Method and device for detecting intrusion of can bus based on imitation message

Abstract

The application relates to the technical field of vehicles and provides a CAN bus intrusion detection method and device based on imitation messages. The method comprises the following steps: acquiring a to-be-sent vehicle signal and a signal data type controlled by a user, determining a corresponding preset signal imitation rule, filling an imitation signal in a reserved bit in a preset associated message, obtaining an imitation message, sending the imitation message to a CAN bus, collecting the imitation message and a to-be-detected message of the CAN bus, determining a preset signal imitation rule corresponding to an imitation signal in each imitation message, judging a current correlation between the imitation signal and a corresponding to-be-sent vehicle signal, determining a matching state between the current correlation and a preset correlation, and determining a current intrusion state of the CAN bus. The method can accurately detect abnormal intrusion, interfere with the cracking of a communication protocol by an intrusion party, save manpower, improve an intrusion identification rate, and has small resource occupation.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of vehicle technology, and more particularly to a method and device for detecting CAN bus intrusion based on counterfeit messages. Background Art

[0002] CAN (Controller Area Network) is an ISO-standardized serial communication protocol and a multi-master serial communication bus widely used in the automotive industry. The CAN bus offers superior real-time performance and is suitable for applications requiring timely data transmission, such as automotive control systems and industrial automation.

[0003] In the related art, for intrusion detection of the CAN bus, a support vector machine model or a neural network model can be used to identify whether the features between the associated data are correct, thereby identifying whether the CAN bus has been invaded. The forms of CAN bus intrusion include but are not limited to at least one of CAN message tampering, CAN message forgery, and CAN message replay. However, based on the support vector machine model or the neural network model, it is necessary to manually identify which data is associated data, and there is not much strongly associated data. The recognition rate of tampering with weakly associated data is very low, the labor cost is high, and the overall detection takes up a lot of computing resources of the controller. On the other hand, the vehicle CAN protocol has many reserved bits. These reserved bits always send the same content (such as 0) by default, which can be easily identified by the intruder, reducing the difficulty of intrusion cracking. Summary of the Invention

[0004] The embodiments of the present application provide a method and apparatus for detecting CAN bus intrusion based on counterfeit messages, so as to solve the technical problems in the related art that CAN bus intrusion detection requires human intervention, has a low intrusion recognition rate, high labor costs, occupies a large amount of computing resources of the controller, and the reserved bits send the same content by default, which is easy to identify and reduces the difficulty of intrusion cracking.

[0005] The embodiment of the present application provides a CAN bus intrusion detection method based on a counterfeit message, and the method comprises the following steps: obtaining a vehicle signal to be sent of a controller; determining a signal data type of the vehicle signal to be sent, determining a preset signal counterfeiting rule corresponding to the vehicle signal to be sent according to the signal data type, wherein the preset signal counterfeiting rule comprises a filling content generation rule and a preset correlation between the vehicle signal to be sent and a counterfeit signal generated based on the filling content generation rule; filling the counterfeit signal in a reserved bit in a preset associated message according to the filling content generation rule based on the preset signal counterfeiting rule, obtaining a counterfeit message of the vehicle signal to be sent, and sending the counterfeit message and a to-be-detected message to a CAN bus through the controller, wherein the to-be-detected message comprises the vehicle signal to be sent; obtaining the counterfeit message and the to-be-detected message sent by one or more controllers through the CAN bus, and determining the preset signal counterfeiting rule corresponding to the counterfeit signal in each counterfeit message; judging the matching state between the current correlation between the counterfeit signal and the vehicle signal to be sent in the corresponding to-be-detected message and the preset correlation based on the preset signal counterfeiting rule, obtaining the matching state result of each counterfeit signal; and determining the current intrusion state of the CAN bus based on the matching state result of all the counterfeit signals, so as to perform CAN bus intrusion detection.

[0006] In an embodiment of the present application, the construction method of the preset signal counterfeiting rule comprises the following steps: obtaining all vehicle signals to be subjected to CAN bus intrusion detection, and counting the signal data types of all the vehicle signals; configuring an initial filling content rule corresponding to each signal data type, wherein the initial filling content rule at least comprises a preset reserved bit number of a reserved bit and a filling content generation rule; determining a preset correlation between a vehicle signal and a counterfeit signal according to the filling content generation rule, wherein the counterfeit signal is generated according to the vehicle signal and the filling content generation rule; and associating the filling content generation rule, the preset correlation and the vehicle signal, to obtain the preset signal counterfeiting rule corresponding to the vehicle signal.

[0007] In an embodiment of the present application, before the step of filling the counterfeit signal in the reserved bit in the preset associated message according to the filling content generation rule based on the preset signal counterfeiting rule, to obtain the counterfeit message of the vehicle signal to be sent, the method comprises the following steps: preconfiguring a preset associated message corresponding to each vehicle signal, wherein the preset associated message comprises a to-be-detected message of the vehicle signal, a same network segment message of the to-be-detected message, or a same cycle message of the to-be-detected message; and determining a blank position with a preset reserved bit number in the preset associated message as the reserved bit, wherein the preset reserved bit number is determined based on the initial filling content rule corresponding to the vehicle signal.

[0008] In one embodiment of the present application, configuring a corresponding filling content generation rule for each signal data type includes at least one of the following: if the signal data type is an enumeration type and the data length of the vehicle signal is less than a preset data length, the filling content generation rule is to copy the vehicle signal as a simulated signal; if the signal data type is an enumeration type and the data length of the vehicle signal is greater than or equal to the preset data length, the filling content generation rule is to change the vehicle signal into associated data and use the associated data as the simulated signal, wherein the associated data and the vehicle signal are signal data corresponding to different signal states of the same vehicle state data; if the signal data type is a continuous numerical type, the filling content generation rule is to determine a simulated bus value of the simulated signal data in the simulated signal according to the original bus value of the vehicle signal, the original signal accuracy of the vehicle signal, the original signal offset of the vehicle signal, a preset distortion coefficient, a preset simulated signal data accuracy, and a preset simulated signal data offset, round the simulated bus value, and determine the simulated signal based on the rounded simulated bus value.

[0009] In one embodiment of the present application, the vehicle signal is changed into associated data, including: obtaining a vehicle status signal data set corresponding to the vehicle status defined by the vehicle signal; if the vehicle signal is vehicle status signal data representing an initial state or an invalid state in the vehicle status signal data set, determining the associated data as the vehicle signal itself; if the vehicle signal is variable-order vehicle status signal data, sorting all variable-order vehicle status signal data to obtain an initial signal sequence, using the inverse sequence of the initial signal sequence as an associated signal sequence, obtaining the initial sorting of the vehicle signal in the initial signal sequence, and determining the variable-order vehicle status signal data at the initial sequence position of the associated signal sequence as the associated data, wherein the variable-order vehicle status signal data is vehicle status signal data representing other than the initial state and the invalid state in the vehicle status signal data set.

[0010] In one embodiment of the present application, determining a simulated bus value of simulated signal data in a simulated signal based on an original bus value of the vehicle signal, an original signal accuracy of the vehicle signal, an original signal offset of the vehicle signal, a preset distortion coefficient, a preset simulated signal data accuracy, and a preset simulated signal data offset includes:

[0011] S 仿 =(g*(S 原 *R 原 +Offset 原 )-Offset 仿 ) / R 仿 ,

[0012] Among them, S仿 is a preset distortion coefficient, S 原 is an original bus value of a vehicle signal, R 原 is an original signal precision of a vehicle signal, Offset 原 is an original signal offset of a vehicle signal, Offset 仿 is a preset fake signal data offset, R 仿 is a preset fake signal data precision; wherein a deviation between the fake bus value and the original bus value is less than a preset deviation threshold.

[0013] In an embodiment of the present application, the current intrusion state of the CAN bus is determined based on matching state results of all fake signals, including: if matching state results of more than a preset number of fake signals are matching failure, the current intrusion state of the CAN bus is intrusion, a preset intrusion flag is set to a preset identification, and an attacked message is reported to a cloud platform; if matching state results of less than or equal to the preset number of fake signals are matching failure, the current intrusion state of the CAN bus is non-intrusion.

[0014] In an embodiment of the present application, if the current intrusion state of the CAN bus is intrusion, after a preset time when the current intrusion state is detected to be intrusion, the controller is controlled to send a newly generated to-be-detected message to the CAN bus in reverse until the vehicle is powered on again.

[0015] In an embodiment of the present application, after a preset time when the current intrusion state is detected to be intrusion, the method further includes: obtaining a new fake message corresponding to the newly generated to-be-detected message sent by the controller through the CAN bus, and determining a new preset signal fake rule corresponding to a new fake signal in the new fake message; judging a matching state between a new current correlation relationship between the new fake signal and a new to-be-sent vehicle signal in the new to-be-detected message and a preset correlation relationship based on the new preset signal fake rule; if the matching state result is matching failure, inverting the new to-be-detected message, judging a matching state between a new current correlation relationship between the new to-be-sent vehicle signal in the inverted new to-be-detected message and the corresponding new fake signal and a preset correlation relationship based on the new preset signal fake rule; if the matching state result is matching success, inverting all to-be-detected messages obtained through the CAN bus afterwards, judging a matching state between a current correlation relationship between a to-be-sent vehicle signal in the inverted to-be-detected message and a corresponding fake signal and a preset correlation relationship based on a preset signal fake rule corresponding to the fake signal, until the vehicle is powered on again.

[0016] The embodiment of the present application also provides a CAN bus intrusion detection device based on counterfeit messages, the device comprising: an acquisition module for acquiring a vehicle signal to be sent from a controller; a rule matching module for determining a signal data type of the vehicle signal to be sent, and determining a preset signal counterfeiting rule corresponding to the vehicle signal to be sent according to the signal data type, the preset signal counterfeiting rule comprising a filling content generation rule, and a preset correlation between the vehicle signal to be sent and the counterfeit signal generated based on the filling content generation rule; a message counterfeiting module for filling a reserved position in a preset associated message according to the filling content generation rule based on the preset signal counterfeiting rule, obtaining a counterfeit message of the vehicle signal to be sent, and detecting the counterfeit message by the counterfeit message. The controller sends the simulated message and the message to be detected to the CAN bus, wherein the message to be detected includes the vehicle signal to be sent; the simulated signal acquisition module is used to obtain the simulated messages and the message to be detected sent by one or more controllers through the CAN bus, and determine the preset signal simulation rule corresponding to the simulated signal in each simulated message; the matching module is used to determine the matching status between the current correlation between the simulated signal and the vehicle signal to be sent in the corresponding message to be detected and the preset correlation based on the preset signal simulation rule, and obtain the matching status result of each simulated signal; the intrusion detection module is used to determine the current intrusion status of the CAN bus based on the matching status results of all simulated signals, so as to perform CAN bus intrusion detection.

[0017] An embodiment of the present application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any one of the above embodiments when executing the computer program.

[0018] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the method described in any one of the above embodiments is implemented.

[0019] The above-mentioned method and device for CAN bus intrusion detection based on counterfeit messages, the method obtains the controlled vehicle signal to be sent and the signal data type of the signal, then determines the corresponding preset signal counterfeiting rule according to the signal data type, fills the reserved position in the preset associated message with the counterfeit signal according to the preset signal counterfeiting rule, obtains the counterfeit signal and sends it to the CAN bus, collects the counterfeit signal of the CAN bus and the message to be detected generated based on the vehicle signal to be sent, determines the preset signal counterfeiting rule corresponding to the counterfeit signal in each counterfeit message, judges the current correlation between the counterfeit signal and the vehicle signal to be sent in the corresponding message to be detected, and further determines the current correlation The matching status between the relationship and the preset correlation relationship is then used to determine the current intrusion status of the CAN bus based on the matching status results of all the simulated signals, thus achieving CAN bus intrusion detection. By constructing a simulated signal and based on whether the current correlation between the simulated signal and the vehicle message to be sent in the message to be detected matches the preset correlation relationship, abnormal intrusions can be accurately detected, effectively interfering with the intruder's cracking of the communication protocol, and increasing the difficulty of cracking. It does not require excessive human intervention, saving manpower and improving the intrusion recognition rate. Compared with the method of using support vector machine models or neural network models to identify whether the features between related data are correct, it also consumes less computing resources of the controller. By constructing a simulated signal in the reserved bit, the content of the reserved bit is slightly changed, making it difficult to identify, and increasing the difficulty of cracking. In addition, after a certain degree of intrusion occurs, the newly generated message to be detected is transformed and sent again. Since the intruder may mistake the simulated message containing the simulated signal as the message to be detected, the difficulty of cracking can be further increased. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 A flowchart of a method for detecting CAN bus intrusion based on counterfeit messages provided in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of the structure of a CAN bus intrusion detection device based on counterfeit messages provided in an embodiment of the present application;

[0023] Figure 3 A schematic structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all of them. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0025] Please refer to Figure 1 as shown, Figure 1 A flowchart of a CAN bus intrusion detection method based on forged messages provided by the embodiments of the present application is shown in the figure. The method comprises the following steps:

[0026] In step S110, the to-be-sent vehicle signals of the controller are acquired.

[0027] The method can determine which controllers to construct the forged signals based on which to-be-sent vehicle signals according to the number of target controllers preset by those of ordinary skill in the art. In other words, the number of controllers can be one or more, which is not limited herein. In the above embodiments, the implementation mode of one controller is taken as an example, and when the number of controllers is more than one, the provided forged signal construction mode can be referred to for implementation. The number of to-be-sent vehicle signals corresponding to each controller can be one or more, which is not limited herein.

[0028] The generation of the forged signal based on the to-be-sent vehicle signal can be realized by the controller itself or by other devices preset by those of ordinary skill in the art.

[0029] In the related art, since the CAN bus can generally receive messages sent by multiple ECUs (Electronic Control Unit), those of ordinary skill in the art can specify which ECU or which part of the ECUs connected to the CAN bus as the controller in the present method.

[0030] In step S120, the signal data type of the to-be-sent vehicle signal is determined, and a preset signal forging rule corresponding to the to-be-sent vehicle signal is determined according to the signal data type.

[0031] The preset signal forging rule comprises a padding content generation rule and a preset correlation between the to-be-sent vehicle signal and the forged signal generated based on the padding content generation rule.

[0032] It can be understood that each type of signal data is pre-configured with a corresponding preset signal simulation rule, and the preset signal simulation rule is stored in the controller or other device for generating a simulated signal, and the preset signal simulation rule is stored in the intrusion detection device, so that the execution of the scheme is facilitated.

[0033] The signal data type includes but is not limited to enumeration type and continuous numerical type, etc., wherein the enumeration type is divided into two types according to the length of the signal data, i.e., enumeration type less than a preset data length and enumeration type greater than or equal to a preset data length. For example, the bit length of the vehicle signal to be sent, such as brake pedal state (0x0: Not pressed 0x1: Pressed), main positive relay state (0x0: Open 0x1: Close 0x2: Fault), high-pressure tank pressure relief request (0x0: No Request 0x1: Request 0x2: Reserved 0x3: Invalid) and the like, which is less than 3 (or other values set by those skilled in the art) can be used as the enumeration type of the vehicle signal to be sent which is less than the preset data length; the bit length greater than or equal to 3, such as target gear (0x1: P 0x2: R 0x3: N 0x4: D 0x5: Invalid value), actual gear (0x0: Undefined initial value 0x1: P gear 0x2: R gear 0x3: N gear 0x4: D gear), vehicle driving mode (0x0: Initial 0x1: ECO 0x2: Comfort 0x3: Sport 0x4: Individual 0x5: Wet 0x6: Snow 0x7: Escape 0x8: Race 0x9: Reserved) and the like can be used as the enumeration type of the vehicle signal to be sent which is greater than or equal to the preset data length; and the charging target SOC (precision 1, offset 0, 7 bits, physical value = bus value converted decimal * precision + offset, 0x7F: Invalid), throttle pedal opening (precision 0.1, offset 0, 10 bits, 0x3FF: Invalid) and the like can be used as the continuous numerical type of the vehicle signal to be sent.

[0034] In one embodiment, a method for constructing a preset signal imitation rule includes: obtaining all vehicle signals that require CAN bus intrusion detection, and counting the signal data types of all vehicle signals; configuring a corresponding initial filling content rule for each signal data type, the initial filling content rule including at least a preset number of reserved bits and a filling content generation rule; determining a preset correlation between the vehicle signal and the imitation signal based on the filling content generation rule, and generating the imitation signal based on the vehicle signal and the filling content generation rule; and associating the filling content generation rule, the preset correlation, and the vehicle signal to obtain a preset signal imitation rule corresponding to the vehicle signal.

[0035] Continuing from the above embodiment, based on the preset signal imitation rule, the reserved bits in the preset associated message are filled with imitation signals according to the filling content generation rule, and before obtaining the imitation message of the vehicle signal to be sent, the method includes: pre-configuring a corresponding preset associated message for each vehicle signal, the preset associated message including the message to be detected where the vehicle signal is located, the message in the same network segment as the message to be detected, or the message in the same period as the message to be detected; determining the blank position of the preset reserved bit number in the preset associated message as the reserved bit, and the preset reserved bit number is determined based on the initial filling content rule corresponding to the vehicle signal.

[0036] The preset associated message is a message pre-set by those skilled in the art to have an associated relationship with the message to be detected. Generally speaking, the message to be detected and / or messages in the same network segment and period as the message to be detected can be used as the preset associated message.

[0037] Since there are often blank positions in a message without any filling content, a certain number of blank positions can be selected in advance in the preset associated message as reserved positions.

[0038] The aforementioned initial message counterfeiting rule, as a general rule, often represents the initial filling content rule of the reserved bit. The initial filling content rule at least includes the preset number of reserved bits and the filling content generation rule of the blank content in the reserved bit.

[0039] Since the filler content generation rule represents a rule for converting the to-be-sent vehicle signal into a simulated signal via a preset conversion relationship, the preset correlation between the to-be-sent vehicle signal of the to-be-detected message and the simulated signal of the simulated signal can be determined based on the filler content generation rule. For example, if the filler content generation rule could be replication, then the preset correlation between the to-be-sent vehicle signal of the to-be-detected message and the simulated signal of the simulated signal should be the same. For another example, if the filler content generation rule could be conversion of the to-be-sent vehicle signal into a corresponding associated signal, then the preset correlation should be the correlation between the conversion of the to-be-sent vehicle signal and the associated signal.

[0040] It can be understood that the correlation relationship can be that the vehicle signal to be sent and the imitation signal are extracted from the message to be detected and the imitation signal respectively, and the correlation relationship between the vehicle signal to be sent and the imitation signal is used as the preset correlation relationship between the message to be detected and the imitation signal generated based on the filling content generation rule.

[0041] The controller to be detected is also the target controller mentioned in the above embodiment that needs to perform CAN bus intrusion detection. By obtaining the message identifiers and signal data types of the messages to be detected of all the controllers to be detected in advance, the initial filling content rules are determined based on the signal data type. An initial filling content rule is constructed in advance for each signal data type, and the association relationship between the signal data type and the initial filling content rule is obtained. Based on the association relationship, the initial filling content rule is obtained by matching the signal data type. The initial filling content rule at least stipulates the number of reserved bits for the reserved bits, so as to find a suitable number of blank positions from the preset associated message. The initial filling content rule should also include a filling content generation rule, which represents what kind of conversion of the vehicle signal to be detected can obtain the filling content, or in other words, based on the filling content generation rule, the conversion relationship between the vehicle signal to be detected and the filling content can be obtained, that is, the preset correlation relationship. The conversion relationship can be a copy, a mapping relationship or a calculation formula, etc.

[0042] The preset associated message can be the message to be detected itself, or it can be other messages with the same period and / or the same network segment as the message to be detected, or it can be said that the preset associated message is at least one of the message to be detected, the message with the same period as the message to be detected, and the message with the same network segment as the message to be detected.

[0043] The above-mentioned pre-configuration process can be completed before the method is executed. In this way, the signal data type can be directly used to search during the subsequent execution of the method to obtain the preset signal simulation rules corresponding to the signal data type. Those skilled in the art can modify the preset signal simulation rules after the method is executed a certain number of times or when necessary.

[0044] As an example, after the preset signal imitation rules are generated, they can be stored locally in the corresponding controller. In this way, when the controller collects the vehicle signal to be sent, it can obtain the preset signal imitation rules locally and then construct the imitation signal.

[0045] Following the above embodiment, configuring a corresponding filling content generation rule for each signal data type includes at least one of the following:

[0046] If the signal data type is an enumeration type and the data length of the vehicle signal is less than the preset data length, the padding content generation rule is to copy the vehicle signal as the imitation signal;

[0047] If the signal data type is an enumeration type, and the data length of the vehicle signal is greater than or equal to the preset data length, the fill content generation rule is to change the vehicle signal into associated data, use the associated data as the simulated signal, and the associated data and the vehicle signal are signal data corresponding to different signal states of the same vehicle state data;

[0048] If the signal data type is a continuous numeric type, the filling content generation rule is to determine the simulated bus value of the simulated signal data in the simulated signal based on the original bus value of the vehicle signal, the original signal accuracy of the vehicle signal, the original signal offset of the vehicle signal, the preset distortion coefficient, the preset simulated signal data accuracy and the preset simulated signal data offset, round the simulated bus value, and determine the simulated signal based on the rounded simulated bus value.

[0049] In this way, after obtaining the vehicle signal to be sent, corresponding filling content generation rules can be known based on the signal data type to which the vehicle signal to be sent belongs.

[0050] Continuing with the above embodiment, if the signal data type is an enumeration type and the data length of the vehicle signal to be transmitted is greater than or equal to a preset data length, the vehicle signal is converted into associated data, including: obtaining a vehicle state signal data set corresponding to the vehicle state defined by the vehicle signal; if the vehicle signal is vehicle state signal data representing an initial state or an invalid state in the vehicle state signal data set, determining the associated data as the vehicle signal itself; if the vehicle signal is variable-sequence vehicle state signal data, sorting all variable-sequence vehicle state signal data to obtain an initial signal sequence, using the inverse sequence of the initial signal sequence as the associated signal sequence, obtaining an initial sort of the vehicle signal in the initial signal sequence, and determining the variable-sequence vehicle state signal data at the initial sequence position of the associated signal sequence as the associated data, wherein the variable-sequence vehicle state signal data is vehicle state signal data representing vehicle states other than the initial state and the invalid state in the vehicle state signal data set. For this type of signal data, the number of signals corresponding to it is often limited. In this case, by selecting another vehicle signal from the vehicle state signal data set that is different from the real signal as a counterfeit signal, an intruder can be confused and unable to identify the real vehicle signal, thereby increasing the difficulty of signal cracking and improving data security.

[0051] As an example, the simulated bus value can be determined by determining a first product between the original bus value and the original signal accuracy, summing the product with the original signal offset to obtain a current sum value, subtracting the current sum value from the preset simulated signal data offset to obtain a current difference value, determining a second product of the preset distortion coefficient and the current difference value, and then using the quotient of the second product and the preset simulated signal data accuracy as the simulated bus value.

[0052] Continuing with the above embodiment, if the signal data type is a continuous numeric type, determining the simulated bus value of the simulated signal data in the simulated signal based on the original bus value of the vehicle signal, the original signal accuracy of the vehicle signal, the original signal offset of the vehicle signal, a preset distortion coefficient, a preset simulated signal data accuracy, and a preset simulated signal data offset includes:

[0053] S 仿 =(g*(S 原 *R 原 +Offset 原 )-Offset 仿 ) / R 仿 ,

[0054] Among them, S 仿 is the simulated bus value, g is the preset distortion coefficient, S 原 is the original bus value of the vehicle signal, R 原 is the original signal accuracy of the vehicle signal, Offset 原 Offset is the original signal offset of the vehicle signal. 仿 To preset the simulated signal data offset, R 仿 Preset simulated signal data accuracy.

[0055] The deviation between the simulated bus value and the original bus value is less than a preset deviation threshold. The preset deviation threshold can be determined by determining the difference between the simulated bus value and the original bus value, and taking the quotient of the difference and the original bus value as the preset deviation threshold. The preset deviation threshold is greater than 0 and less than 1. As an example, it can be 10%.

[0056] Through the above method, continuous numerical signal data can be simulated so that the simulated value is very similar to the real value, and the real value can be protected.

[0057] Step S130 , based on the preset signal imitation rule, the reserved position in the preset associated message is filled with an imitation signal according to the filling content generation rule to obtain an imitation message of the vehicle signal to be sent, and the imitation message and the message to be detected are sent to the CAN bus through the controller.

[0058] The message to be detected includes a vehicle signal to be sent.

[0059] The vehicle signal to be sent can be modified or copied by filling in the content generation rule, and then a counterfeit signal is obtained, which is filled in the reserved position according to the preset filling order to obtain the counterfeit signal. The counterfeit signal is then sent to the CAN bus.

[0060] The above provides methods for generating and transmitting dummy signals. A controller may correspond to one or more vehicle signals to be detected, that is, one or more messages to be detected. Each of these signals can be used to generate and transmit dummy signals using the above methods. If there are multiple controllers to be detected, each controller can use the same methods to generate and transmit dummy signals.

[0061] Step S140: acquiring the counterfeit signals and the message to be detected sent by one or more controllers via the CAN bus, and determining the preset signal counterfeiting rule corresponding to the counterfeit signal of each counterfeit message.

[0062] Steps S140 to S160 may be executed by the gateway, or by a designated controller, or by the gateway and the controller in cooperation.

[0063] In one embodiment, the preset signal emulation rule corresponding to each emulated signal can be determined by the signal data type of the emulated signal, and the preset signal emulation rule corresponding to each emulated signal can be pre-stored in the gateway and / or designated controller that performs steps S140 to S160.

[0064] Step S150 , based on the preset signal imitation rule, the matching status between the current correlation between the imitation signal and the corresponding vehicle signal to be sent in the message to be detected and the preset correlation is determined to obtain the matching status result of each imitation signal.

[0065] In one embodiment, determining a matching status between a current correlation relationship between a simulated signal and a corresponding message to be detected and a preset correlation relationship based on a preset signal simulated rule includes: extracting a simulated signal from the simulated signal according to the preset signal simulated rule, then extracting a signal to be sent from the message to be detected, and then obtaining a current correlation relationship based on the simulated signal and the signal to be sent, and then obtaining a matching status result by matching a preset correlation relationship in the preset signal simulated rule with the current correlation relationship.

[0066] As mentioned in the above embodiment, the preset signal imitation rule includes information about reserved bits, based on which the filling contents on the reserved bits can be extracted and reorganized according to a preset filling sequence to obtain an imitation signal.

[0067] Step S160 , determining the current intrusion status of the CAN bus based on the matching status results of all the simulated signals to perform CAN bus intrusion detection.

[0068] In one embodiment, the current intrusion status of the CAN bus is determined based on the matching status results of all the simulated signals, including: if the matching status results of more than a preset number of simulated signals are matching failures, the current intrusion status of the CAN bus is intrusion, a preset intrusion flag position is set to a preset identifier, and an attack message is reported to the cloud platform; if the matching status results of less than or equal to the preset number of simulated signals are matching failures, the current intrusion status of the CAN bus is not intruded.

[0069] The preset number can be set by those skilled in the art as needed. The time of each detection cycle can also be set by those skilled in the art as needed, and re-detection is performed after exceeding the detection cycle.

[0070] Continuing with the above embodiment, if the current intrusion status of the CAN bus is intrusion, after a preset time has passed since the current intrusion status was detected, the controller will invert the newly generated message to be detected and send it to the CAN bus until the vehicle is powered on again. Since the intrusion has occurred, the forged message or the message to be detected is unreliable. In this case, message inversion can be performed, such as reversing the order in which the vehicle data to be sent is filled in the message to be detected, thereby increasing the difficulty of cracking by the intruder to a certain extent.

[0071] Continuing with the above embodiment, after the current intrusion state is detected as a preset intrusion time, in other words, when the intrusion occurs for a period of time, such as 3 seconds, the method further includes: acquiring, via the CAN bus, a new counterfeit message corresponding to the newly generated message to be detected sent by the controller, and determining a new preset signal counterfeiting rule corresponding to a new counterfeit signal in the new counterfeit message; and determining, based on the new preset signal counterfeiting rule, a matching status between a new current correlation between the new counterfeit signal and the new vehicle signal to be sent in the corresponding new message to be detected and a preset correlation (the preset correlation corresponding to the new preset signal counterfeiting rule); If the matching status result is a matching failure, the new message to be detected is inverted, and the matching status between the new current correlation relationship and the preset correlation relationship between the new vehicle signal to be sent of the inverted new message to be detected and the corresponding new imitation signal is judged based on the new preset signal imitation rule; if the matching status result is a matching success, all subsequent messages to be detected obtained through the CAN bus are first inverted, and the matching status between the current correlation relationship and the preset correlation relationship between the vehicle signal to be sent of the inverted message to be detected and the corresponding imitation signal is judged based on the preset signal imitation rule corresponding to the imitation signal until the vehicle is powered on again.

[0072] The preset time can be set by those skilled in the art as needed, such as 3 seconds. This waiting time allows the front-end controller to prepare and send message inversion, avoiding a one-size-fits-all time difference that could lead to parsing confusion. Initially, the original intrusion detection method is used. If inversion has not occurred, intrusion detection continues as before. If inversion has occurred, the current result is a match failure, and inversion of the message to be detected is then performed again before intrusion detection is performed again.

[0073] The above-mentioned embodiment provides a CAN bus intrusion detection method based on counterfeit messages. The method obtains a controlled vehicle signal to be sent and a signal data type of the signal, and then determines a corresponding preset signal counterfeiting rule based on the signal data type. The counterfeit signal is filled in the reserved position in the preset associated message according to the preset signal counterfeiting rule to obtain a counterfeit signal and send it to the CAN bus. The counterfeit signal of the CAN bus and the message to be detected generated based on the vehicle signal to be sent are collected, and the preset signal counterfeiting rule corresponding to the counterfeit signal in each counterfeit message is determined to judge the current correlation between the counterfeit signal and the vehicle signal to be sent in the corresponding message to be detected, and further determine the current correlation. The matching status between the simulated signal and the preset correlation is used to determine the current intrusion status of the CAN bus. This allows for CAN bus intrusion detection. By constructing a simulated signal and determining whether the current correlation between the simulated signal and the vehicle message to be sent in the message to be detected matches the preset correlation, the system can accurately detect abnormal intrusions, effectively interfering with the intruder's cracking of the communication protocol, and increasing the difficulty of cracking. This system does not require excessive human intervention, saving manpower and improving the intrusion recognition rate. Compared to methods that use support vector machine models or neural network models to identify whether the features between associated data are correct, it also consumes less computing resources in the controller. By constructing a simulated signal in a reserved bit, the content of the reserved bit is subject to certain changes, making it difficult to identify and increasing the difficulty of cracking. In addition, after a certain degree of intrusion occurs, the newly generated message to be detected is transformed and retransmitted. Since the intruder may mistake the simulated message containing the simulated signal as the message to be detected, the difficulty of cracking can be further increased.

[0074] By using a large number of reserved bits to imitate important signals to obtain imitated signals, it is possible to effectively interfere with the intruder's cracking of the communication protocol; establishing a correlation between the imitated signal and the original important signal (the vehicle signal to be sent) and detecting the correlation can detect the occurrence of intrusion to a certain extent; after a certain degree of intrusion occurs, the original important signal is transformed and sent, further increasing the difficulty of cracking, because at this time the intruder will think that the imitated signal is the original important message.

[0075] The following describes a specific example of the CAN bus intrusion detection method based on forged messages provided in the above embodiment. To accurately detect intrusion, the data characteristics of the reserved bits (unused bits) in each message must be obvious, and any failure to set the reserved bits in any message according to the rules will result in the forged signal being corrupted.

[0076] Vehicles have many important signals, but different signals require different simulation methods. This is because different signals vary in their behavior, bit length, and data type. Based on whether the data is an enumeration (continuous value) and the bit length, the signals to be simulated are categorized into three types, each requiring a different simulation method.

[0077] The first type is enumerated data with a bit length of less than 3; for example, the brake pedal status (0x0: Not pressed 0x1: Pressed), the main positive relay status (0x0: Open 0x1: Close 0x2: Fault), and the high-pressure fuel tank pressure relief request (0x0: NoRequest 0x1: Request 0x2: Reserved 0x3: Invalid).

[0078] This type of signal has limited states and is easily matched to the vehicle state. Therefore, when imitating such a signal, it is necessary to fill the reserved bits of the same message with the same signal (or the reserved bits of the message with the same network segment and the same period).

[0079] The reason for not changing the counterfeit signal is that there are too few states, and it is easy to find that the counterfeit signal is fake. If they are the same, it is difficult for an intruder to distinguish which one is the counterfeit message.

[0080] The second type is an enumeration type with a bit length ≥ 3; for example, the target gear (0x1: P 0x2: R 0x3: N 0x4: D 0x5: invalid value), the actual gear (0x0: Undefined initial value 0x1: P gear 0x2: R gear 0x3: N gear 0x4: D gear), the vehicle driving mode (0x0: Initial 0x1: ECO 0x2: Comfort 0x3: Sport 0x4: Individual 0x5: Wet 0x6: Snow 0x7: Escape 0x8: Race 0x9: Reserved), etc.

[0081] This type of signal has many states, and the states defined by the signal can be interchanged in a certain order, which further increases the difficulty of cracking. Because of some default rules designed by the CAN communication protocol, 0x0 and 0xn generally represent the initial value (default value) and invalid value respectively. Therefore, for a signal with n+1 states (including invalid and initial states), keep the values ​​0x0 and 0xn unchanged. For the remaining n-1 states, that is, the i-th state (0xi) from 1 to n-1, at this time,

[0082] i 仿 =(0.5*(n-1)-i 原 )*2+i 原 ,

[0083] Among them, i 仿 The serial number of the state signal of the imitation signal, i 原 is the sequence number of the status signal of the vehicle message (real message) to be sent, and n is the number of other status signals except the invalid state.

[0084] It can be understood as swapping the states of the two sides along the center.

[0085] According to the above rules, this type of counterfeit signal is obtained. Similarly, it is best to fill the reserved bit of the same message with the counterfeit signal (or the reserved bit of the message with the same network segment and the same period).

[0086] The third type is continuous numerical data, such as charging target SOC (precision is 1, offset is 0, occupies 7 bits, physical value = decimal value converted from bus value * precision + offset, 0x7F: Invalid), accelerator pedal opening (precision is 0.1, offset is 0, occupies 10 bits, 0x3FF: Invalid).

[0087] Similarly, due to some default rules designed into the CAN communication protocol, 0xn, the maximum bus value of the signal, generally represents an invalid value. Therefore, when simulating a continuous numeric signal, this characteristic should be maintained. Furthermore, continuous numeric signals often represent a specific physical value and cannot be arbitrarily changed, otherwise they can easily be identified as erroneous counterfeit signals. To ensure sufficient authenticity, the true content of the real signal must be kept confidential. This can be achieved by changing the precision and offset. Although the physical value represented is similar, the physical value parsed from the bus value is distorted.

[0088] For example, P 原 Indicates the physical value represented by the original signal, R 原 Indicates the accuracy of the original signal, Offset 原 Indicates the offset of the original signal, S原 Indicates the bus value of the original signal (decimal). 仿 Indicates the physical value represented by the original signal, R 仿 Indicates the accuracy of the original signal, Offset 仿 Indicates the offset of the original signal, S 仿 Indicates the bus value of the original signal (decimal).

[0089] In order to make P 仿 There is a certain degree of distortion, so let P 仿 =gP 原 .

[0090] S 仿 *R 仿 +Offset 仿 =g*(S 原 *R 原 +Offset 原 ).

[0091] Then according to S 原 Get S 仿 , the specific formula is as follows:

[0092] S 仿 =(g*(S 原 *R 原 +Offset 原 )-Offset 仿 ) / R 仿 ,

[0093] Among them, S 仿 is the simulated bus value, g is the preset distortion coefficient, S 原 is the original bus value of the vehicle signal, R 原 is the original signal accuracy of the vehicle signal, Offset 原 Offset is the original signal offset of the vehicle signal. 仿 To preset the simulated signal data offset, R 仿 Preset simulated signal data accuracy.

[0094] Because the imitation signal is eventually sent to the bus, it must be an integer, so the Simulation obtained above must be rounded [S 仿] This is the simulated signal. g is the distortion factor, which is used to create a certain degree of distortion in the simulated signal's physical value. Even if the simulated signal is cracked, the true physical value will not be fully exposed to the intruder. g can be an empirical value, such as g = 0.99, or it can be adjusted appropriately based on the bit length of the simulated signal. The larger the bit length, the smaller the difference between g and 1 should be. For continuous numerical signals, longer bits represent a larger range or higher precision, and distortion (the difference between g and 1) can be less significant, because even a small amount of distortion has a significant impact on the signal.

[0095] As for S 仿 With S 原 The difference shall not exceed 10%S 原 Because the accuracy range required for the vehicle's physical signal is well known to professionals, if the difference is large, it is easy to be detected. Moreover, the larger the difference in accuracy, the greater the difference in length between the counterfeit signal and the original message, and the lower the counterfeiting effect.

[0096] Offset 仿 You can select it according to experience, as long as it does not violate the requirement that the simulated signal covers the physical maximum and minimum values. If the offset of the simulated signal is too outrageous, the S 仿 It may not be sent at all, or it may take up a very long bit, which not only occupies reserved bit resources but also has a very poor imitation effect.

[0097] The forged signals are constructed based on three types. A correlation (preset correlation) is also constructed between the forged signals and the vehicle signals to be sent in the original message. This correlation can be used for detection. If the correlation is broken, it indicates that the important message has been tampered with. In this case, the intrusion flag can be set to 1 and the attack can be reported to the cloud platform.

[0098] After a controller detects that the correlation of its own important signals has been broken (immediately sends an intrusion flag) for 3 seconds, or receives an intrusion flag from another controller for 3 seconds, it sends the original important message in reverse order. That is, instead of sending 000101, it now sends 101000. The original transmission method is restored after power is turned on and off.

[0099] The 3-second delay before inverting the transmission gives the controller receiving the important message time to synchronize the protocol parsing changes. Furthermore, inverting the transmission further protects the original message from detection. The controller receiving the important message determines whether the inversion has occurred based on the correlation between the original and counterfeit signals. If the original and counterfeit signals are uncorrelated, the controller further inverts the original signal to determine the correlation. If they are uncorrelated, the controller receives and processes the message according to the original protocol until 4 seconds after the intrusion, when it automatically parses the message according to the inverted protocol. If the first signal is coherent, the controller receives and processes the message according to the original protocol. If the first signal is uncorrelated (match failed), the second signal is coherent (match successful), and the inverted protocol is parsed until the original parsing method is restored after power is turned on and off.

[0100] In one embodiment, a CAN bus intrusion detection device based on forged messages is provided. The CAN bus intrusion detection device based on forged messages is used to perform the steps of the CAN bus intrusion detection method provided in any of the above embodiments. Figure 2 , Figure 2 A structural diagram of a CAN bus intrusion detection device based on counterfeit messages provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the CAN bus intrusion detection device 200 based on counterfeit messages includes: an acquisition module 201, used to acquire the vehicle signal to be sent from the controller; a rule matching module 202, used to determine the signal data type of the vehicle signal to be sent, and determine the preset signal counterfeiting rule corresponding to the vehicle signal to be sent according to the signal data type, the preset signal counterfeiting rule including a filling content generation rule and a preset correlation between the vehicle signal to be sent and the counterfeit signal generated based on the filling content generation rule; a message counterfeiting module 203, used to fill the reserved position in the preset associated message with the counterfeit signal according to the filling content generation rule based on the preset signal counterfeiting rule, to obtain the counterfeit message of the vehicle signal to be sent, and to send the counterfeit message to the controller through the controller. The message and the message to be detected are sent to the CAN bus, and the message to be detected includes the vehicle signal to be sent; the imitation signal acquisition module 204 is used to obtain the imitation messages and the message to be detected sent by one or more controllers through the CAN bus, and determine the preset signal imitation rule corresponding to the imitation signal in each imitation message; the matching module 205 is used to determine the matching status between the current correlation between the imitation signal and the vehicle signal to be sent in the corresponding message to be detected and the preset correlation based on the preset signal imitation rule, and obtain the matching status result of each imitation signal; the intrusion detection module 206 is used to determine the current intrusion status of the CAN bus based on the matching status results of all imitation signals to perform CAN bus intrusion detection.

[0101] In one embodiment, the device also includes a preset signal imitation rule construction module, which is used to obtain all vehicle signals that require CAN bus intrusion detection and count the signal data types of all vehicle signals; configure a corresponding initial filling content rule for each signal data type, the initial filling content rule at least including a preset number of reserved bits and a filling content generation rule; determine a preset correlation between the vehicle signal and the imitation signal according to the filling content generation rule, and generate the imitation signal according to the vehicle signal and the filling content generation rule; associate the filling content generation rule, the preset correlation and the vehicle signal to obtain the preset signal imitation rule corresponding to the vehicle signal.

[0102] In one embodiment, the preset signal imitation rule construction module is further configured to: fill the reserved bits in the preset associated message with imitation signals according to the filling content generation rule based on the preset signal imitation rule, and before obtaining the imitation message of the vehicle signal to be sent, pre-configure a corresponding preset associated message for each vehicle signal, the preset associated message including the message to be detected where the vehicle signal is located, the message in the same network segment as the message to be detected, or the message in the same period as the message to be detected; determine the blank position of the preset reserved bit number in the preset associated message as the reserved bit, and the preset reserved bit number is determined based on the initial filling content rule corresponding to the vehicle signal.

[0103] In one embodiment, the preset signal imitation rule construction module is further configured as at least one of the following: if the signal data type is an enumeration type and the data length of the vehicle signal is less than the preset data length, the filling content generation rule is to copy the vehicle signal as the imitation signal; if the signal data type is an enumeration type and the data length of the vehicle signal is greater than or equal to the preset data length, the filling content generation rule is to change the vehicle signal into associated data and use the associated data as the imitation signal, and the associated data and the vehicle signal are signal data corresponding to different signal states of the same vehicle state data; if the signal data type is a continuous numerical type, the filling content generation rule is to determine the imitation bus value of the imitation signal data in the imitation signal according to the original bus value of the vehicle signal, the original signal accuracy of the vehicle signal, the original signal offset of the vehicle signal, the preset distortion coefficient, the preset imitation signal data accuracy and the preset imitation signal data offset, round the imitation bus value, and determine the imitation signal based on the rounded imitation bus value.

[0104] In an embodiment, the preset signal imitation rule construction module is further configured to: acquire a vehicle state signal data set corresponding to a vehicle state defined by the vehicle signal; if the vehicle signal is a vehicle state signal data in the vehicle state signal data set representing an initial state or an invalid state, determine the associated data as the vehicle signal itself; if the vehicle signal is a variable sequence vehicle state signal data, sort all the variable sequence vehicle state signal data to obtain an initial signal sequence, take the reverse sequence of the initial signal sequence as an associated signal sequence, acquire the initial sequence position of the vehicle signal in the initial signal sequence, and determine the variable sequence vehicle state signal data at the initial sequence position of the associated signal sequence as the associated data, the variable sequence vehicle state signal data being a vehicle state signal data in the vehicle state signal data set representing a vehicle state other than the initial state and the invalid state.

[0105] In an embodiment, the preset signal imitation rule construction module is further configured to: determine an imitation bus value of the imitation signal data in the imitation signal according to an original bus value of the vehicle signal, an original signal precision of the vehicle signal, an original signal offset of the vehicle signal, a preset distortion coefficient, a preset imitation signal data precision, and a preset imitation signal data offset, including:

[0106] S 仿 = (g * (S 原 * R 原 + Offset 原 ) - Offset 仿 ) / R 仿 ,

[0107] wherein S 仿 is the imitation bus value, g is the preset distortion coefficient, S 原 is the original bus value of the vehicle signal, R 原 is the original signal precision of the vehicle signal, Offset 原 is the original signal offset of the vehicle signal, Offset 仿 is the preset imitation signal data offset, and R 仿 is the preset imitation signal data precision; wherein the deviation between the imitation bus value and the original bus value is less than a preset deviation threshold.

[0108] In an embodiment, the intrusion detection module is configured to: if the matching state result of more than a preset number of imitation signals is a matching failure, the current intrusion state of the CAN bus is intrusion, set a preset intrusion flag position to a preset identifier, and report an attacked message to a cloud platform; if the matching state result of less than or equal to a preset number of imitation signals is a matching failure, the current intrusion state of the CAN bus is non-intrusion.

[0109] In one embodiment, the device further includes an inversion module, which is used to control the controller to invert and send the newly generated message to be detected to the CAN bus after a preset time when the current intrusion state of the CAN bus is intrusion, until the vehicle is powered on again.

[0110] In one embodiment, the inversion module is further configured to, after detecting that the current intrusion state is a preset time of intrusion, obtain, via the CAN bus, a new counterfeit message corresponding to a newly generated message to be detected sent by the controller, and determine a new preset signal counterfeiting rule corresponding to a new counterfeit signal in the new counterfeit message; determine, based on the new preset signal counterfeiting rule, a matching status between a new current correlation relationship and a preset correlation relationship between the new counterfeit signal and the new vehicle signal to be sent in the corresponding new message to be detected; if a matching status result is a matching failure, invert the new message to be detected, and determine, based on the new preset signal counterfeiting rule, a matching status between a new current correlation relationship and a preset correlation relationship between the new vehicle signal to be sent in the inverted new message to be detected and the corresponding new counterfeit signal; if a matching status result is a matching success, invert all subsequent messages to be detected obtained via the CAN bus, and determine, based on the preset signal counterfeiting rule corresponding to the counterfeit signal, a matching status between a current correlation relationship and a preset correlation relationship between the vehicle signal to be sent in the inverted message to be detected and the corresponding counterfeit signal, until the vehicle is powered on again.

[0111] The specific limitations of the CAN bus intrusion detection device based on forged messages can be found in the limitations of the CAN bus intrusion detection method based on forged messages above and will not be elaborated upon here. Each module in the aforementioned CAN bus intrusion detection device based on forged messages can be implemented in whole or in part through software, hardware, or a combination thereof. Each of these modules can be embedded in or independent of a processor in an electronic device in hardware form, or stored in memory in the electronic device in software form, so that the processor can call and execute the corresponding operations of each of these modules.

[0112] In this embodiment, the CAN bus intrusion detection device based on counterfeit messages is essentially equipped with multiple modules to execute the CAN bus intrusion detection method based on counterfeit messages in any of the above embodiments. The specific functions and technical effects can be referred to the above embodiments and will not be repeated here.

[0113] In one embodiment, a vehicle is provided, comprising the CAN bus intrusion detection device based on forged messages provided in any of the above embodiments. The specific functions and technical effects of the vehicle can be referred to the above embodiments and will not be described in detail here.

[0114] See also Figure 3An embodiment of the present invention further provides an electronic device 300, including a processor 301, a memory 302 and a communication bus 303; the communication bus 303 is used to connect the processor 301 and the memory 302; the processor 301 is used to execute the computer program stored in the memory 302 to implement the method provided in any one of the above embodiments.

[0115] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, the computer program being used to enable a computer to execute the method provided in any one of the above embodiments.

[0116] An embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute the instructions (instructions) of the steps included in embodiment 1 of the embodiment of the present application.

[0117] An embodiment of the present application also provides a computer program product, including a computer program, which can implement the steps and corresponding contents of the aforementioned method embodiment when executed by a processor.

[0118] Note that the computer readable medium described above can be a computer readable signal medium or a computer readable storage medium or any combination thereof. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the foregoing. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program used by or in connection with an instruction execution system, apparatus or device. In the disclosure, the computer readable signal medium can include a computer readable program code propagated on or through a computer readable medium, in baseband or as part of a carrier wave. The computer readable signal medium can take a variety of forms, including but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate or transport a program for use by or in connection with an instruction execution system, apparatus or device. Program code embodied on a computer readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0119] The computer readable medium described above can be included in the electronic device described above; alternatively, the computer readable medium can exist as a separate entity in which the electronic device is incorporated.

[0120] Computer program code for carrying out operations of the disclosure can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0121] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architectures, functions and operations of the methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment or part of code, which contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, as well as the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified functions or operations, or can be implemented using a combination of dedicated hardware and computer instructions.

[0122] It should be understood that the terms "first," "second," and the like are used herein to distinguish similar objects and do not necessarily indicate a specific order or precedence. The technical features associated with these terms are interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described.

[0123] It should be understood that although the flowcharts provided in the embodiments of the present application use arrows to indicate the steps, the order indicated by the arrows does not necessarily limit the order in which the steps are to be performed. Those skilled in the art may perform the steps in other orders as needed based on the steps for different implementation scenarios.

[0124] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the present invention. Anyone skilled in the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by one of ordinary skill in the art without departing from the spirit and technical principles disclosed herein are intended to be covered by the claims of the present invention.

Claims

1. A CAN bus intrusion detection method based on counterfeit messages, characterized in that: The method comprises: Obtain the vehicle signal to be sent from the controller; Determining a signal data type of the vehicle signal to be sent, and determining a preset signal imitation rule corresponding to the vehicle signal to be sent based on the signal data type, wherein the preset signal imitation rule includes a filling content generation rule and a preset correlation between the vehicle signal to be sent and an imitation signal generated based on the filling content generation rule; Based on the preset signal imitation rule, the reserved position in the preset associated message is filled with an imitation signal according to the filling content generation rule to obtain an imitation message of the vehicle signal to be sent, and the imitation message and the message to be detected are sent to the CAN bus through the controller, wherein the message to be detected includes the vehicle signal to be sent; Acquire the counterfeit messages and the to-be-detected messages sent by one or more controllers via the CAN bus, and determine the preset signal counterfeiting rule corresponding to the counterfeit signal in each counterfeit message; Determining, based on the preset signal imitation rule, a matching state between a current correlation relationship between the imitation signal and a corresponding vehicle signal to be sent in the message to be detected and the preset correlation relationship, and obtaining a matching state result for each imitation signal; Determining a current intrusion state of the CAN bus based on the matching state results of all the simulated signals to perform CAN bus intrusion detection; The determining of the current intrusion status of the CAN bus based on the matching status results of all the imitation signals includes: If the matching status result of the counterfeit signals exceeding the preset number is a match failure, the current intrusion status of the CAN bus is an intrusion, the preset intrusion flag position is set to a preset identifier, and the attack message is reported to the cloud platform; If the matching result of the number of counterfeit signals that is less than or equal to the preset number is a matching failure, the current intrusion status of the CAN bus is no intrusion.

2. The CAN bus intrusion detection method based on counterfeit messages according to claim 1, characterized in that: The method of constructing the preset signal imitation rule includes: Obtain all vehicle signals that require CAN bus intrusion detection and count the signal data types of all vehicle signals; Configuring a corresponding initial filling content rule for each signal data type, the initial filling content rule including at least a preset number of reserved bits and a filling content generation rule; Determining a preset correlation between a vehicle signal and an imitation signal according to the filling content generation rule, wherein the imitation signal is generated according to the vehicle signal and the filling content generation rule; The filling content generation rule, the preset correlation relationship and the vehicle signal are associated to obtain a preset signal imitation rule corresponding to the vehicle signal.

3. The CAN bus intrusion detection method based on counterfeit messages according to claim 2, characterized in that: Before obtaining the imitation message of the vehicle signal to be sent, the method includes: Pre-configure a corresponding preset associated message for each vehicle signal, wherein the preset associated message includes a message to be detected where the vehicle signal is located, a message in the same network segment as the message to be detected, or a message in the same period as the message to be detected; The blank position of the preset reserved bit number in the preset association message is determined as the reserved bit, and the preset reserved bit number is determined based on the initial filling content rule corresponding to the vehicle signal.

4. The CAN bus intrusion detection method based on counterfeit messages according to claim 2, wherein: Configuring a corresponding fill content generation rule for each signal data type includes at least one of the following: If the signal data type is an enumeration type and the data length of the vehicle signal is less than the preset data length, the filling content generation rule is to copy the vehicle signal as a counterfeit signal; If the signal data type is an enumeration type, and the data length of the vehicle signal is greater than or equal to the preset data length, the fill content generation rule is to change the vehicle signal into associated data, use the associated data as the simulated signal, and the associated data and the vehicle signal are signal data corresponding to different signal states of the same vehicle state data; If the signal data type is a continuous numerical type, the filling content generation rule is to determine the simulated bus value of the simulated signal data in the simulated signal based on the original bus value of the vehicle signal, the original signal accuracy of the vehicle signal, the original signal offset of the vehicle signal, the preset distortion coefficient, the preset simulated signal data accuracy and the preset simulated signal data offset, round the simulated bus value, and determine the simulated signal based on the rounded simulated bus value.

5. The CAN bus intrusion detection method based on counterfeit messages according to claim 4 is characterized in that: Changing the vehicle signal into associated data includes: Acquire a vehicle state signal data set corresponding to the vehicle state defined by the vehicle signal; If the vehicle signal is vehicle state signal data representing an initial state or an invalid state in the vehicle state signal data set, determining the associated data as the vehicle signal itself; If the vehicle signal is variable-sequence vehicle status signal data, all variable-sequence vehicle status signal data are sorted to obtain an initial signal sequence, the inverse sequence of the initial signal sequence is used as an associated signal sequence, the initial sorting of the vehicle signal in the initial signal sequence is obtained, and the variable-sequence vehicle status signal data at the initial sequence position of the associated signal sequence is determined as the associated data. The variable-sequence vehicle status signal data is the vehicle status signal data in the vehicle status signal data set that represents the vehicle status except for the initial state and the invalid state.

6. The method for detecting CAN bus intrusion based on counterfeit messages according to claim 4, wherein: Determining a simulated bus value of simulated signal data in a simulated signal according to an original bus value of the vehicle signal, an original signal precision of the vehicle signal, an original signal offset of the vehicle signal, a preset distortion coefficient, a preset simulated signal data precision, and a preset simulated signal data offset comprises: S 仿 = (g*(S 原 *R 原 +Offset 原 )- Offset 仿 ) / R 仿 , Among them, S 仿 is the simulated bus value, g is the preset distortion coefficient, S 原 is the original bus value of the vehicle signal, R 原 is the original signal accuracy of the vehicle signal, Offset 原 Offset is the original signal offset of the vehicle signal. 仿 To preset the simulated signal data offset, R 仿 To preset the accuracy of the simulated signal data; The deviation between the simulated bus value and the original bus value is smaller than a preset deviation threshold.

7. The CAN bus intrusion detection method based on counterfeit messages according to claim 1, wherein: If the current intrusion state of the CAN bus is intrusion, after a preset time when the current intrusion state is detected as intrusion, the controller is controlled to send the newly generated message to be detected to the CAN bus in an inverted manner until the vehicle is powered on again.

8. The CAN bus intrusion detection method based on counterfeit messages according to claim 7, characterized in that: After detecting that the current intrusion state is a preset intrusion time, the method further includes: Acquire a new counterfeit message corresponding to the newly generated message to be detected sent by the controller via the CAN bus, and determine a new preset signal counterfeiting rule corresponding to a new counterfeit signal in the new counterfeit message; Determining, based on the new preset signal imitation rule, a matching state between a new current correlation relationship between the new imitation signal and a new vehicle signal to be sent in a corresponding new message to be detected and a preset correlation relationship; If the matching result is a match failure, the new message to be detected is inverted, and a matching status between a new current correlation relationship between a new to-be-sent vehicle signal in the inverted new message to be detected and a corresponding new imitation signal and a preset correlation relationship is determined based on the new preset signal imitation rule; If the matching status result is a successful match, all subsequent messages to be detected obtained through the CAN bus are first inverted, and the matching status between the current correlation relationship between the to-be-sent vehicle signal and the corresponding imitation signal in the inverted message to be detected and the preset correlation relationship is determined based on the preset signal imitation rule corresponding to the imitation signal until the vehicle is powered on again.

9. A CAN bus intrusion detection device based on counterfeit messages, characterized in that: The device comprises: An acquisition module, used to acquire the vehicle signal to be sent by the controller; a rule matching module, configured to determine a signal data type of the to-be-transmitted vehicle signal, and determine a preset signal imitation rule corresponding to the to-be-transmitted vehicle signal based on the signal data type, wherein the preset signal imitation rule includes a filling content generation rule and a preset correlation between the to-be-transmitted vehicle signal and an imitation signal generated based on the filling content generation rule; a message imitation module, configured to fill reserved bits in a preset associated message with an imitation signal according to the filling content generation rule based on the preset signal imitation rule, thereby obtaining an imitation message of the vehicle signal to be sent, and to send the imitation message and a message to be detected to the CAN bus via the controller, wherein the message to be detected includes the vehicle signal to be sent; a counterfeit signal acquisition module for acquiring counterfeit messages and to-be-detected messages sent by one or more controllers via the CAN bus, and determining a preset signal counterfeiting rule corresponding to the counterfeit signal in each counterfeit message; a matching module for determining, based on the preset signal imitation rule, a matching status between a current correlation between the imitation signal and a corresponding vehicle signal to be sent in the message to be detected and the preset correlation, and obtaining a matching status result for each imitation signal; An intrusion detection module is used to determine the current intrusion status of the CAN bus based on the matching status results of all the simulated signals to perform CAN bus intrusion detection, wherein the current intrusion status of the CAN bus is determined based on the matching status results of all the simulated signals, including: if the matching status results of more than a preset number of simulated signals are matching failures, the current intrusion status of the CAN bus is intrusion, the preset intrusion flag position is set to a preset identifier, and an attacked message is reported to the cloud platform; if the matching status results of less than or equal to the preset number of simulated signals are matching failures, the current intrusion status of the CAN bus is not intruded.

Images