A big data-based automobile intelligent diagnosis safety monitoring system and method

Abstract

The present invention relates to the technical field of confidentiality or security communication devices, and in particular, to a big data-based intelligent automobile diagnostic safety monitoring system and method. The method includes recording access information of multiple diagnostic access terminals accessing the diagnostic interface of an automobile; clustering the access information according to different information types to obtain risky monitored items; the monitored items include monitored access subjects, monitored access targets, and monitored access times; adjusting the monitoring strategy of the automobile diagnostic system according to the monitored items and the associations between the monitored items; according to the adjusted monitoring strategy, if abnormal access information is monitored, an abnormal reminder is issued. The present invention effectively monitors the security of the automobile diagnostic system through big data statistical technology.

Description

Technical Field

[0001] The present invention relates to the technical field of confidentiality or security communication devices, and in particular to an automobile intelligent diagnosis safety monitoring system and method based on big data. Background Art

[0002] With the continuous development of automobile electronics and intelligence, the number of electronic control units in the car is increasing, the integrated software functions are gradually increasing, and the resulting software vulnerabilities are also increasing. In order to discover and solve problems in a timely manner, designers or authorized maintenance technicians can use the car diagnostic function to read data, diagnose faults, and upgrade software on the car's electronic control unit.

[0003] External devices can operate the automotive electronic control unit through the automotive diagnostic system. In addition to diagnosis, it also has functions such as data transmission and flashing. The automotive diagnostic system enables the automotive electronic control unit to communicate with the outside. Through the automotive diagnostic system, diagnostic access terminals such as devices, systems or platforms that initiate diagnostic services are allowed to initiate diagnostic services for the entire vehicle. The diagnosed electronic control unit can also respond to diagnostic services by sending diagnostic response messages through the automotive diagnostic system.

[0004] When any external device establishes a connection with the in-vehicle network, the vehicle will increase the risk of security attacks. Any unauthorized access to the diagnostic system is an illegal operation and may cause serious security problems to the vehicle's electronic system. For example, network attackers may exploit vulnerabilities in on-board networked devices to inject malicious code, illegally tamper with software, or modify the vehicle's factory configuration, which will seriously affect the safety of car owners and the consequences are disastrous.

[0005] In view of this, the present invention is proposed. Summary of the invention

[0006] The purpose of the present invention is to provide a big data-based automobile intelligent diagnosis safety monitoring system and method, so as to effectively monitor the safety of the automobile diagnostic system through big data statistical technology.

[0007] In order to achieve the above object, the present invention adopts the following technical solutions:

[0008] In a first aspect, the present invention provides a method for intelligent diagnosis and safety monitoring of automobiles based on big data, comprising:

[0009] Recording access information of multiple diagnostic access terminals accessing the diagnostic interface of the vehicle, wherein the access information includes access identity, access authority, access target, access time, and access source;

[0010] Clustering the access information according to different information types to obtain risky monitored items; the monitored items include monitored access subjects, monitored access targets and monitored access time;

[0011] Adjusting the monitoring strategy of the automobile diagnostic system according to the monitored items and the association relationship between the monitored items;

[0012] According to the adjusted monitoring strategy, if abnormal access information is monitored, an abnormal reminder will be issued.

[0013] In a second aspect, the present invention provides an automobile intelligent diagnosis and safety monitoring system based on big data, comprising:

[0014] A recording component, used to record access information of multiple diagnostic access terminals accessing the diagnostic interface of the vehicle, wherein the access information includes access identity, access authority, access target, access time and access source;

[0015] A monitoring component is used to cluster the access information according to different information types to obtain risky monitored items; the monitored items include monitored access subjects, monitored access targets and monitored access time; and the monitoring strategy of the automobile diagnostic system is adjusted according to the monitored items and the associations between the monitored items;

[0016] The reminder component is used to issue an exception reminder if abnormal access information is monitored according to the adjusted monitoring strategy.

[0017] Compared with the prior art, the present invention has the following beneficial effects:

[0018] The technical problem to be solved by the present invention is the problem of information security of automobile diagnostic system. A kind of automobile intelligent diagnosis safety monitoring system and method based on big data are proposed, which are used to automatically monitor the security status of the diagnostic system, record all access information to the automobile diagnostic interface, including normal access, illegal user access, and the state and access subject when the automobile diagnostic interface is accessed, etc., and record the access information of the diagnostic interface in full coverage. Through the clustering analysis algorithm based on big data, different types of access information are deeply analyzed to discover possible security risks and security problems that may be caused by unsafe access, and it has the functions of decision adjustment and timely abnormal reminder, so as to further protect the safety of automobile diagnostic communication and vehicle diagnosis. The automobile intelligent diagnosis safety monitoring system and method can provide a strong basis for the design and testing of the security mechanism of the diagnostic interface, and can also timely discover unauthorized access and possible security problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 It is a flow chart of a method for intelligent diagnosis and safety monitoring of automobiles based on big data provided by an embodiment of the present invention;

[0021] Figure 2 is a schematic diagram of recording access information provided by an embodiment of the present invention;

[0022] Figure 3 is a schematic diagram of a clustering process provided by an embodiment of the present invention;

[0023] Figure 4 It is a structural schematic diagram of an automobile intelligent diagnosis and safety monitoring system based on big data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0025] The core idea of ​​the present invention is to record the access information of multiple diagnostic access terminals in advance to find out the items that may be risky, and then adjust the monitoring strategy of the automobile diagnostic system. Finally, the abnormal access information is identified through the adjusted monitoring strategy, and abnormal reminders are issued.

[0026] The present invention is further described in detail below with reference to the embodiments.

[0027] Example 1

[0028] Figure 1 This is a flow chart of a method for intelligent automobile diagnosis and safety monitoring based on big data provided by the present invention. This embodiment is applicable to monitoring the safety status of the automobile diagnostic interface. The method provided in this embodiment is executed by an intelligent automobile diagnosis and safety monitoring system based on big data, which can be integrated in the vehicle and communicated with the automobile diagnostic system. Figure 1 , the method provided in this embodiment includes the following operations:

[0029] S110: Record access information of multiple diagnostic access terminals accessing the diagnostic interface of the vehicle.

[0030] For example, in the past month, 10 diagnostic access terminals have been connected to the diagnostic interface of the automobile diagnostic system. The diagnostic access request messages of these 10 diagnostic access terminals are monitored, and the access identity, access rights, access target, access time and access source are parsed from the diagnostic access request messages. Among them, the access identity is the identity of the diagnostic access terminal, and the diagnostic access terminal includes but is not limited to the device, system or platform that initiates the diagnostic service. The diagnostic interface is integrated with an authentication module and stores an authentication algorithm. This embodiment does not limit the specific authentication algorithm, but only limits that by setting the authentication algorithm, it can automatically determine whether the diagnostic access terminal has access rights to a certain access target (i.e., the electronic control unit in the vehicle). The access target is at least one electronic control unit that the diagnostic access terminal needs to access. The access time is the current time, which can be used as the timestamp of the access information. The access source is the network address of the diagnostic access terminal, which can be an IP address, MAC address, etc.

[0031] See also Figure 2 After receiving the diagnostic access request message sent by the diagnostic access terminal, the diagnostic interface first performs identity authentication based on the access identity. After the identity authentication is passed, the access permission is authenticated according to the authentication algorithm. If the authentication is passed, it interacts with the access target to perform subsequent diagnostic operations. Regardless of whether the identity authentication is passed or not, the present embodiment can record each set of access information received by the diagnostic interface in chronological order, and further obtain the identity authentication result of the diagnostic access terminal from the diagnostic interface, that is, whether the identity authentication is passed; and whether the authentication is passed. The access time in each set of access information is used as an index and aggregated data, and multi-dimensional data indexing and query are supported to meet the needs of different application scenarios. For example, all access applications that have passed the identity authentication can be indexed according to the access time, and all access applications of the identity to the diagnostic interface can be indexed according to the access identity.

[0032] S120: Cluster the access information according to different information types to obtain risky monitored items.

[0033] The information type here refers to the access subject, access target and access time. This embodiment aggregates multiple access identities of the same access source to obtain an access subject, thereby aggregating different access identities of the same network address into one access subject, and the access targets and access times of these different access identities are also merged to avoid the situation where the diagnostic access terminal accesses the diagnostic interface with different identities.

[0034] The monitored items include monitored access subjects, monitored access targets and monitored access time. Optionally, a data clustering algorithm is used to cluster the access information with the access subject, access target and access time as cluster centers respectively; the cluster centers obtained by clustering are respectively used as the monitored access subjects, monitored access targets and monitored access time. This embodiment does not limit the specific data clustering algorithm, for example, it is a K-means clustering analysis algorithm.

[0035] Take the access subject as an example, assuming that there are 100 access subjects recorded in total, and the access target and access time of each access subject are used as the attributes of the access subject. Figure 3 , take each access subject and its attributes as a data point. Randomly select K data points as the initial cluster center, also called the centroid, and calculate the distance between the attributes of each access subject and the centroid. For example, the inverse of the number of intersections of the access targets is added to the access time difference to obtain the distance value. In other words, the more the access targets overlap and the shorter the access time is, the closer the distance between the two data points is. According to the distance between each data point and the center of each cluster, it is assigned to the nearest centroid to form K clusters. For each cluster. Adjust the position of the centroid so that the variance within the cluster is as small as possible and the variance between clusters is as large as possible, until the position of the centroid no longer changes, or the preset number of iterations is reached. The final centroid position is a data point in the cluster that best represents the characteristics of the cluster, and is used as the monitored access subject. The number of monitored access subjects is multiple.

[0036] Similarly, taking the access time as an example, the access target and access subject of each access time (which can be accurate to the minute) are taken as the attributes of the access time. Each access time and its attributes are taken as a data point. The difference of the access subject (for example, the same access subject is 0, and different access subjects are 1) is added to the inverse of the number of intersections of the access targets to obtain the distance value. In other words, the more the access targets overlap and the same access subjects, the closer the distance between the two data points. The final centroid position is a data point in the cluster that best represents the characteristics of the cluster as the monitored access time, and the number of monitored access times is multiple.

[0037] Similarly, taking the access target as an example, the access time and access subject of each access target are taken as the attributes of the access target. Each access target and its attributes are taken as a data point. The difference of the access subject (for example, the same access subject is 0, and different access subjects are 1) is added to the access time difference to obtain the distance value. In other words, the shorter the access time is and the same access subject is, the closer the distance between the two data points is. The final centroid position is a data point in the cluster, which best represents the characteristics of the cluster, as the monitored access target, and the number of monitored access targets is multiple.

[0038] S130: Adjust the monitoring strategy of the automobile diagnosis system according to the monitored items and the associations between the monitored items.

[0039] From the above description, it can be known that the monitored items can represent the main access conditions to the diagnostic interface, and they are tentatively referred to as risky monitored items. Different from the prior art that only performs identity authentication and simple authentication on the access subject, in order to further monitor security, this embodiment adjusts the monitoring strategy of the automobile diagnostic system according to the monitored items and the association relationship between the monitored items, including at least one of the following processes:

[0040] The first process: For the access information corresponding to the monitored items, lower the access frequency threshold and the access count threshold.

[0041] Assuming that the original access frequency threshold of the monitored access subject is 20 times / day and the access number threshold is 1000 times, this embodiment reduces the access frequency threshold to 15 times / day and the access number threshold to 500 times. Different monitored items may have different access frequency thresholds and access number thresholds. By lowering the access frequency threshold and the access number threshold, the access of the monitored access subject to the monitored target during the monitored time can be reduced, thereby reducing the risk of being attacked.

[0042] The second process: If the access time of a monitored access subject is concentrated, the access target is concentrated, or the access target covers all electronic control units, a security verification mechanism for the monitored access subject is added.

[0043] The access time is concentrated, which means that the monitored access subject frequently accesses the electronic control unit in a certain time period (such as a set duration) compared with other time periods. The access target is concentrated, which means that the monitored access subject accesses some electronic control units in a short period of time. The access target covers all electronic control units, which means that the monitored access subject accesses most electronic control units in a short period of time.

[0044] Since most current vehicles use domain control solutions, each domain controller has multiple electronic control units. Generally, the diagnostic access terminal is a device specifically used to diagnose electronic control unit failures. It should have the diagnostic function of each electronic control unit, and in actual application scenarios, it will not be only one or two concentrated electronic control units that fail. Therefore, under normal circumstances, the diagnostic access terminal will not only focus on accessing some electronic control units. All electronic control units of the vehicle will not fail, so the diagnostic access terminal will not access all electronic control units in a short period of time. Therefore, the monitored access subject with concentrated access targets (for example, multiple accesses to only one electronic control unit within a set time) or access targets covering various electronic control units (for example, accesses to more than 90% of the set electronic control units within a set time) has a higher security risk and needs to increase the security verification mechanism.

[0045] In actual application scenarios, the time when a vehicle breaks down is uncertain and scattered, and the normal diagnostic access terminal should be accessible at any time without a clear time pattern. Therefore, if the access time of the monitored access subject is concentrated, there is a high security risk, and a security verification mechanism needs to be added.

[0046] The specific security verification mechanism is: the use of multi-factor authentication (MFA) is a security strategy to ensure that even if one of the verification factors is leaked or stolen, attackers cannot easily impersonate the user's identity. Specifically, the monitored access subject is required to provide two or more verification methods. First, the user's geographic location is used as a verification factor. If the monitored access subject attempts to log in from an unusual location, asymmetric encryption identity authentication is required. When the monitored access subject sends an authentication request to the diagnostic access end, a private key based on the RSA algorithm is used to encrypt a randomly generated challenge value, and the encrypted result is sent to the diagnostic access end. The diagnostic access end uses the public key of the monitored access subject to decrypt the received encrypted result. If the decrypted result is consistent with the original challenge value, it proves that the monitored access subject has the corresponding private key, thereby verifying the identity of the monitored access subject to prevent remote attackers from unauthorized access authentication identity. Finally, a strict access control policy is used to check whether the monitoring subject has applied for access within the corresponding permissions according to the permissions corresponding to the access identity, ensuring that only authorized users can access.

[0047] The third process: if the number of visits to a monitored access target accounts for more than a set proportion threshold among all access targets, the access rights to the monitored access target are restricted.

[0048] For example, there are 30 access targets in the vehicle, and they are accessed 50 times in the set time. If the number of accesses to a monitored access target is 20 times in the set time, then the proportion of the 50 times is 40%, which is greater than the set proportion threshold of 35%, indicating that the monitored access target is at risk of excessive access. This embodiment restricts the access rights to the monitored access target, for example, closing the access rights to certain diagnostic access terminals, or using a time-divided access strategy, and prohibiting access if it is not within the access period.

[0049] The fourth process: If the access rights of a monitored access subject are not passed, and the number of accesses or the access frequency exceeds the set value, the prohibited access target is determined based on the failed access rights, and the access rights of the monitored access subject are reduced based on the associated access targets of the prohibited access target.

[0050] Assume that when a monitored access subject attempts to access target A, the access permission is not passed, that is, the monitored access subject is prohibited from accessing target A. However, if the monitored access subject still frequently initiates access to target A, it is considered that the monitored access subject may be a malicious / violent access, and target A is set as a prohibited access target for the monitored access subject. The significance of setting a prohibited access target is that when the monitored access subject accesses the prohibited access target again in the future, no authentication operation is performed, but the monitored access subject is directly not responded. Since the electronic control units on the vehicle are often associated, for example, multiple electronic control units under a domain controller are responsible for the functions of a certain area, and for example, the temperature control unit and the air conditioning control unit need to cooperate to realize the thermal management function. Therefore, if access target A is a prohibited access target for the monitored access subject, the associated access target of access target A is also set as a prohibited access target. The access permission of the monitored access subject should not include access to prohibited access targets to ensure the security of prohibited access targets.

[0051] S140. According to the adjusted monitoring strategy, if risky access information is monitored, an abnormal reminder is issued.

[0052] For the first process: real-time statistics of the access frequency and access count of the monitored items, if the access frequency of the monitored items is greater than the access frequency threshold or the access count is greater than the access count threshold, an abnormal reminder is issued. The access frequency threshold and access count threshold here are the thresholds after "lowering the access frequency threshold and access count threshold for the access information corresponding to the monitored items".

[0053] For the second process: after monitoring the access request of the monitored access subject, the monitored access subject is verified according to the security verification mechanism. If the verification fails, an abnormal reminder is issued. After the monitored access subject is authenticated and authorized, the security verification mechanism is continued to be executed on the monitored access subject. Specifically, the use of multi-factor authentication (MFA) is a security strategy that uses the user's geographic location as a verification factor. If the monitored access subject attempts to log in from an unusual location, asymmetric encryption identity authentication is required. When the monitored access subject sends an authentication request to the diagnostic access terminal, a private key based on the RSA algorithm is used to encrypt a randomly generated challenge value, and the encrypted result is sent to the diagnostic access terminal. The diagnostic access terminal uses the public key of the monitored access subject to decrypt the received encryption result. If the decrypted result is consistent with the original challenge value, it proves that the monitored access subject has the corresponding private key, thereby verifying the identity of the monitored access subject to prevent remote attackers from unauthorized access authentication identity.

[0054] For the third process: after monitoring the access request to the monitored access target, use the restricted access rights for authentication, and if the authentication fails, issue an exception reminder. Assuming that the access to a monitored access target is restricted by a time-divided access policy, for example, the monitored access target can only be accessed between 8:00 and 10:00, then after monitoring the access request to the monitored access target, determine whether the current time is within the specified time period. If it is not within the specified time period, the authentication fails, access is not allowed, and an exception reminder is issued; if it is within the specified time period, the authentication passes and access is allowed.

[0055] For the fourth process: after detecting the access request of the monitored access subject, authentication is performed according to the narrowed access rights, and an abnormal reminder is issued if the authentication fails. For example, a monitored access subject initiates an access request to access target A, but the monitored access subject does not have the access rights to access target A, authentication fails, and an abnormal reminder is issued.

[0056] Optionally, after abnormal access information is monitored and an abnormal reminder is issued, if abnormal access information is monitored according to the adjusted monitoring strategy, it is determined whether the access subject from which the abnormal access information comes is an attacking end. Specifically, assuming that a monitored access subject fails to pass the security verification mechanism when initiating access, it is determined that the monitored access subject is an abnormal access subject, and it is necessary to further confirm whether it is an attacking end. Specifically, the user can perform a security check on the monitored access subject and give a result of whether it is an attacking end. If the access subject is an attacking end, the identity, address and corresponding monitoring strategy of the attacking end (i.e., the adjusted monitoring strategy adopted when the access information is found to be abnormal) are uploaded to the cloud platform, so as to update the monitoring strategy of the automobile diagnostic system of other vehicles through the cloud platform, and the identity and address of the attacking end are blacklisted. For the automobile diagnostic system of other vehicles, after receiving an access request from any diagnostic access end, when performing identity authentication, if the identity of the diagnostic access end is in the blacklist, the identity authentication will not be passed.

[0057] Optionally, the four processes in S130 focus on finding abnormal access subjects, and adopt the method of limiting permissions and reducing the number of accesses / frequency to ensure the security of the access targets in the car. However, it is possible that the originally normal access subjects are also listed as abnormal. Therefore, this embodiment analyzes whether the car has a diagnostic requirement according to the occurrence of the car fault code, and makes a white list. Specifically, according to the adjusted monitoring strategy, if abnormal access information is monitored, before the abnormal reminder is made, according to the car diagnostic system, each access target will generate a fault code when a fault occurs, and the diagnostic access terminal needs to perform diagnosis at this time. Therefore, the occurrence time of the fault code of each access target is recorded; the access subject set (including at least one access subject) monitored within the set time after the fault code appears and the access target (with the fault code) is summarized. Assume that within 1 hour after the fault code appears in the access target A, the access subject M and the access subject N that perform diagnostic access to the access target A are monitored. Then, the access targets of each access subject in the access subject set are counted. If the access targets of an access subject exceed the set proportion of access targets that are faulty, the access subject is listed in the white list. Take access subject M as an example. Within 1 hour after the fault code appears on access target A, access subject M has visited access target O, access target A and access target B, and access target O and access target B have no fault code. It can be seen that among the access targets accessed by access subject M, only 33.3% are faulty, which does not exceed the set proportion of 60%, so access subject M is not listed in the whitelist. On the contrary, if the access targets that exceed the set proportion are faulty, the access subject is listed in the whitelist. Adjust the monitoring strategy of the automobile diagnostic system according to the whitelist. After receiving an access request from any diagnostic access terminal, if the identity of the diagnostic access terminal is in the whitelist, the diagnostic access terminal will not be further monitored, and no abnormal reminder will be issued. The diagnostic access terminal is assumed to be a safe terminal. The whitelist can also be used to execute the following process: According to the adjusted monitoring strategy, if abnormal access information is monitored and the access subject is not in the whitelist, an abnormal reminder will be issued. For example, after monitoring abnormal access information, the abnormal access subject is further determined. The abnormal access subject is compared with the white list; if the abnormal access subject is in the white list, no abnormal reminder is given; if the abnormal access subject is not in the white list, an abnormal reminder is given.

[0058] Example 2

[0059] like Figure 4 As shown, this embodiment provides an automobile intelligent diagnosis and safety monitoring system based on big data, including: a recording component, a monitoring component and a reminder component.

[0060] A recording component, used to record access information of multiple diagnostic access terminals accessing the diagnostic interface of the vehicle, wherein the access information includes access identity, access authority, access target, access time and access source;

[0061] A monitoring component is used to cluster the access information according to different information types to obtain risky monitored items; the monitored items include monitored access subjects, monitored access targets and monitored access time; and the monitoring strategy of the automobile diagnostic system is adjusted according to the monitored items and the association relationship between the monitored items;

[0062] The reminder component is used to issue an exception reminder if abnormal access information is monitored according to the adjusted monitoring strategy.

[0063] Optionally, a recording component is used to parse diagnostic access request messages sent by multiple diagnostic access terminals to the diagnostic interface of the automobile, obtain access information, and store the access information in a database; the access target includes an electronic control unit in the vehicle.

[0064] Optionally, the system also includes an upload module, which is used to determine whether the access subject from which the abnormal access information comes is an attacking end if abnormal access information is monitored according to the adjusted monitoring strategy; if the access subject is an attacking end, the identity, address and corresponding monitoring strategy of the attacking end are uploaded to the cloud platform; the cloud platform is used to send the identity, address and corresponding monitoring strategy of the attacking end to the vehicle diagnostic system of other vehicles.

[0065] The automobile intelligent diagnosis and safety monitoring system based on big data provided in this embodiment can execute the automobile intelligent diagnosis and safety monitoring method based on big data provided in the above embodiments, and achieve corresponding technical effects.

[0066] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0067] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A method for intelligent automobile diagnosis and safety monitoring based on big data, characterized in that: include: Recording access information of multiple diagnostic access terminals accessing the diagnostic interface of the vehicle, wherein the access information includes access identity, access authority, access target, access time, and access source; Clustering the access information according to different information types to obtain risky monitored items; the monitored items include monitored access subjects, monitored access targets and monitored access time; Adjusting the monitoring strategy of the automobile diagnostic system according to the monitored items and the association relationship between the monitored items; According to the adjusted monitoring strategy, if abnormal access information is monitored, an abnormal reminder will be issued; The monitoring strategy of the automobile diagnostic system is adjusted according to the monitored items and the association relationship between the monitored items, including the following process: The first process: lowering the access frequency threshold and the access count threshold for the access information corresponding to the monitored item; The second process: if the access time of a monitored access subject is concentrated and the access target covers all electronic control units, a security verification mechanism for the monitored access subject is added; The third process: if the number of visits to a monitored access target accounts for more than a set proportion threshold among all access targets, restricting access rights to the monitored access target; The fourth process: If the access rights of a monitored access subject are not passed, and the number of accesses or the access frequency exceeds the set value, the prohibited access target is determined based on the failed access rights, and the access rights of the monitored access subject are reduced based on the associated access targets of the prohibited access target.

2. The method according to claim 1, characterized in that The access information is clustered according to different information types to obtain risky monitored items, including: Aggregate multiple access identities from the same access source to obtain an access subject; Using a data clustering algorithm, the access information is clustered with the access subject, access target and access time as cluster centers respectively; The cluster centers obtained by clustering are used as the monitored access subject, monitored access target and monitored access time respectively.

3. The method according to claim 1, characterized in that According to the adjusted monitoring strategy, if abnormal access information is monitored, an abnormal reminder will be issued, including: For the first process: real-time statistics of the access frequency and access times of the monitored items, if the access frequency of the monitored items is greater than the access frequency threshold or the access times are greater than the access times threshold, an abnormal reminder is issued; Regarding the second process: after monitoring the access request of the monitored access subject, verify the monitored access subject according to the security verification mechanism, and issue an abnormal reminder if the verification fails; Regarding the third process: after monitoring the access request to the monitored access target, the restricted access rights are used for authentication, and if the authentication fails, an abnormal reminder is issued; Regarding the fourth process: after detecting the access request of the monitored access subject, authentication is performed according to the narrowed access rights, and if the authentication fails, an abnormal reminder is issued.

4. The method according to claim 3, characterized in that According to the adjusted monitoring strategy, if abnormal access information is monitored, after the abnormal reminder is issued, it also includes: If abnormal access information is monitored according to the adjusted monitoring strategy, it is determined whether the access subject from which the abnormal access information comes is an attacking end; If the access subject is an attacker, the identity, address and corresponding monitoring strategy of the attacker are uploaded to the cloud platform to update the monitoring strategy of the automobile diagnostic system of other vehicles through the cloud platform, and the identity and address of the attacker are blacklisted.

5. The method according to claim 4, characterized in that According to the adjusted monitoring strategy, if abnormal access information is monitored, before the abnormal reminder is issued, it also includes: Record the occurrence time of the fault code of each access target; Summarize the set of access subjects to the access target monitored within a set period of time after the fault code appears; Counting the access targets of each access subject in the access subject set, if more than a set proportion of the access targets of an access subject are faulty access targets, the access subject is added to the whitelist; The monitoring strategy of the automobile diagnostic system is adjusted according to the white list.

6. The method according to claim 5, characterized in that According to the adjusted monitoring strategy, if abnormal access information is monitored, an abnormal reminder will be issued, including: According to the adjusted monitoring strategy, if abnormal access information is monitored and the access subject is not in the whitelist, an abnormal reminder will be issued.

7. An automobile intelligent diagnosis and safety monitoring system based on big data, characterized in that: include: A recording component, used to record access information of multiple diagnostic access terminals accessing the diagnostic interface of the vehicle, wherein the access information includes access identity, access authority, access target, access time and access source; A monitoring component is used to cluster the access information according to different information types to obtain risky monitored items; the monitored items include monitored access subjects, monitored access targets and monitored access time; and the monitoring strategy of the automobile diagnostic system is adjusted according to the monitored items and the associations between the monitored items; The reminder component is used to issue an abnormal reminder if abnormal access information is monitored according to the adjusted monitoring strategy; The monitoring strategy of the automobile diagnostic system is adjusted according to the monitored items and the association relationship between the monitored items, including the following process: The first process: lowering the access frequency threshold and the access count threshold for the access information corresponding to the monitored item; The second process: if the access time of a monitored access subject is concentrated and the access target covers all electronic control units, a security verification mechanism for the monitored access subject is added; The third process: if the number of visits to a monitored access target accounts for more than a set proportion threshold among all access targets, restricting access rights to the monitored access target; The fourth process: If the access rights of a monitored access subject are not passed, and the number of accesses or the access frequency exceeds the set value, the prohibited access target is determined based on the failed access rights, and the access rights of the monitored access subject are reduced based on the associated access targets of the prohibited access target.

8. The system according to claim 7, characterized in that The recording component is used to parse the diagnostic access request messages sent by multiple diagnostic access terminals to the diagnostic interface of the vehicle, obtain access information, and store the access information in a database; The access target includes an electronic control unit in a vehicle.

9. The system according to claim 7, characterized in that Also includes: The upload module is used to determine whether the access subject from which the abnormal access information comes is an attacking end if abnormal access information is monitored according to the adjusted monitoring strategy; If the access subject is an attacker, the identity, address and corresponding monitoring policy of the attacker are uploaded to the cloud platform; The cloud platform is used to send the identity, address and corresponding monitoring strategy of the attacker to the automotive diagnostic system of other vehicles.

Images