Intrusion detection system message reporting method, device, equipment and medium

Abstract

The invention discloses an intrusion detection system message reporting method, apparatus and device, and a medium. The method comprises the steps of obtaining an intrusion detection system message of each vehicle controller; state judgment and score calculation processing are carried out on each vehicle controller, and an uploading controller is determined; the information of the intrusion detection system is reported to the cloud through the uploading controller; according to the scheme, the uploading controller is determined by calculating the performance of each controller, and the intrusion detection system message can be timely uploaded to the cloud based on the uploading controller. According to the embodiment of the invention, the message reporting efficiency can be improved, and the method can be widely applied to the technical field of vehicle-mounted networks.

Description

Technical Field

[0001] The present application relates to the field of vehicle-mounted network technology, and in particular to an intrusion detection system message reporting method, device, equipment and medium. Background Art

[0002] With the development of vehicle networking and intelligence, more and more countries and regions have begun to pay attention to vehicle network security and have formulated relevant laws and standards to regulate the use and requirements of vehicle intrusion detection systems (IDS). In related technologies, when communicating with the cloud, IDS aggregates data to a certain vehicle controller in the vehicle and then uploads it to the cloud. However, when the vehicle controller that uploads the IDS message crashes or loses its Internet access function for some reason, the IDS message cannot be uploaded to the cloud in time, which will cause a delay in responding to security threats and increase the risk of the device being successfully attacked. In summary, the technical problems existing in related technologies need to be improved. Summary of the invention

[0003] The main purpose of the embodiments of the present application is to provide an intrusion detection system message reporting method, device, equipment and medium, which can improve the timeliness of message reporting.

[0004] To achieve the above object, an embodiment of the present application provides a method for reporting an intrusion detection system message, the method comprising:

[0005] Obtain intrusion detection system messages from each vehicle controller;

[0006] Performing status judgment and score calculation processing on each of the vehicle controllers to determine an uploading controller;

[0007] The intrusion detection system message is reported to the cloud through the upload controller.

[0008] In some embodiments, the step of obtaining the intrusion detection system message of each vehicle controller includes the following steps:

[0009] deploying an intrusion detection system and management module in each of the vehicle controllers;

[0010] The management module collects and processes messages of the intrusion detection system to obtain the intrusion detection system messages.

[0011] In some embodiments, the deploying of the intrusion detection system and management module in each of the vehicle controllers comprises at least one of the following steps:

[0012] deploying the intrusion detection system and the management module in a microprocessor unit of the vehicle controller;

[0013] Alternatively, the intrusion detection system is deployed in a microcontroller of the vehicle controller, and the management module is deployed in a microprocessor unit of the vehicle controller.

[0014] In some embodiments, the state judgment and score calculation processing of each vehicle controller to determine the uploading vehicle controller includes the following steps:

[0015] Acquiring status information of the vehicle controller through the intrusion detection system, and sending the status information to the management module;

[0016] The management module performs resource scoring calculation processing on the vehicle controller according to the status information to obtain a scoring table;

[0017] The vehicle controller with the highest score obtained by screening according to the scoring table is determined as the uploading vehicle controller.

[0018] In some embodiments, the resource scoring calculation processing of the vehicle controller by the management module according to the state information to obtain a scoring table includes the following steps:

[0019] Acquire processor resources, memory resources and disk resources of the vehicle controller according to the status information;

[0020] Calculating and processing the processor resources, the memory resources, and the disk resources in combination with a weight coefficient set to obtain a resource score for each of the vehicle controllers;

[0021] The resource score is saved in the management module to obtain the score table.

[0022] In some embodiments, the combined weight coefficient set is used to calculate the processor resources, the memory resources, and the disk resources to obtain a resource score for each of the vehicle controllers, specifically including the following steps:

[0023] Determine a first coefficient, a second coefficient, and a third coefficient according to the weight coefficient set;

[0024] Performing processor index and load condition scoring processing on the processor resource to obtain a first score;

[0025] Performing memory index and usage scoring on the memory resource to obtain a second score;

[0026] Performing disk index and usage scoring processing on the disk resource to obtain a third score;

[0027] The first coefficient is multiplied by the first score, the second coefficient is multiplied by the second score, the third coefficient is multiplied by the third score, and all calculated product results are added to obtain the resource score.

[0028] In some embodiments, reporting the intrusion detection system message to the cloud through the upload controller includes the following steps:

[0029] The intrusion detection system message is acquired by communicating with other controllers through the upload controller;

[0030] The upload controller is used to register with the cloud, and the intrusion detection system message is encrypted and transmitted to the cloud.

[0031] To achieve the above-mentioned purpose, another aspect of the embodiment of the present application provides an intrusion detection system message reporting device, the device comprising:

[0032] The first module is used to obtain intrusion detection system messages of each controller;

[0033] The second module is used to perform status judgment and score calculation processing on each of the controllers to determine the uploading controller;

[0034] The third module is used to report the intrusion detection system message to the cloud through the upload controller.

[0035] In some embodiments, the first module, used to obtain intrusion detection system messages of each vehicle controller, includes:

[0036] A first unit, for deploying an intrusion detection system and a management module in each of the vehicle controllers;

[0037] The second unit is used to collect and process the message of the intrusion detection system through the management module to obtain the intrusion detection system message.

[0038] In some embodiments, the first unit, for deploying an intrusion detection system and a management module in each of the vehicle controllers, includes:

[0039] A first subunit, configured to deploy the intrusion detection system and the management module in a microprocessor unit of the vehicle controller;

[0040] The second subunit is used to deploy the intrusion detection system in the microcontroller of the vehicle controller and to deploy the management module in the microprocessor unit of the vehicle controller.

[0041] In some embodiments, the second module is used to perform status judgment and score calculation processing on each vehicle controller to determine the uploading vehicle controller, including:

[0042] A third unit, configured to obtain status information of the vehicle controller through the intrusion detection system and send the status information to the management module;

[0043] A fourth unit is used to perform resource scoring calculation processing on the vehicle controller according to the state information through the management module to obtain a scoring table;

[0044] The fifth unit is used to screen the vehicle controller with the highest score according to the scoring table and determine it as the uploading vehicle controller.

[0045] In some embodiments, the fourth unit is used to perform resource scoring calculation processing on the vehicle controller according to the state information through the management module to obtain a scoring table, including:

[0046] A third subunit is used to obtain the processor resources, memory resources and disk resources of the vehicle controller according to the state information;

[0047] A fourth subunit is used to calculate and process the processor resources, the memory resources and the disk resources in combination with a weight coefficient set to obtain a resource score of each of the vehicle controllers;

[0048] The fifth subunit is used to save the resource score to the management module to obtain the score table.

[0049] In some embodiments, the fourth subunit is used to calculate and process the processor resources, the memory resources, and the disk resources in combination with the weight coefficient set to obtain a resource score for each of the vehicle controllers, specifically including:

[0050] A first micro unit, configured to determine a first coefficient, a second coefficient, and a third coefficient according to the weight coefficient set;

[0051] A second micro unit is used to perform processor index and load condition scoring processing on the processor resource to obtain a first score;

[0052] A third micro-unit is used to perform memory index and usage scoring processing on the memory resource to obtain a second score;

[0053] The fourth micro-unit is used to perform disk index and usage scoring processing on the disk resource to obtain a third score;

[0054] The fifth micro unit is used to multiply the first coefficient by the first score, multiply the second coefficient by the second score, multiply the third coefficient by the third score, and add all the calculated product results to obtain the resource score.

[0055] In some embodiments, the third module, used to report the intrusion detection system message to the cloud through the upload controller, includes:

[0056] A sixth unit is used to communicate with other controllers through the upload controller to obtain the intrusion detection system message;

[0057] The seventh unit is used to register with the cloud through the upload controller and encrypt the intrusion detection system message and transmit it to the cloud.

[0058] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the above-mentioned method when executing the computer program.

[0059] To achieve the above objective, another aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0060] The embodiments of the present application include at least the following beneficial effects: the present application provides an intrusion detection system message reporting method, apparatus, equipment and medium, the scheme obtains the intrusion detection system messages of each vehicle controller; performs status judgment and score calculation processing on each vehicle controller to determine the upload controller; and reports the intrusion detection system message to the cloud through the upload controller; the scheme determines the upload controller by calculating the performance of each controller, and can upload the intrusion detection system message to the cloud in a timely manner based on the upload controller, thereby reducing the risk of the controller being unable to upload messages due to shutdown or loss of Internet access for some reason, and improving the timeliness of message reporting. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a schematic diagram of the architecture of an intrusion detection system provided in an embodiment of the present application;

[0062] Figure 2 This is a flow chart of a method for reporting intrusion detection system messages provided by an embodiment of the present application;

[0063] Figure 3 is a schematic diagram of a single-core deployment provided in an embodiment of the present application;

[0064] Figure 4 is a schematic diagram of a dual-core deployment provided in an embodiment of the present application;

[0065] Figure 5 It is a cloud interaction flow chart of an intrusion detection system provided in an embodiment of the present application;

[0066] Figure 6 is a communication flow chart of an intrusion detection system provided by an embodiment of the present application;

[0067] Figure 7 This is a periodic reporting flow chart provided in an embodiment of the present application;

[0068] Figure 8 This is a trigger reporting flow chart provided in an embodiment of the present application;

[0069] Fig. 9 It is a structural diagram of an intrusion detection system message reporting device provided in an embodiment of the present application;

[0070] Fig.10 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0072] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0073] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0074] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0075] Before describing the embodiments of the present application in detail, some nouns and terms involved in the embodiments of the present application are first described. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0076] 1) An Intrusion Detection System (IDS) is a network security device or software application that monitors and analyzes network or system activities to identify potential malicious activities or security violations. These systems look for abnormal behavior patterns by examining data sources such as network traffic, system logs, and application logs. These patterns may indicate security threats such as unauthorized access, malware infection, data leakage, etc.

[0077] 2) A vehicle controller is an electronic device that receives signals from sensors and other input devices, processes and analyzes these signals according to predetermined programs and algorithms, and thus achieves precise control of various vehicle operations. According to different control objects and functions, vehicle controllers can be divided into many types, such as engine control unit (ECU), transmission control unit (TCU), brake control unit (BCM), air conditioning control unit (HVAC), body controller, airbag controller (SBC), navigation control system, vehicle stability control system (VSC), drive control unit (DCU) and auxiliary driving system controller.

[0078] 3) Vehicle CAN Network Intrusion Detection System (CAN IDS), specifically refers to the intrusion detection system designed for vehicle CAN network. With the development of vehicle intelligence and networking, CAN network, as an important medium for communication between vehicle electronic controllers, has received increasing attention for its security.

[0079] 4) Host-based Intrusion Detection System (HIDS) focuses on the internal system and monitors the dynamic behavior of all or part of the system and the status of the entire computer system. HIDS installs probes (agents) in the protected system, tightly ties it to the operating system kernel and services, and monitors various system events, such as kernel or API calls, specific system files, and executable file calls.

[0080] 5) Network Intrusion Detection System (NIDS) is mainly used to detect intrusion behaviors through the network. It is an important part of the network security architecture. It can monitor network traffic, analyze data packet contents, detect any possible attack behaviors, and issue alarms in time.

[0081] 6) An intelligent vehicle is a comprehensive device that integrates environmental perception, planning and decision-making, multi-level assisted driving and other functions. It concentrates on the use of computers, modern sensors, information fusion, communications, artificial intelligence and automatic control technologies. It can exchange information with people, vehicles, roads, etc. through on-board environmental perception devices and information terminals, so that the vehicle has intelligent environmental perception capabilities and can automatically analyze the safety and dangerous status of vehicle driving.

[0082] With the development of vehicle networking and intelligence, more and more countries and regions have begun to pay attention to vehicle network security and have formulated relevant laws and standards to regulate the use and requirements of vehicle IDS. Therefore, many controllers in vehicles have deployed IDS, such as CAN IDS, H IDS and N IDS. As the degree of intelligence and interconnection of vehicles increases, many controllers in vehicles have Internet access functions, and the network attack surface of vehicles continues to expand. Vehicle IDS needs to constantly adapt to new threats and attack methods, including remote attacks, malware, data tampering, etc. In related technologies, most IDSs aggregate data to a certain controller in the vehicle when communicating with the cloud, and then upload it to the cloud in a unified manner. This processing method will cause a problem: when the controller that uploads the IDS message crashes or loses the Internet access function for some reason, the IDS message cannot be uploaded to the cloud in time, which may have serious consequences.

[0083] In view of this, an embodiment of the present application provides an intrusion detection system message reporting method, device, electronic device and storage medium. The scheme obtains the intrusion detection system messages of each vehicle controller; performs status judgment and score calculation processing on each vehicle controller to determine the upload controller; and reports the intrusion detection system message to the cloud through the upload controller. The scheme determines the upload controller by calculating the performance of each controller, and can upload the intrusion detection system message to the cloud in a timely manner based on the upload controller, thereby reducing the risk of the controller being unable to upload messages due to shutdown or loss of Internet access for some reason, and improving the timeliness of message reporting.

[0084] An intrusion detection system message reporting method provided in an embodiment of the present application relates to the field of vehicle-mounted network technology. An intrusion detection system message reporting method provided in an embodiment of the present application can be applied to a terminal, can also be applied to a server, and can also be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a vehicle-mounted terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or it can be configured as a server cluster or a distributed device composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements an intrusion detection system message reporting method, etc., but is not limited to the above forms.

[0085] The present application can be used in many general or special computer device environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor devices, microprocessor-based devices, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above devices or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0086] Figure 1It is a schematic diagram of the architecture of an intrusion detection system provided by an embodiment of the present application, wherein an IDS (intrusion detection system) and an IDSM (intrusion detection system management module) are deployed in a vehicle controller in an embodiment of the present application. Since there are multiple controllers in a vehicle, the embodiment of the present application takes component 1, component 2 and component 3 as examples. IDS messages can be exchanged between components, i.e., between vehicle controllers using TCP communication. The intrusion detection system management module is used to receive intrusion detection system messages of each intrusion detection system, perform management processing such as filtering, and then select a controller based on the intrusion detection system message reporting method of the embodiment of the present application, for example, select component 2 as the upload controller, and upload all intrusion detection system messages to the Web cloud through the communication method of HTTPS+WSS. Among them, HTTPS is a hypertext transfer security protocol, which implements data encryption and identity authentication by adding an SSL / TLS (Secure Sockets Layer / Transport Layer Security Protocol) layer on the basis of the HTTP protocol. WSS (WebSocket Secure) is an encrypted version of WebSocket, which encrypts and securely processes WebSocket connections through the TLS / SSL protocol. WebSocket is a protocol for full-duplex communication on a single TCP connection, which allows the server to actively push information to the client, realizing real-time communication between the client and the server.

[0087] Figure 2 This is an optional flowchart of an intrusion detection system message reporting method provided in an embodiment of the present application. Figure 2 The method may include but is not limited to steps S201 to S203.

[0088] Step S201, obtaining intrusion detection system messages of each vehicle controller;

[0089] Step S202, performing status judgment and score calculation processing on each of the vehicle controllers to determine the uploading controller;

[0090] Step S203: reporting the intrusion detection system message to the cloud through the upload controller.

[0091] Steps S201 to S203 shown in the embodiment of the present application are performed by obtaining the intrusion detection system messages of each vehicle controller; performing status judgment and score calculation processing on each vehicle controller to determine the upload controller; and reporting the intrusion detection system messages to the cloud through the upload controller. This scheme determines the upload controller by calculating the performance of each controller, and can upload the intrusion detection system messages to the cloud in a timely manner based on the upload controller, thereby reducing the risk of the controller being unable to upload messages due to shutdown or loss of Internet access for some reason, and improving the timeliness of message reporting.

[0092] In step S201 of some embodiments, obtaining the intrusion detection system message of each vehicle controller includes the following steps:

[0093] deploying an intrusion detection system and management module in each of the vehicle controllers;

[0094] The management module collects and processes messages of the intrusion detection system to obtain the intrusion detection system messages.

[0095] In an embodiment of the present application, an intrusion detection system (IDS) and a management module (IDS Manager, IDSM) are set in each vehicle controller, wherein the intrusion detection system is used to monitor and analyze network or system activities of the vehicle controller to identify potential malicious activities or security violations. The management module is used to receive IDS security events generated by each controller, collect and filter them, and obtain intrusion detection system messages. The embodiment of the present application can manage intrusion detection system messages by deploying a management module, thereby improving the efficiency of message management and facilitating subsequent message reporting.

[0096] In some embodiments, the deploying of the intrusion detection system and management module in each of the vehicle controllers comprises at least one of the following steps:

[0097] deploying the intrusion detection system and the management module in a microprocessor unit of the vehicle controller;

[0098] Alternatively, the intrusion detection system is deployed in a microcontroller of the vehicle controller, and the management module is deployed in a microprocessor unit of the vehicle controller.

[0099] In the embodiment of the present application, an intrusion detection system and management module are deployed in the microprocessor unit of the vehicle controller. Figure 3 The embodiment of the present application provides a single-core deployment method, by deploying multiple intrusion detection systems and a management module in a microprocessor unit (MPU), the intrusion detection system includes H IDS, CAN IDS and N IDS, each intrusion detection system is connected to the management module, and the intrusion detection system messages (N IDS messages) of all intrusion detection systems in the microprocessor unit are received and managed by the management module. The embodiment of the present application also provides a multi-core deployment method, by deploying an intrusion detection system in a microcontroller of a vehicle controller and deploying a management module in a microprocessor unit of a vehicle controller, please refer to Figure 4In addition to the management module, the microprocessor unit can also deploy an intrusion detection system, wherein the CAN IDS intrusion detection system is deployed in the microcontroller (MCU), and the H IDS, NISD and management module (IDSM) are deployed in the microprocessor unit (MPU). The intrusion detection system messages of all intrusion detection systems are received and managed through the management module. The embodiment of the present application can be applied to the vehicle controller by deploying the management module in a single-core or multi-core environment to improve the efficiency of message reporting.

[0100] In some embodiments, the state judgment and score calculation processing of each vehicle controller to determine the uploading vehicle controller includes the following steps:

[0101] Acquiring status information of the vehicle controller through the intrusion detection system, and sending the status information to the management module;

[0102] The management module performs resource scoring calculation processing on the vehicle controller according to the status information to obtain a scoring table;

[0103] The vehicle controller with the highest score obtained by screening according to the scoring table is determined as the uploading vehicle controller.

[0104] In an embodiment of the present application, the intrusion detection system collects the status information of the controller and sends the information to the respective management module components. It is conceivable that the intrusion detection system can collect the status information of the controller periodically or trigger the collection of the status information of the controller. The management module filters the collected information and saves it locally for reporting. When the periodic intrusion detection system message is about to be reported, the management module in each controller determines whether the controller has the ability to access the Internet based on the status information. If there is the ability to access the Internet, the resource score is performed based on its own CPU resources, memory resources, and disk resources, and a score table is recorded. The vehicle controller with the highest score in the score table is selected as the upload controller, so that all intrusion detection system messages are reported to the cloud based on the upload controller, reducing the risk of not being able to report messages in time when the controller is unavailable, and improving the timeliness of message reporting.

[0105] In some embodiments, the resource scoring calculation processing of the vehicle controller by the management module according to the state information to obtain a scoring table includes the following steps:

[0106] Acquire processor resources, memory resources and disk resources of the vehicle controller according to the status information;

[0107] Calculating and processing the processor resources, the memory resources, and the disk resources in combination with a weight coefficient set to obtain a resource score for each of the vehicle controllers;

[0108] The resource score is saved in the management module to obtain the score table.

[0109] In an embodiment of the present application, by analyzing the status information of each vehicle controller, the processor resources, memory resources and disk resources of each vehicle controller can be obtained. By calculating and processing the processor resources, memory resources and disk resources in combination with a set of weight coefficients, a resource score of each vehicle controller is obtained, and the resource score is saved to a management module to obtain a score table. The embodiment of the present application can save the resource score of each vehicle controller to a management module, providing a data basis for subsequent controller screening.

[0110] In some embodiments, the combined weight coefficient set is used to calculate the processor resources, the memory resources, and the disk resources to obtain a resource score for each of the vehicle controllers, specifically including the following steps:

[0111] Determine a first coefficient, a second coefficient, and a third coefficient according to the weight coefficient set;

[0112] Performing processor index and load condition scoring processing on the processor resource to obtain a first score;

[0113] Performing memory index and usage scoring on the memory resource to obtain a second score;

[0114] Performing disk index and usage scoring processing on the disk resource to obtain a third score;

[0115] The first coefficient is multiplied by the first score, the second coefficient is multiplied by the second score, the third coefficient is multiplied by the third score, and all calculated product results are added to obtain the resource score.

[0116] In the embodiment of the present application, the weight coefficient set includes a first coefficient, a second coefficient and a third coefficient, which are used to adjust the importance of different resources in the score, and can be adjusted according to specific circumstances and needs to reflect the impact of different resources on the performance of the control machine. The processor resource is scored by processing the processor index and load situation, and the first score is obtained. The first score is the CPU resource score. By considering the CPU frequency, core number, cache size and other indicators, as well as the CPU load situation, a relative CPU resource score is calculated based on these indicators. The memory resource is scored by processing the memory index and usage situation, and the second score is obtained. The second score is the memory resource score. By considering the memory capacity, bandwidth and delay and other indicators, as well as the memory usage, a relative memory resource score is calculated based on these indicators. The disk resource is scored by processing the disk index and usage situation, and the third score is obtained. The third score is the disk resource score. By considering the disk capacity, read and write speed and reliability and other indicators, as well as the disk usage, a relative disk resource score is calculated based on these indicators. The resource score of the embodiment of the present application is based on the formula: performance score = w1×CPU resource score + w2×memory resource score + w3×disk resource score. Wherein, w1, w2 and w3 are weight coefficients, which are the first coefficient, the second coefficient and the third coefficient, respectively. Specifically, the first coefficient is multiplied by the first score, the second coefficient is multiplied by the second score, the third coefficient is multiplied by the third score, and all the product results calculated are added to obtain the resource score. According to the selection of the specific resource score and the weight coefficient, the formula can be appropriately adjusted according to actual needs. For example, if the CPU resource is more important to the performance of the controller, the value of w1 can be increased to make the CPU resource account for a larger proportion in the score. It should be noted that the design of the formula should be based on the actual resource indicators and the performance requirements of the controller, and verification and testing are required to ensure its accuracy and effectiveness. In addition, the specific implementation of the formula may vary due to different controller systems and requirements. It can be imagined that after calculating the score, each controller IDSM in the embodiment of the present application records the score in the score table of the IDSM and broadcasts it together with the identification code of the controller itself. In this way, the identification code and score of itself and all other controllers will be recorded in the IDSM, and the IDSM will send the message to the controller with the highest score according to the score to obtain the reporting controller. After receiving the IDS information sent by other controllers, the reporting controller reports the IDS message to the cloud. The embodiment of the present application calculates the controller performance to facilitate the calculation of controller scores for different systems, thereby reducing the risk of the controller being unavailable and unable to report messages in time.

[0117] In some embodiments, reporting the intrusion detection system message to the cloud through the upload controller includes the following steps:

[0118] The intrusion detection system message is acquired by communicating with other controllers through the upload controller;

[0119] The upload controller is used to register with the cloud, and the intrusion detection system message is encrypted and transmitted to the cloud.

[0120] In the embodiment of the present application, after the IDS is deployed to each controller, the controllers communicate with each other through the TCP protocol, and the communication with the cloud uses the WSS+HTTPS protocol. Through the TCP protocol communication processing between the uploading controller and other controllers, all intrusion detection system messages are obtained. When the reporting controller communicates with the cloud platform, the protocol followed is the HTTPS protocol, and the transmission content is encrypted based on 128bit AES128CBC (PKCS5Padding) based on the PKI foundation. Among them, PKI (Public Key Infrastructure) is a key management platform that follows the standard. It uses public key encryption technology to provide security services for network communication. Before this part of the encrypted transmission, the IDPS (uploading controller) needs to complete the negotiation of the registration key and the drawing key in succession. Specifically, the AES encryption algorithm with a 128-bit key is used, and encryption is performed in the CBC operation mode, and the PKCS#5 padding scheme is used to process data that is not an integer multiple of the block size. The communication content of the HTTPS protocol is probe configuration, registration key and negotiation key. Wss is responsible for detecting uploads and defense distribution, and http registration and negotiation are required to be successful before communication. Please participate Figure 5 , the IDPS end-cloud communication process is as follows Figure 5 As shown: After the IDPS is powered on, it determines whether registration is required. If registration is required, it will apply to the cloud for negotiation of the session key. After the negotiation is successful, a long connection is established and the configuration is pulled to update the configuration file. Figure 6 , IDPS wss communication such as Figure 6 As shown: After the IDPS wss communication connection is successful, the IDPS reports the periodic heartbeat, and the cloud determines whether the controller has completed registration. If the review is passed, it starts to receive the periodic status message and trigger event message sent by the IDPS. The embodiment of the present application realizes the distributed upload of IDS messages through a distributed IDS system, which improves the timeliness and confidentiality of message reporting.

[0121] The following is a detailed description and explanation of the solution of the embodiment of the present application in conjunction with a specific application example:

[0122] The embodiments of the present application can be applied to the field of vehicle network technology. In a feasible implementation, the present application is applied to the intrusion detection system of the controller in the intelligent vehicle, and the IDS message can be reported to the cloud through periodic reporting and triggered reporting. Figure 7 , periodic reporting means that each controller uploads its own status information every once in a while to maintain a long connection with the cloud. IDS periodically collects the status information of the controller and sends the information to their respective IDSM components. IDSM filters the collected information and saves it locally for reporting. When a periodic IDS message is about to be reported, the IDSM in each controller determines whether it has the ability to access the Internet. If it has the ability to access the Internet, it will score itself based on its own CPU resources, memory resources, and disk resources. After calculating the score, each controller IDSM will record the score in the IDSM's scoring table and broadcast it together with the controller's own identification code. In this way, the IDSM will record its own and all other controllers' identification codes and scores. Based on the score, the IDSM will send the message to the controller with the highest score. After the controller receives the IDS information sent by other controllers, it reports the IDS message to the cloud. Please refer to Figure 8 , trigger reporting is when the IDS identifies an abnormality in the controller and sends the IDS message to the IDSM, the IDSM filters and reports to the cloud. When the IDS of one or more controllers detects an abnormality and sends the IDS message to the IDSM, the IDSM sends the IDS information to the controller with the highest score based on the most recently updated identification code and score. After the controller receives the message from other controllers, the IDSM automatically reports to the cloud.

[0123] See also Fig. 9 The embodiment of the present application further provides an intrusion detection system message reporting device, which can implement the above-mentioned intrusion detection system message reporting method, and the device includes:

[0124] The first module 901 is used to obtain intrusion detection system messages of each controller;

[0125] The second module 902 is used to perform status judgment and score calculation processing on each of the controllers to determine the uploading controller;

[0126] The third module 903 is used to report the intrusion detection system message to the cloud through the upload controller.

[0127] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0128] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned intrusion detection system message reporting method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0129] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0130] See also Fig.10 , Fig.10 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0131] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0132] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store operating devices and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the intrusion detection system message reporting method of the embodiment of this application;

[0133] Input / output interface 1003, used to implement information input and output;

[0134] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WI FI, Bluetooth, etc.);

[0135] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0136] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0137] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a computer processor, the above-mentioned intrusion detection system message reporting method is implemented.

[0138] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0139] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0140] An intrusion detection system message reporting method, device, electronic device and storage medium provided in an embodiment of the present application, the scheme obtains the intrusion detection system message of each vehicle controller; performs status judgment and score calculation processing on each vehicle controller to determine the upload controller; and reports the intrusion detection system message to the cloud through the upload controller; the scheme determines the upload controller by calculating the performance of each controller, and can upload the intrusion detection system message to the cloud in a timely manner based on the upload controller, thereby reducing the risk of the controller being unable to upload messages due to shutdown or loss of Internet access for some reason, and improving the timeliness of message reporting.

[0141] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0142] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0143] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0144] Those skilled in the art will appreciate that all or some of the steps, devices, and functional modules / units in the above disclosed methods may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0145] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0146] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0147] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0148] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0149] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0150] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0151] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for reporting intrusion detection system messages, characterized in that: The method comprises the following steps: Obtain intrusion detection system messages from each vehicle controller; Performing status judgment and score calculation processing on each of the vehicle controllers to determine an uploading controller; The intrusion detection system message is reported to the cloud through the upload controller.

2. The method according to claim 1, characterized in that The method of obtaining the intrusion detection system message of each vehicle controller includes the following steps: deploying an intrusion detection system and management module in each of the vehicle controllers; The management module collects and processes messages of the intrusion detection system to obtain the intrusion detection system messages.

3. The method according to claim 2, characterized in that The deploying of the intrusion detection system and management module in each of the vehicle controllers comprises at least one of the following steps: deploying the intrusion detection system and the management module in a microprocessor unit of the vehicle controller; Alternatively, the intrusion detection system is deployed in a microcontroller of the vehicle controller, and the management module is deployed in a microprocessor unit of the vehicle controller.

4. The method according to claim 2, characterized in that: The step of performing status judgment and score calculation processing on each vehicle controller to determine the uploading vehicle controller comprises the following steps: Acquiring status information of the vehicle controller through the intrusion detection system, and sending the status information to the management module; The management module performs resource scoring calculation processing on the vehicle controller according to the status information to obtain a scoring table; The vehicle controller with the highest score obtained by screening according to the scoring table is determined as the uploading vehicle controller.

5. The method according to claim 4, characterized in that The method of performing resource scoring calculation processing on the vehicle controller according to the state information by the management module to obtain a scoring table includes the following steps: Acquire processor resources, memory resources and disk resources of the vehicle controller according to the status information; Calculating and processing the processor resources, the memory resources, and the disk resources in combination with a weight coefficient set to obtain a resource score for each of the vehicle controllers; The resource score is saved in the management module to obtain the score table.

6. The method according to claim 5, characterized in that The combining weight coefficient set is used to calculate the processor resources, the memory resources and the disk resources to obtain a resource score for each vehicle controller, specifically comprising the following steps: Determine a first coefficient, a second coefficient, and a third coefficient according to the weight coefficient set; Performing processor index and load condition scoring processing on the processor resource to obtain a first score; Performing memory index and usage scoring on the memory resource to obtain a second score; Performing disk index and usage scoring processing on the disk resource to obtain a third score; The first coefficient is multiplied by the first score, the second coefficient is multiplied by the second score, the third coefficient is multiplied by the third score, and all calculated product results are added to obtain the resource score.

7. The method according to any one of claims 1 to 6, characterized in that: The step of reporting the intrusion detection system message to the cloud through the upload controller includes the following steps: The intrusion detection system message is acquired by communicating with other controllers through the upload controller; The upload controller is used to register with the cloud, and the intrusion detection system message is encrypted and transmitted to the cloud.

8. An intrusion detection system message reporting device, characterized in that: The device comprises: The first module is used to obtain intrusion detection system messages of each controller; The second module is used to perform status judgment and score calculation processing on each of the controllers to determine the uploading controller; The third module is used to report the intrusion detection system message to the cloud through the upload controller.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images