Method and equipment for identifying complex attack combination

Abstract

The invention aims to provide a method and equipment for identifying a complex attack combination, and the method specifically comprises the steps: obtaining the target security event information of vehicle equipment about an intrusion protection system, and enabling a security attack corresponding to the target security event information to comprise a target attack sequence composed of a plurality of attack units; identifying the security event information according to the attack detection database, and determining whether the target attack sequence is the same as or similar to an attack template stored in the attack detection database; and if not, determining that the target attack sequence contained in the target security event information is a complex attack combination. According to the method, the security event information of the intrusion protection system in the vehicle equipment is identified through the attack detection database, and the complex attack combination in the security event information is determined, so that the protection capability of the intrusion protection system is improved, and a better safe driving environment is provided for a driver.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a technology for identifying complex attack combinations. Background Art

[0002] As the process of automobile networking and intelligent innovation and application continues to accelerate, security features are becoming more complex, new security risks and challenges are becoming more prominent, and the application scenarios of the Internet of Vehicles have put forward higher requirements for network security and data security protection capabilities. According to research, the Internet of Vehicles has the security characteristics of "five dangers in one", namely, strong correlation with personal safety, extremely wide range of risks, huge data circulation and difficult control, intelligent networking supervision and difficult management, and multi-network integration risk spread, which are directly related to personal safety, traffic safety, public safety and even national security. The system security of vehicle equipment refers to the security protection of technology and management established and adopted for data processing systems, protecting the hardware, software and data of vehicle equipment from being destroyed, changed and leaked due to accidental and malicious reasons. Once an intelligent networked car is attacked and remotely controlled by criminals, it can endanger the life and property of drivers and passengers and others; if the enterprise production system and office network are invaded, the production line can be paralyzed, affecting the normal production and operation of the enterprise, thereby causing a blow to the entire industrial chain. Summary of the invention

[0003] One object of the present application is to provide a method and device for identifying complex attack combinations.

[0004] According to one aspect of the present application, a method for identifying a complex attack combination is provided, the method comprising: Acquire target security event information of the vehicle device regarding the intrusion protection system, wherein the security attack corresponding to the target security event information includes a target attack sequence composed of multiple attack units; Identifying the security event information according to the attack detection database, and determining whether the target attack sequence is the same as or similar to the attack template stored in the attack detection database; If not, it is determined that the target attack sequence included in the target security event information is a complex attack combination.

[0005] According to another aspect of the present application, a device for identifying a complex attack combination is provided, wherein the device includes: A module for obtaining target security event information of a vehicle device regarding an intrusion protection system, wherein the security attack corresponding to the target security event information includes a target attack sequence composed of a plurality of attack units; A module 12 is used to identify the security event information according to the attack detection database, and determine whether the target attack sequence is the same as or similar to the attack template stored in the attack detection database; Module one or three, if not, is used to determine that the target attack sequence contained in the target security event information is a complex attack combination.

[0006] According to one aspect of the present application, a computer device is provided, wherein the device includes: Processor; and A memory arranged to store computer executable instructions, which when executed cause the processor to perform the steps of any of the methods described above.

[0007] According to one aspect of the present application, a computer-readable storage medium is provided, on which a computer program / instruction is stored, characterized in that when the computer program / instruction is executed, the system performs the steps of any of the methods described above.

[0008] According to one aspect of the present application, a computer program product is provided, including a computer program / instruction, characterized in that the computer program / instruction implements the steps of any of the above methods when executed by a processor.

[0009] Compared with the prior art, the present application identifies the security event information of the intrusion protection system in the vehicle equipment through the attack detection database, and determines the complex attack combination in the security event information, thereby improving the protection capability of the intrusion protection system and providing the driver with a better safe driving environment. Furthermore, the present application can also update the attack detection database in combination with the complex attack combination, thereby enriching the data stored in the database and improving the efficiency and accuracy of the database in identifying security event information. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 A flow chart of a method for identifying complex attack combinations according to an embodiment of the present application is shown; Figure 2 A structural diagram of a device for identifying complex attack combinations according to another embodiment of the present application is shown; Figure 3 An exemplary system is shown that can be used to implement the various embodiments described in this application.

[0011] The same or similar reference numerals in the drawings represent the same or similar components. DETAILED DESCRIPTION

[0012] The present application is described in further detail below in conjunction with the accompanying drawings.

[0013] In a typical configuration of the present application, the terminal, the device of the service network and the trusted party all include one or more processors (eg, a central processing unit (CPU), an input / output interface, a network interface and a memory.

[0014] Memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash memory. Memory is an example of a computer-readable medium.

[0015] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, Phase-Change Memory (PCM), Programmable Random Access Memory (PRAM), Static Random-Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of random access memory (RAM), Read-Only Memory (ROM), Electrically-Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0016] The devices referred to in this application include but are not limited to user devices, network devices, or devices formed by integrating user devices and network devices through a network. The user devices include but are not limited to any mobile electronic products that can interact with users (for example, interact with users through a touchpad), such as smart phones, tablet computers, etc. The mobile electronic products can use any operating system, such as Android operating system, iOS operating system, etc. Among them, the network device includes an electronic device that can automatically perform numerical calculations and information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable logic devices (Programmable Logic Device, PLD), field programmable gate arrays (Field Programmable Gate Array, FPGA), digital signal processors (Digital Signal Processor, DSP), embedded devices, etc. The network devices include but are not limited to computers, network hosts, single network servers, multiple network server sets or multiple servers. The cloud is composed of a large number of computers or network servers based on cloud computing (Cloud Computing), wherein cloud computing is a type of distributed computing, a virtual supercomputer composed of a group of loosely coupled computer sets. The network includes but is not limited to the Internet, a wide area network, a metropolitan area network, a local area network, a VPN network, a wireless self-organizing network (Ad Hoc network), etc. Preferably, the device may also be a program running on the user device, the network device, or a device formed by integrating the user device and the network device, the network device, the touch terminal, or the network device and the touch terminal through a network.

[0017] Of course, those skilled in the art should understand that the above-mentioned devices are only examples, and other existing or future devices that are applicable to the present application should also be included in the scope of protection of the present application and are included here by reference.

[0018] In the description of the present application, “plurality” means two or more, unless otherwise clearly and specifically defined.

[0019] Figure 1A method for identifying a complex attack combination according to one aspect of the present application is shown, which is applied to a computer device and specifically includes steps S101, S102, and S103. In step S101, the target security event information of the vehicle device about the intrusion protection system is obtained, wherein the security attack corresponding to the target security event information includes a target attack sequence composed of multiple attack units; in step S102, the security event information is identified according to the attack detection database to determine whether the target attack sequence is the same or similar to the attack template stored in the attack detection database; in step S103, if not, it is determined that the target attack sequence contained in the target security event information is a complex attack combination. Wherein, the computer device includes a network device or an integrated device of a user device and a network device, wherein the network device includes but is not limited to a computer, a network host, a single network server, a plurality of network server sets or a cloud composed of multiple servers, and the user device includes but is not limited to any device that can interact with a user, such as a mobile phone, a personal computer or a vehicle device.

[0020] Specifically, in step S101, target security event information of the vehicle equipment about the intrusion protection system is obtained, wherein the security attack corresponding to the target security event information includes a target attack sequence composed of multiple attack units. For example, the intrusion detection and prevention system (IDPS) refers to a system that can monitor threats in the network and then take action to prevent the detected threats. As a network security technology, IDPS aims to automatically identify and defend against malicious activities and attacks against the network or system. It achieves detection and defense by monitoring network traffic and system activities, analyzing data packets, and identifying abnormal behaviors and known attack patterns. The intrusion detection and protection system is applied to vehicle equipment to detect and defend against corresponding malicious attacks during the network communication process of the vehicle equipment. After detecting the corresponding malicious attack, the intrusion detection and protection system generates corresponding security event information and uploads the security event corresponding to the malicious attack to a computer device, etc. The security event information includes the time of occurrence of the event, the state information of the vehicle subjected to the security attack, the identification information of the vehicle equipment subjected to the attack, and the data packet causing the security event, etc. The vehicle state information includes but is not limited to the vehicle lateral acceleration, longitudinal acceleration, front wheel angle, yaw angular velocity and vehicle position information, etc. The data packet is the attack data obtained by the attack detection algorithm after detecting the controller and various components of the vehicle equipment. The target attack sequence is a chain attack or ring attack to be detected composed of multiple attack units. The attack unit is used to indicate the separable, single scattered minimum attack data for security attack in the security event, etc.; the attack unit is identified and determined by matching corresponding unit features, such as identifying the corresponding attack unit by format features, behavior features, etc. of the attack data. The identification process of the attack unit can be determined by identifying and determining the local unit feature library on the vehicle equipment, or by identifying and determining the cloud unit database on the server side, etc. Each vehicle device establishes a communication connection with a computer device (e.g., a network device) through vehicle network communication, and reports the security event information of each vehicle device to the computer device based on the communication connection, so that the computer device obtains the security event information of the vehicle device that has established a connection with the cloud. Alternatively, in some cases, the computer device is a third-party server outside the network security system, and the computer device obtains the security event information uploaded by each vehicle device to the network security server from the server of the network security system, so as to further identify and process the corresponding security event information. The target security event information refers to the security event information to be detected uploaded by the current vehicle device to the server.

[0021] In step S102, the security event information is identified according to the attack detection database to determine whether the target attack sequence is the same or similar to the attack template stored in the attack detection database. For example, the computer device is provided with a corresponding attack detection database, and the attack detection database stores sequence identification records of attack sequences composed of multiple attack units, each sequence identification record contains corresponding sequence identification information and an attack template of the attack sequence, and the attack template includes format data features and behavior data features for identifying each of the corresponding multiple attack units, and the sequence type of the multiple attack units, such as chain, ring, etc. The attack template in the attack detection database can be obtained through neural network model training, for example, by inputting corresponding attack sample data into the template for training to obtain the attack features of the corresponding attack sequence, etc. After the computer device obtains the target security event information to be detected, the target security event information is input into the corresponding attack detection database, and the template recognition is performed on the target attack sequence through feature matching, and the corresponding target attack sequence in the target security event information is feature matched with the attack template, and it is determined whether there is an attack template similar or identical to the target attack sequence in the attack detection database, etc. The attack template similar to the target attack sequence in the attack detection database means that the similarity between the attack template and the sequence features extracted from the target attack sequence is greater than or equal to a similarity threshold, etc.

[0022] In step S103, if not, it is determined that the target attack sequence contained in the target security event information is a complex attack combination. For example, if the computer device does not match an attack template that matches the target attack sequence in the attack detection database (for example, the similarity between the target attack sequence and any attack template is less than the similarity threshold), it is determined that the target attack sequence contained in the target security event information is an attack template not stored in the system, and the target attack sequence is determined as a complex attack combination, and the complex attack combination is used to indicate attack template data not stored on the server side. In some embodiments, in step S103, if yes, the target attack identification information corresponding to the target attack sequence is determined, and the target security event information is updated based on the target attack identification information. For example, if a computer device matches a matching attack template that matches the target attack sequence in the attack detection database (for example, the similarity between the target attack sequence and a certain attack template is greater than or equal to a similarity threshold), the target attack sequence contained in the target security event information is determined to be the matching attack template, and the attack identification information of the matching attack template is determined as the target attack identification information of the target attack sequence (for example, a sequence identification numbered XXXYYY, etc.), and the target attack identification information is added to the target security event information to update the event data of the target security event information, so that the server can perform statistical analysis on the security event information, etc.

[0023] In some embodiments, the method further includes step S104 (not shown), in which, using a correlation analysis algorithm, each of the multiple attack units of the target attack sequence is unit parsed to obtain a parsed target attack sequence; and the attack detection database is updated according to the parsed target attack sequence. For example, the correlation analysis algorithm is a method in data mining, which is mainly used to discover interesting relationships or correlations in a data set, and is particularly popular in market basket analysis. For example, (X) is the antecedent of a rule (a set of items), (Y) is the consequent of a rule (another set of items), the confidence (X \cup Y) is used to indicate the proportion of transactions from X to Y, and the confidence (X) is used to indicate the proportion of transactions from X to X. Example Assume that in a supermarket shopping data set, we find that transactions containing milk and bread account for 20% of all transactions, and transactions containing milk account for 40% of all transactions. Then, the confidence of "milk → bread" is: milk bread This means that in a shopping basket containing milk, there is a 50% probability that bread will also be included. Generally, the higher the confidence, the more reliable the rule, which means that the probability of the consequent appearing when the antecedent appears is greater. Rule screening: In the association rule learning algorithm, confidence is often used as a threshold, and only rules with confidence higher than a certain threshold will be retained. If the computer device does not match an attack template that matches the target attack sequence in the attack detection database, and determines that the target attack sequence is determined to be a complex attack combination, it is necessary to further identify the target attack sequence, parse the target attack sequence, determine the attack behavior and attack type of the target attack sequence, and thus perform security assessment and security control on the target attack sequence. The computer device can match based on the unit template of each attack unit, thereby sequentially identifying multiple target attack units contained in the target attack sequence, thereby determining the data contained in the target attack sequence, such as the sequence identification information of the target attack sequence composed of the unit identification information of the attack units sequentially contained in the target attack sequence. In some embodiments, the target attack sequence also includes the unit arrangement order of the multiple attack units. For example, the attack sequence identification information of the target attack sequence may be composed of the unit identification information of the multiple attack units. In some cases, the target attack sequence is executed by multiple attack units in a certain order. In this case, the attack sequence identification information of the corresponding target attack sequence includes not only the unit identification information of the multiple attack units but also the arrangement order of the unit identification information of the multiple attack units.

[0024] After the computer device identifies the target attack sequence, it can update the attack detection database based on the target attack sequence, such as storing the sequence features of the parsed target attack sequence as the template features of the target attack sequence in the attack detection database, so that the attack detection database can quickly identify the same or similar attack sequences as the target attack sequence in the subsequent attack detection process. In some embodiments, the updating of the attack detection database according to the parsed target attack sequence includes: generating a corresponding target attack template according to the parsed target attack sequence, and updating the target attack template to the attack detection database. For example, after the computer device parses and identifies the target attack sequence, it can advance the template features of the target attack sequence and store the target attack template in the attack detection database. In addition, based on the confidence in the correlation analysis algorithm, the computer device can also update the confidence in the attack unit based on the attack unit contained in the target attack sequence, such as performing a certain weight ratio on the target attack sequence to determine the confidence of each attack unit and other attack units. In some cases, the weight of the target attack sequence may be an initial weight ratio assigned by the system, or may be determined based on the frequency with which the target attack sequence is identified within a subsequent unit of time (eg, one day, one week, or one month, etc.).

[0025] In some embodiments, the method of using a correlation analysis algorithm to perform unit analysis on each of the multiple attack units of the target attack sequence to obtain the analyzed target attack sequence includes: using a correlation analysis algorithm to analyze each of the multiple attack units of the target attack sequence to determine the unit identification information corresponding to each attack unit; and determining the analyzed target attack sequence according to the unit identification information of the multiple attack units. For example, for the identification of each attack unit, it is usually necessary to perform feature matching on the attack unit with a large number of attack units in a unit database. For an attack sequence containing multiple attack units, this requires high computing resources. Using a correlation analysis algorithm, the accuracy of identification can be improved while saving computing resources and improving identification efficiency. The computer device analyzes the multiple attack units in turn through the correlation analysis algorithm, extracts the unit features of each attack unit, and matches them with the unit features, thereby determining the unit identification information of each attack unit, and then determining the analyzed target attack sequence according to the unit identification information of the multiple attack units, such as generating the attack sequence identification corresponding to the target attack sequence according to the unit identification information and sorting of the multiple attack units.

[0026] In some embodiments, the method of using a correlation analysis algorithm to analyze each of the multiple attack units of the target attack sequence to determine the unit identification information corresponding to each attack unit includes: performing unit analysis on the first attack unit of the multiple attack units of the target attack sequence to determine the unit identification information of the first attack unit, and using a correlation analysis algorithm to perform unit analysis on each subsequent attack unit in turn according to the confidence of each subsequent attack unit and the previous attack unit of the subsequent attack unit, until the unit identification information corresponding to each attack unit is determined. For example, after the computer device obtains the corresponding target attack sequence, matching is performed based on the confidence between the adjacent attack units, which can greatly reduce the amount of matching calculations. The computer device first matches and identifies the first attack unit, and matches and determines the unit identification information of the first attack unit from the unit database, wherein the first attack unit is used to indicate the head of a chain attack or the first attack unit to perform an attack in a ring attack, etc. The computer device recognizes the unit identification information of the first attack unit, and can determine other attack units with higher confidence than the first attack unit based on the confidence, and match the attack unit after the first attack unit with the other attack units with higher confidence, thereby narrowing the matching range, improving the matching efficiency, and reducing the computing resources. If an attack unit matching the latter attack unit is matched from other attack units with higher confidence than the first attack unit, the next attack unit is matched backward in sequence according to the confidence of the matched attack unit until the last attack unit is matched, thereby parsing the target attack sequence. If an attack unit matching the latter attack unit is not matched from other attack units with higher confidence than the first attack unit, then the attack unit with lower confidence than the first attack unit is matched again, or the attack unit is matched from all unit templates, etc.

[0027] In some embodiments, the method of using a correlation analysis algorithm to perform unit analysis on each subsequent attack unit in sequence according to the confidence of each subsequent attack unit and the previous attack unit of the subsequent attack unit includes: d. using a correlation analysis algorithm, taking the next subsequent attack unit of the currently analyzed attack unit as the subsequent attack unit to be detected, querying and determining the unit confidence list of the previous attack unit of the subsequent attack unit, matching the multiple attack units included in the unit confidence list with the attack unit to be analyzed in order from high to low confidence, until an attack unit matching the subsequent attack unit to be detected is determined, so as to determine the unit identification information of the subsequent attack unit to be detected; and repeating step d. until the unit identification information corresponding to the last attack unit in the target attack sequence is determined. For example, for the currently matched attack unit, the next attack unit of the attack unit in the attack sequence is called the subsequent attack unit. The computer device stores a pairwise confidence list for each attack unit. The confidence list of the matched attack unit can be queried according to the unit identification information of the matched attack unit. In order to improve the matching efficiency, the computer device can match the unit template corresponding to the unit identification information in the confidence list with the subsequent attack unit to be matched according to the confidence level in the confidence list from high to low, until the attack unit matching the subsequent attack unit to be detected is determined; or, if the attack unit matching the subsequent attack unit is not matched from the unit confidence list, the subsequent attack unit is matched from all unit templates, etc. For each matched attack unit, the above matching process is performed in sequence, so that the attack sequence contained in the complex attack combination can be quickly and accurately identified based on the confidence level.

[0028] In some embodiments, the method further includes step S105 (not shown), in which an event check is performed on the parsed target attack sequence and the target security event information. If the check is passed, the parsed target attack sequence is determined to be a valid attack sequence; if not, the parsed target attack sequence is determined to be an invalid attack sequence; wherein, the updating of the attack detection database according to the parsed target attack sequence includes: if the parsed target attack sequence is determined to be a valid attack sequence, the attack detection database is updated according to the parsed target attack sequence. For example, after the computer device parses the corresponding target attack sequence, it is also necessary to perform an event check on the target security event, such as checking the vehicle data such as the vehicle status information contained in the target security event information, and excluding system anomalies caused by non-security attacks, such as component errors or system false alarms. The event check can be to review the vehicle data in the target security event information through the system, or to send the vehicle data of the target security event information to the management device of the management personnel for manual review by the management personnel, etc. If the target security event information does not contain other system anomalies, it is determined that the target security event information passes the verification, and the parsed target attack sequence is determined to be a valid attack sequence; if not, the parsed target attack sequence is determined to be an invalid attack sequence. In some cases, the computer device will also verify the parsed target attack sequence with the vehicle status information to determine whether the vehicle status information conforms to the error caused by the target attack sequence, etc. If so, it is determined that the target security event information passes the verification, and the parsed target attack sequence is determined to be a valid attack sequence; if not, the parsed target attack sequence is determined to be an invalid attack sequence.

[0029] The above mainly introduces various embodiments of a method for identifying complex attack combinations of the present application. In addition, the present application also provides specific devices that can implement the above embodiments. Figure 2 Make an introduction.

[0030] Figure 2 A computer device 100 for identifying a complex attack combination according to one aspect of the present application is shown, specifically comprising a first module 101, a second module 102 and a third module 103. The first module 101 is used to obtain target security event information of a vehicle device regarding an intrusion protection system, wherein the security attack corresponding to the target security event information includes a target attack sequence composed of multiple attack units; the first module 102 is used to identify the security event information according to the attack detection database, and determine whether the target attack sequence is the same as or similar to the attack template stored in the attack detection database; the third module 103, if not, is used to determine that the target attack sequence contained in the target security event information is a complex attack combination.

[0031] In some implementations, in step S103, if yes, target attack identification information corresponding to the target attack sequence is determined, and the target security event information is updated based on the target attack identification information.

[0032] Here, the Figure 2 The implementations corresponding to the illustrated one-one module 101, one-two module 102 and one-three module 103 are the same or similar to the aforementioned embodiments of step S101, step S102 and step S103, and thus are not described in detail and are included herein by reference.

[0033] In some embodiments, the device further includes a module (not shown) for performing unit analysis on each of the multiple attack units of the target attack sequence using a correlation analysis algorithm to obtain a parsed target attack sequence; and updating the attack detection database according to the parsed target attack sequence. For example, the correlation analysis algorithm is a method in data mining, which is mainly used to discover interesting relationships or correlations in a data set, and is particularly popular in market basket analysis. For example, (X) is the antecedent of a rule (a set of items), (Y) is the consequent of a rule (another set of items), the confidence (X \cup Y) is used to indicate the proportion of transactions from X to Y, and the confidence (X) is used to indicate the proportion of transactions from X to X. Example Assume that in a supermarket shopping data set, we find that transactions containing milk and bread account for 20% of all transactions, and transactions containing milk account for 40% of all transactions. Then, the confidence of "milk → bread" is: milk bread This means that in a shopping basket containing milk, there is a 50% probability that bread will also be included. Generally, the higher the confidence, the more reliable the rule, which means that the probability of the consequent appearing when the antecedent appears is greater. Rule screening: In the association rule learning algorithm, confidence is often used as a threshold, and only rules with confidence higher than a certain threshold will be retained. If the computer device does not match an attack template that matches the target attack sequence in the attack detection database, and determines that the target attack sequence is determined to be a complex attack combination, it is necessary to further identify the target attack sequence, parse the target attack sequence, determine the attack behavior and attack type of the target attack sequence, and thus perform security assessment and security control on the target attack sequence. The computer device can match based on the unit template of each attack unit, thereby sequentially identifying multiple target attack units contained in the target attack sequence, thereby determining the data contained in the target attack sequence, such as the sequence identification information of the target attack sequence composed of the unit identification information of the attack units sequentially contained in the target attack sequence. In some embodiments, the target attack sequence also includes the unit arrangement order of the multiple attack units. For example, the attack sequence identification information of the target attack sequence may be composed of the unit identification information of the multiple attack units. In some cases, the target attack sequence is executed by multiple attack units in a certain order. In this case, the attack sequence identification information of the corresponding target attack sequence includes not only the unit identification information of the multiple attack units but also the arrangement order of the unit identification information of the multiple attack units.

[0034] After the computer device identifies the target attack sequence, it can update the attack detection database based on the target attack sequence, such as storing the sequence features of the parsed target attack sequence as the template features of the target attack sequence in the attack detection database, so that the attack detection database can quickly identify the same or similar attack sequences as the target attack sequence in the subsequent attack detection process. In some embodiments, the updating of the attack detection database according to the parsed target attack sequence includes: generating a corresponding target attack template according to the parsed target attack sequence, and updating the target attack template to the attack detection database. For example, after the computer device parses and identifies the target attack sequence, it can advance the template features of the target attack sequence and store the target attack template in the attack detection database. In addition, based on the confidence in the correlation analysis algorithm, the computer device can also update the confidence in the attack unit based on the attack unit contained in the target attack sequence, such as performing a certain weight ratio on the target attack sequence to determine the confidence of each attack unit and other attack units. In some cases, the weight of the target attack sequence may be an initial weight ratio assigned by the system, or may be determined based on the frequency with which the target attack sequence is identified within a subsequent unit of time (eg, one day, one week, or one month, etc.).

[0035] In some embodiments, the method of using a correlation analysis algorithm to perform unit analysis on each of the multiple attack units of the target attack sequence to obtain the analyzed target attack sequence includes: using a correlation analysis algorithm to analyze each of the multiple attack units of the target attack sequence to determine the unit identification information corresponding to each attack unit; and determining the analyzed target attack sequence according to the unit identification information of the multiple attack units. For example, for the identification of each attack unit, it is usually necessary to perform feature matching on the attack unit with a large number of attack units in a unit database. For an attack sequence containing multiple attack units, this requires high computing resources. Using a correlation analysis algorithm, the accuracy of identification can be improved while saving computing resources and improving identification efficiency. The computer device analyzes the multiple attack units in turn through the correlation analysis algorithm, extracts the unit features of each attack unit, and matches them with the unit features, thereby determining the unit identification information of each attack unit, and then determining the analyzed target attack sequence according to the unit identification information of the multiple attack units, such as generating the attack sequence identification corresponding to the target attack sequence according to the unit identification information and sorting of the multiple attack units.

[0036] In some embodiments, the method of using a correlation analysis algorithm to analyze each of the multiple attack units of the target attack sequence to determine the unit identification information corresponding to each attack unit includes: performing unit analysis on the first attack unit of the multiple attack units of the target attack sequence to determine the unit identification information of the first attack unit, and using a correlation analysis algorithm to perform unit analysis on each subsequent attack unit in turn according to the confidence of each subsequent attack unit and the previous attack unit of the subsequent attack unit, until the unit identification information corresponding to each attack unit is determined. For example, after the computer device obtains the corresponding target attack sequence, matching is performed based on the confidence between the adjacent attack units, which can greatly reduce the amount of matching calculations. The computer device first matches and identifies the first attack unit, and matches and determines the unit identification information of the first attack unit from the unit database, wherein the first attack unit is used to indicate the head of a chain attack or the first attack unit to perform an attack in a ring attack, etc. The computer device recognizes the unit identification information of the first attack unit, and can determine other attack units with higher confidence than the first attack unit based on the confidence, and match the attack unit after the first attack unit with the other attack units with higher confidence, thereby narrowing the matching range, improving the matching efficiency, and reducing the computing resources. If an attack unit matching the latter attack unit is matched from other attack units with higher confidence than the first attack unit, the next attack unit is matched backward in sequence according to the confidence of the matched attack unit until the last attack unit is matched, thereby parsing the target attack sequence. If an attack unit matching the latter attack unit is not matched from other attack units with higher confidence than the first attack unit, then the attack unit with lower confidence than the first attack unit is matched again, or the attack unit is matched from all unit templates, etc.

[0037] In some embodiments, the method of using a correlation analysis algorithm to perform unit analysis on each subsequent attack unit in sequence according to the confidence of each subsequent attack unit and the previous attack unit of the subsequent attack unit includes: d. using a correlation analysis algorithm, taking the next subsequent attack unit of the currently analyzed attack unit as the subsequent attack unit to be detected, querying and determining the unit confidence list of the previous attack unit of the subsequent attack unit, matching the multiple attack units included in the unit confidence list with the attack unit to be analyzed in order from high to low confidence, until an attack unit matching the subsequent attack unit to be detected is determined, so as to determine the unit identification information of the subsequent attack unit to be detected; and repeating step d. until the unit identification information corresponding to the last attack unit in the target attack sequence is determined. For example, for the currently matched attack unit, the next attack unit of the attack unit in the attack sequence is called the subsequent attack unit. The computer device stores a pairwise confidence list for each attack unit. The confidence list of the matched attack unit can be queried according to the unit identification information of the matched attack unit. In order to improve the matching efficiency, the computer device can match the unit template corresponding to the unit identification information in the confidence list with the subsequent attack unit to be matched according to the confidence level in the confidence list from high to low, until the attack unit matching the subsequent attack unit to be detected is determined; or, if the attack unit matching the subsequent attack unit is not matched from the unit confidence list, the subsequent attack unit is matched from all unit templates, etc. For each matched attack unit, the above matching process is performed in sequence, so that the attack sequence contained in the complex attack combination can be quickly and accurately identified based on the confidence level.

[0038] In some embodiments, the device also includes a module (not shown) for performing event verification on the parsed target attack sequence and the target security event information. If the verification passes, the parsed target attack sequence is determined to be a valid attack sequence; if not, the parsed target attack sequence is determined to be an invalid attack sequence; wherein, updating the attack detection database according to the parsed target attack sequence includes: if it is determined that the parsed target attack sequence is a valid attack sequence, updating the attack detection database according to the parsed target attack sequence.

[0039] Here, the specific implementations corresponding to the 14th module and the 15th module are the same or similar to the embodiments of the aforementioned step S104 and step S105, and thus will not be described in detail but are included herein by reference.

[0040] In addition to the methods and devices described in the above embodiments, the present application also provides a computer-readable storage medium, which stores computer code. When the computer code is executed, the method described in any of the preceding items is executed.

[0041] The present application also provides a computer program product. When the computer program product is executed by a computer device, the method described in any of the preceding items is executed.

[0042] The present application also provides a computer device, the computer device comprising: one or more processors; a memory for storing one or more computer programs; When the one or more computer programs are executed by the one or more processors, the one or more processors are caused to implement the method as described in any of the preceding items.

[0043] Figure 3 An exemplary system that can be used to implement various embodiments described in this application is shown; like Figure 3 In some embodiments shown, the system 300 can be used as any of the above-mentioned devices in each of the described embodiments. In some embodiments, the system 300 may include one or more computer-readable media (e.g., system memory or non-volatile memory (NVM) / storage device 320) with instructions and one or more processors (e.g., (one or more) processors 305) coupled to the one or more computer-readable media and configured to execute instructions to implement modules to perform the actions described in this application.

[0044] For one embodiment, system control module 310 may include any suitable interface controller to provide any suitable interface to at least one of processor(s) 305 and / or any suitable device or component in communication with system control module 310 .

[0045] The system control module 310 may include a memory controller module 330 to provide an interface to the system memory 315. The memory controller module 330 may be a hardware module, a software module, and / or a firmware module.

[0046] The system memory 315 may be used, for example, to load and store data and / or instructions for the system 300. For one embodiment, the system memory 315 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the system memory 315 may include a double data rate type four synchronous dynamic random access memory (Double Data Rate 4 SDRAM, DDR4 SDRAM).

[0047] For one embodiment, system control module 310 may include one or more input / output (I / O) controllers to provide interfaces to NVM / storage device 320 and communication interface(s) 325 .

[0048] For example, NVM / storage device 320 may be used to store data and / or instructions. NVM / storage device 320 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDD), one or more compact disc (CD) drives, and / or one or more digital versatile disc (DVD) drives).

[0049] NVM / storage device 320 may include storage resources that are physically part of the device on which system 300 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 320 may be accessed over a network via communication interface(s) 325.

[0050] Communication interface(s) 325 may provide an interface for system 300 to communicate over one or more networks and / or with any other suitable devices. System 300 may wirelessly communicate with one or more components of a wireless network in accordance with any of one or more wireless network standards and / or protocols.

[0051] For one embodiment, at least one of the processor(s) 305 may be packaged together with the logic of one or more controllers (e.g., memory controller module 330) of the system control module 310. For one embodiment, at least one of the processor(s) 305 may be packaged together with the logic of one or more controllers of the system control module 310 to form a System In a Package (SiP). For one embodiment, at least one of the processor(s) 305 may be integrated on the same die with the logic of one or more controllers of the system control module 310. For one embodiment, at least one of the processor(s) 305 may be integrated on the same die with the logic of one or more controllers of the system control module 310 to form a System On Chip (SoC).

[0052] In various embodiments, the system 300 may be, but is not limited to: a server, a workstation, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the system 300 may have more or fewer components and / or different architectures. For example, in some embodiments, the system 300 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application specific integrated circuit (ASIC), and a speaker.

[0053] It should be noted that the present application can be implemented in software and / or a combination of software and hardware, for example, it can be implemented using an application-specific integrated circuit (ASIC), a general-purpose computer or any other similar hardware device. In one embodiment, the software program of the present application can be executed by a processor to implement the steps or functions described above. Similarly, the software program of the present application (including related data structures) can be stored in a computer-readable recording medium, for example, a RAM memory, a magnetic or optical drive or a floppy disk and the like. In addition, some steps or functions of the present application can be implemented using hardware, for example, as a circuit that cooperates with a processor to perform various steps or functions.

[0054] In addition, a part of the present application may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present application through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes but is not limited to source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0055] Communication media include media by which communication signals containing, for example, computer readable instructions, data structures, program modules, or other data are transmitted from one system to another. Communication media may include guided transmission media such as cables and wires (e.g., optical fiber, coaxial, etc.) and wireless (unguided transmission) media that can propagate energy waves, such as acoustic, electromagnetic, radio frequency (RF), microwave, and infrared. Computer readable instructions, data structures, program modules, or other data may be embodied as a modulated data signal in, for example, a wireless medium such as a carrier wave or similar mechanism such as that embodied as part of spread spectrum technology. The term "modulated data signal" refers to a signal whose one or more characteristics are changed or set in such a way as to encode information in the signal. Modulation may be analog, digital, or a hybrid modulation technique.

[0056] By way of example and not limitation, computer-readable storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. For example, computer-readable storage media include, but are not limited to, volatile memory, such as random access memory (RAM, DRAM, SRAM); and non-volatile memory, such as flash memory, various read-only memories (ROM, PROM, EPROM, EEPROM), magnetic and ferromagnetic / ferroelectric memories (MRAM, FeRAM); and magnetic and optical storage devices (hard disks, magnetic tapes, CDs, DVDs); or other media now known or later developed that can store computer-readable information / data for use with a computer system.

[0057] Here, according to an embodiment of the present application, a device is included, which includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein, when the computer program instructions are executed by the processor, the device is triggered to run the methods and / or technical solutions based on the aforementioned multiple embodiments of the present application.

[0058] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the spirit or basic features of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the present application is limited by the attached claims rather than the above description, so it is intended to include all changes that fall within the meaning and scope of the equivalent elements of the claims in the present application. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

Claims

1. A method for identifying complex attack combinations, wherein: The method includes: a. obtaining target security event information of the vehicle device regarding the intrusion protection system, wherein the security attack corresponding to the target security event information includes a target attack sequence composed of a plurality of attack units; b. identifying the security event information according to the attack detection database, and determining whether the target attack sequence is the same as or similar to the attack template stored in the attack detection database; c. If not, it is determined that the target attack sequence included in the target security event information is a complex attack combination.

2. The method according to claim 1, wherein: The step c also includes: If so, the target attack identification information corresponding to the target attack sequence is determined, and the target security event information is updated based on the target attack identification information.

3. The method according to claim 1, wherein: The method further comprises: Using a correlation analysis algorithm, performing unit analysis on each of the multiple attack units of the target attack sequence to obtain a analyzed target attack sequence; The attack detection database is updated according to the parsed target attack sequence.

4. The method according to claim 3, wherein: The updating of the attack detection database according to the parsed target attack sequence includes: A corresponding target attack template is generated according to the parsed target attack sequence, and the target attack template is updated to the attack detection database.

5. The method according to claim 3, wherein: The method of using a correlation analysis algorithm to perform unit analysis on each of the multiple attack units of the target attack sequence to obtain a analyzed target attack sequence includes: Analyze each attack unit in the target attack sequence by using a correlation analysis algorithm to determine the unit identification information corresponding to each attack unit; The parsed target attack sequence is determined according to the unit identification information of the multiple attack units.

6. The method according to claim 5, wherein: The method of using a correlation analysis algorithm to analyze each of the multiple attack units in the target attack sequence to determine the unit identification information corresponding to each attack unit includes: The first attack unit among the multiple attack units of the target attack sequence is subjected to unit analysis to determine the unit identification information of the first attack unit, and a correlation analysis algorithm is used to sequentially analyze each subsequent attack unit according to the confidence of each subsequent attack unit and the previous attack unit of the subsequent attack unit, until the unit identification information corresponding to each attack unit is determined.

7. The method according to claim 6, wherein: The method of using the correlation analysis algorithm to sequentially analyze each subsequent attack unit according to the confidence of each subsequent attack unit and the previous attack unit of the subsequent attack unit includes: d. using a correlation analysis algorithm, taking the next subsequent attack unit of the currently resolved attack unit as the subsequent attack unit to be detected, querying and determining a unit confidence list of a previous attack unit of the subsequent attack unit, and matching multiple attack units included in the unit confidence list with the attack unit to be resolved in order from high to low confidence, until an attack unit matching the subsequent attack unit to be detected is determined, so as to determine the unit identification information of the subsequent attack unit to be detected; Repeat step d until the unit identification information corresponding to the last attack unit in the target attack sequence is determined.

8. The method according to any one of claims 5 to 7, wherein: The target attack sequence also includes a unit arrangement order of the multiple attack units.

9. The method according to claim 3, wherein: The method further comprises: Performing event verification on the parsed target attack sequence and the target security event information, if the verification passes, determining that the parsed target attack sequence is a valid attack sequence; if not, determining that the parsed target attack sequence is an invalid attack sequence; Wherein, updating the attack detection database according to the parsed target attack sequence includes: If it is determined that the parsed target attack sequence is a valid attack sequence, the attack detection database is updated according to the parsed target attack sequence.

10. A device for identifying complex attack combinations, wherein: The equipment includes: A module for obtaining target security event information of a vehicle device regarding an intrusion protection system, wherein the security attack corresponding to the target security event information includes a target attack sequence composed of multiple attack units; A module 12 is used to identify the security event information according to the attack detection database, and determine whether the target attack sequence is the same as or similar to the attack template stored in the attack detection database; Module one or three, if not, is used to determine that the target attack sequence contained in the target security event information is a complex attack combination.

11. A computer device, wherein: The equipment includes: Processor; and A memory arranged to store computer executable instructions which, when executed, cause the processor to perform the steps of the method as claimed in any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: The computer program / instructions, when executed, cause the system to perform the steps of the method as claimed in any one of claims 1 to 9.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images