Attack detection method, protection control method and device
By analyzing domain-specific and cellular traffic data with machine learning, the method enhances the detection and response to malicious attacks in vehicles, addressing the limitations of traditional IDPS systems.
Patent Information
- Application Number
- CN202411389961.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-08
- Publication Date
- 2024-12-31
AI Technical Summary
Traditional intrusion detection and prevention systems (IDPS) in vehicles struggle to accurately identify malicious traffic attacks, especially near-end Distributed Denial of Service (DDOS) attacks, due to varying network environments and user habits, leading to high false positive and negative rates and ineffective detection of new or unknown attacks.
A method utilizing domain controllers to count and analyze traffic within specific vehicle domains, combining intra-domain and cellular network traffic statistics, and employing machine learning algorithms to model and predict malicious attacks, with encryption for data integrity, and implementing protection controls to disconnect affected applications or domains.
Improves the accuracy and pertinence of traffic monitoring, reduces false positives and negatives, and effectively detects and responds to malicious traffic attacks, enhancing vehicle system security.
Smart Images
Figure CN119232470A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present application relate to the field of information security technology, and specifically to an attack detection method and a protection control method, apparatus, terminal equipment, and computer-readable storage medium. Background Art
[0002] With the development of intelligent driving and intelligent cockpit technology, the traffic volume and complexity generated by various components in vehicles have increased significantly. In particular, the in-vehicle infotainment system (IVI system) in the vehicle, with its rich functions and frequent interactions, may result in a large amount of data transmission, making it extremely difficult to judge malicious attacks based solely on the size of the traffic.
[0003] For the whole vehicle, each vehicle faces a different network environment, and users have different habits of using intelligent driving functions or IVI system functions. The traffic used and generated by each user is different. The OEM lacks effective model data as a reference and reference when identifying and responding to new malicious traffic attacks, which increases the difficulty and uncertainty of defense. If the whole vehicle is attacked by a near-end DDOS attack, it is impossible to identify whether there is an excessively large malicious traffic packet through the intrusion detection and prevention system (IDPS) deployed by Tbox (Telematics Box). Traditional IDPS usually relies on known attack features or patterns to detect malicious traffic, and the detection effect of new or unknown attacks is poor. The user's traffic fee surge cannot be verified, and the near-end DDOS attack is difficult to trace. Summary of the invention
[0004] In view of the above problems, the embodiments of the present application provide an attack detection method, device, storage medium and vehicle system for improving the detection effect and accuracy of malicious traffic.
[0005] According to one aspect of an embodiment of the present application, an attack detection method is provided, the method comprising: obtaining first traffic information sent by at least one domain controller; wherein the first traffic information is traffic generated by an application within the domain within a first preset time period;
[0006] According to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, it is determined whether the whole vehicle system has been attacked maliciously.
[0007] Specifically, the attack detection method of the present application utilizes a domain controller to count the traffic generated by applications within the domain it controls, obtains first traffic information, and implements modeling of traffic behavior in various areas of the vehicle. The present application analyzes the traffic generated by applications within the domain within a first preset time period and the traffic generated by the entire vehicle system as a whole to determine whether there is a malicious attack on the vehicle system, thereby improving the accuracy and pertinence of traffic monitoring, and thereby improving the granularity of traffic analysis. In addition, by analyzing traffic information to determine whether there is a malicious attack on the vehicle system, the risk of false positives and false negatives in traditional IDPS detection is reduced, and the detection effect of malicious traffic is improved.
[0008] In an optional manner, the obtaining the first flow information sent by at least one domain controller includes:
[0009] Obtaining a configuration file sent by the domain controller;
[0010] The configuration file is generated by the domain controller according to traffic generated by one or more applications in the domain within a first preset time period, and is encrypted and transmitted by the domain controller based on a communication protocol;
[0011] The configuration file is parsed to obtain first flow information.
[0012] Among them, the domain controller is a domain controller corresponding to the intelligent driving domain or the intelligent cockpit domain.
[0013] Specifically, the present application uses a domain controller to generate a configuration file based on the traffic generated by one or more applications in the domain within a first preset time period, and further subdivides the traffic calculation in the domain into traffic calculations of different applications or functional modules, thereby achieving more refined traffic monitoring and management, and improving the accuracy and pertinence of traffic monitoring. In addition, the present application encrypts and transmits the configuration file based on the communication protocol, thereby improving the protection of the integrity of the traffic data, ensuring that the traffic data in the configuration file has not been tampered with during the transmission process, and realizing secure communication of the configuration file.
[0014] In an optional manner, before judging whether the whole vehicle system has been subjected to a malicious attack based on the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, the method includes:
[0015] Acquire second flow information generated by the vehicle system within the first preset time period;
[0016] Among them, the second traffic information is the traffic information generated by the cellular traffic outlet of the whole vehicle system.
[0017] Specifically, the domain controller counts the traffic generated by the domain application in the local network or when communicating with other domain control modules. Different from the first traffic information counted by the domain controller, the second traffic information is the amount of data transmitted through the cellular network. This application analyzes the traffic information counted by both, and can identify whether there is a malicious traffic attack, realize the modeling of traffic behavior of multiple domains, improve the granularity of traffic analysis, and thus improve the detection effect of malicious traffic.
[0018] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period includes:
[0019] using the first flow information sent by one or more domain controllers as the third flow information;
[0020] When the third flow information and the second flow information meet a preset condition, it is determined that there is a malicious attack on the entire vehicle system.
[0021] In an optional manner, when the third flow information and the second flow information meet a preset condition, it is determined that there is a malicious attack on the entire vehicle system, including:
[0022] Calculate the sum of one or more first flow information in the third flow information to obtain fourth flow information;
[0023] If the ratio of the fourth flow information to the second flow information is greater than a preset threshold, it is determined that a malicious attack exists in the entire vehicle system.
[0024] Specifically, the present application calculates the ratio of the sum of the first flow information sent by one or more domain controllers to the second flow information, and sets a preset threshold for the ratio. If the ratio of the application in any one or more domains to the second flow information is greater than the preset threshold, it means that there may be traffic in the domain that does not belong to the various areas of the vehicle system, that is, malicious traffic. Therefore, it is determined that there is a malicious attack on the vehicle system, reducing the risk of false alarms and missed reports in the detection of traditional IDPS. The present application combines cellular network port traffic statistics and intra-domain traffic calculations to achieve refined monitoring and management of intra-domain application traffic, which can locate the scope of malicious attacks, realize flexible and comprehensive traffic monitoring, and reduce the risk of false alarms and missed reports in the detection of traditional IDPS.
[0025] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period further includes:
[0026] Inputting the first flow information and the second flow information generated within the first preset time period into the malicious attack detection model to analyze and predict the malicious attack, and obtain a detection result;
[0027] Among them, the malicious attack detection model is constructed based on a preset machine learning algorithm.
[0028] Specifically, this application uses big data and machine learning technology to build a malicious attack detection model, analyze and predict traffic data, and discover potential malicious traffic attack trends in advance to improve the detection effect of malicious traffic.
[0029] According to another aspect of an embodiment of the present application, a protection control method is provided, comprising: using the attack detection method as described in the invention summary to detect whether there is a malicious attack on the vehicle system;
[0030] If there is a malicious attack on the entire vehicle system, the application or domain where the malicious attack occurs is determined, and the application or domain where the malicious attack occurs is disconnected from the network.
[0031] Specifically, after identifying that a malicious attack exists in the vehicle system, the protection control method of the present application automatically takes appropriate protection measures to protect the security of the vehicle system, such as disconnecting an application that is determined to have a malicious attack or disconnecting a domain that has a malicious attack, thereby improving the security of the vehicle system.
[0032] According to another aspect of an embodiment of the present application, there is provided a malicious attack detection device, including: a parsing module and a judgment module;
[0033] The parsing module is used to obtain first traffic information sent by at least one domain controller; wherein the first traffic information is the traffic generated by an application in the domain within a first preset time period;
[0034] The judgment module is used to judge whether there is a malicious attack on the whole vehicle system according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period.
[0035] Specifically, the malicious attack detection device of the present application counts the traffic generated by applications in the domain controlled by the domain controller through a parsing unit to obtain first traffic information, thereby modeling the traffic behavior in each area of the vehicle. The present application uses a judgment unit to analyze the traffic generated by applications in the domain within a first preset time period and the traffic generated by the entire vehicle system as a whole to determine whether there is a malicious attack on the entire vehicle system, thereby improving the accuracy and pertinence of traffic monitoring and the granularity of traffic analysis. In addition, by analyzing traffic information to determine whether there is a malicious attack on the entire vehicle system, the risk of false positives and false negatives in the detection of traditional IDPS is reduced, and the detection effect of malicious traffic is improved.
[0036] According to another aspect of an embodiment of the present application, there is provided a safety protection control device, including: a detection module and a protection module;
[0037] The detection module is used to detect whether there is a malicious attack on the vehicle system by using the attack detection method described in the present invention;
[0038] The protection module is used to determine the application or domain where the malicious attack occurs if the whole vehicle system is attacked maliciously, and disconnect the application or domain where the malicious attack occurs from the network.
[0039] Specifically, the protection control device of the present application identifies whether there is a malicious attack on the entire vehicle system through a detection unit. After the protection unit identifies that there is a malicious attack on the entire vehicle system, it automatically takes appropriate protection measures to protect the entire vehicle system and improve the safety of the entire vehicle system.
[0040] According to another aspect of an embodiment of the present application, a terminal device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus;
[0041] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform the operation of the attack detection method described in the content of the present invention, or the operation of the protection control method described in the content of the present invention.
[0042] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, in which at least one executable instruction is stored, and the executable instruction enables a malicious attack detection device / apparatus to perform the operation of the attack detection method as described in the content of the present invention, or the operation of the protection control method as described in the content of the present invention.
[0043] The above description is only an overview of the technical solution of the embodiment of the present application. In order to more clearly understand the technical means of the embodiment of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] The accompanying drawings are only used to illustrate the embodiments and are not to be considered as limiting the present application. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings. In the accompanying drawings:
[0045] Figure 1 A schematic diagram showing a flow chart of an embodiment of an attack detection method provided by the present application;
[0046] Figure 2 A schematic diagram showing a flow chart of an embodiment of the protection control method provided by the present application is shown;
[0047] Figure 3 A schematic diagram showing the structure of an embodiment of an attack detection device provided by the present application is shown;
[0048] Figure 4 A schematic structural diagram of an embodiment of a protection control device provided by the present application is shown;
[0049] Figure 5 A schematic structural diagram of an embodiment of a terminal device provided in the present application is shown. DETAILED DESCRIPTION
[0050] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein.
[0051] Figure 1 FIG. 1 is a flowchart of a first embodiment of the attack detection method of the present application, which is executed by an attack detection device. Figure 1 As shown, the method comprises the following steps:
[0052] Step 110: Obtain first traffic information sent by at least one domain controller; wherein the first traffic information is the traffic generated by an application within the domain within a first preset time period.
[0053] In an optional manner, the obtaining the first flow information sent by at least one domain controller includes:
[0054] Obtaining a configuration file sent by the domain controller;
[0055] The configuration file is generated by the domain controller according to traffic generated by one or more applications in the domain within a first preset time period, and is encrypted and transmitted by the domain controller based on a communication protocol;
[0056] The configuration file is parsed to obtain first flow information.
[0057] Among them, the domain controller is a domain controller corresponding to the intelligent driving domain or the intelligent cockpit domain.
[0058] Specifically, in a smart car, the entire vehicle is divided into smart driving domain, smart cockpit domain and power domain according to its functions. The domain controller (Electronic Control Unit, ECU) is the core control unit of each domain, namely: smart driving domain controller, smart cockpit domain controller and power domain VCU (Vehicle Control Unit).
[0059] Among them, the intelligent driving domain controller is used to control the advanced driver assistance system (ADAS). The functions of the advanced driver assistance system include but are not limited to: data collection of vehicle sensors, and data processing and analysis of vehicle autonomous driving decisions. Exemplarily, the intelligent driving domain controller collects environmental data by controlling integrated down-hung sensors (such as cameras and radars that sense the vehicle's surrounding environment) to sense the vehicle's surrounding environment. The autonomous driving decision system is used for path planning decisions, speed control decisions, and obstacle avoidance decisions, etc.
[0060] The smart cockpit domain controller is used to control the in-car infotainment system and realize human-computer interaction functions. The infotainment system includes: central control display screen and audio system, etc. The infotainment system is equipped with application software such as music, map navigation and video. Human-computer interaction functions include: voice recognition and touch control, etc.
[0061] The power domain VCU is used to monitor and control the vehicle's power system, including the engine and electric motor.
[0062] Specifically, domain controllers that have operating systems and generate traffic usage, such as smart cockpit domain controllers and smart driving domain controllers, perform traffic statistics through system-level interface hooks. For example, the operating system of the domain controller is Linux or QNX operating system, or the domain controller is a real-time operating system (RTOS).
[0063] Furthermore, the domain controller monitors the data transmission volume of each application in the domain and calculates the actual traffic consumption of each application in the domain. For example, the traffic consumed by the smart cockpit system is mainly used for software updates, map downloads, and online entertainment.
[0064] Preferably, each domain controller calculates the actual traffic used by the applications it carries, such as IVI applications and ADAS applications, in the domain on an hourly basis, records the traffic size used by each application, and generates a configuration file. The configuration file includes: traffic information such as the traffic size value and the application name.
[0065] In an optional manner, before judging whether the whole vehicle system has been subjected to a malicious attack based on the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, the method includes:
[0066] Acquire second flow information generated by the vehicle system within the first preset time period;
[0067] Among them, the second traffic information is the traffic information generated by the cellular traffic outlet of the whole vehicle system.
[0068] Specifically, Tbox is used to count the second traffic information. Tbox is mainly responsible for the communication between the vehicle and the external network, such as remote monitoring, vehicle positioning, emergency rescue and other functions. Tbox counts the data traffic generated through the cellular network through the SIM network card installed in the vehicle. In actual applications, the cellular mobile network used by the cockpit system and other systems also comes from the cellular traffic transparent transmission of Tbox.
[0069] In an optional manner, Tbox acts as an attack detection device to execute the attack detection method of the present application, and the intelligent driving system and the intelligent cockpit system respectively perform services and file transfers with Tbox based on the SOME / IP protocol of the Transport Layer Security Protocol (TLS).
[0070] Among them, SOME / IP (Scalable service-oriented Middleware over IP) is a service-oriented communication protocol used to implement distributed communication in automotive electronic systems. SOME / IP provides a flexible way to define and call services, allowing efficient communication between different electronic control units (ECUs).
[0071] TLS (Transport Layer Security) is a secure communication protocol used to provide encryption, authentication, and data integrity protection in network communications. It is commonly used to protect communications between web browsers and servers, but can also be applied to other communication scenarios.
[0072] Specifically, the SOME / IP protocol is configured in the domain controllers of the intelligent driving system and the intelligent cockpit system and in the Tbox to support TLS. The TLS function is enabled for the communication software; digital certificates are generated and managed for identity authentication and encrypted communication. The digital certificates are issued by a trusted certificate authority (CA) to ensure the authenticity of the identities of both parties in the communication.
[0073] When the domain controller communicates with Tbox, a TLS connection is first established between the two communicating parties, including a handshake process, where the two parties exchange digital certificates, verify the identities of both parties, and negotiate to generate encryption parameters. After the TLS connection is successfully established, the two communicating parties can use encryption algorithms to encrypt data for transmission. The smart cockpit domain controller and the smart driving domain controller encrypt their respective configuration files and transmit them to Tbox through a TLS connection with Tbox. Among them, TLS provides a data integrity protection mechanism to ensure that the transmitted data has not been tampered with during the transmission process. For example, this is achieved by using technologies such as message authentication codes (MACs).
[0074] Step 120: Determine whether the whole vehicle system is under malicious attack based on the first flow information and the second flow information generated by the whole vehicle system within the first preset time period.
[0075] In an optional manner, when Tbox is used as an attack detection device to execute the attack detection method of the present application, Tbox obtains configuration files sent by each domain controller; parses the configuration files to obtain first flow information, and Tbox itself counts the second flow information. Tbox determines whether there is a malicious attack on the vehicle system based on the first flow information and the second flow information generated within the first preset time period.
[0076] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period includes:
[0077] using the first flow information sent by one or more domain controllers as the third flow information;
[0078] When the third flow information and the second flow information meet a preset condition, it is determined that there is a malicious attack on the entire vehicle system.
[0079] In an optional manner, when the third flow information and the second flow information meet a preset condition, it is determined that there is a malicious attack on the entire vehicle system, including:
[0080] Calculate the sum of one or more first flow information in the third flow information to obtain fourth flow information;
[0081] If the ratio of the fourth flow information to the second flow information is greater than a preset threshold, it is determined that a malicious attack exists in the entire vehicle system.
[0082] Specifically, the first traffic information sent by the domain controller is the traffic generated by one or more applications in the domain within the first preset time period. The fourth traffic information is the sum of the first traffic information sent by one or more domain controllers. The present application does not limit the number of domain controllers and the number of applications. The sum of the traffic sizes generated by one or more applications in one of the domain controllers within the first preset time period can be used as the fourth traffic information to be compared with the second traffic information, or the sum of the traffic sizes generated by all applications in all domain controllers within the first preset time period can be used as the fourth traffic information to be compared with the second traffic information.
[0083] Theoretically, the sum of the first traffic size used by each area of the vehicle system is the same as the second traffic size used by the vehicle system through the cellular network. In actual applications, there is a certain difference between the sum of the first traffic size used by each area of the vehicle system and the second traffic size used by the vehicle system through the cellular network. When the ratio of the traffic size generated by any application in any domain controller within the first preset time period to the second traffic information is greater than the preset threshold, it means that there may be traffic in the vehicle system that does not belong to the various areas of the vehicle system, that is, malicious traffic, so it is determined that there is a malicious attack on the vehicle system.
[0084] Preferably, the sum of the traffic sizes generated by all applications in the smart cockpit domain controller and the smart driving domain controller within the first preset time period is taken as the fourth traffic information, and the ratio of the fourth traffic information to the second traffic information is calculated as:
[0085]
[0086] If the fourth flow information is greater than 120%, an alarm message is sent to the host manufacturer to indicate that there may be a risk of malicious flow attack.
[0087] If the fourth traffic information is greater than 200%, it is confirmed as a malicious traffic attack, and Tbox immediately implements a traffic blocking operation.
[0088] For example, if at a certain moment, the traffic size calculated by the intelligent driving domain controller is 100MB, the traffic size calculated by the intelligent cockpit domain controller is 200MB, and the total traffic counted by Tbox is 500MB, then the ratio of the calculated fourth traffic information to the second traffic information is (100+200) / 500=60%. If the threshold set by the OEM is 120% at this time, the system will not issue an alarm. However, if subsequent traffic changes cause the ratio to exceed the threshold, it is determined that there is a malicious attack on the vehicle system.
[0089] Preferably, the device can choose to obtain the ratio of the fourth flow information to the second flow information every several hours or minutes according to the performance computing power of the Tbox. For example, if the Tbox has strong performance, you can choose to obtain the ratio of the fourth flow information to the second flow information every 5 minutes to monitor the flow changes more timely. If the Tbox performance is average, you can choose to obtain the ratio of the fourth flow information to the second flow information every 2 hours to reduce the system burden while ensuring the monitoring effect.
[0090] Preferably, the device analyzes the operation effect of the system based on the collected data, including flow data, alarm conditions, blocking operations, etc. According to the analysis results, the detection parameters such as threshold settings and monitoring cycles are optimized and adjusted to improve the accuracy and reliability of the system.
[0091] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period further includes:
[0092] Inputting the first flow information and the second flow information generated within the first preset time period into the malicious attack detection model to analyze and predict the malicious attack, and obtain a detection result;
[0093] Among them, the malicious attack detection model is constructed based on a preset machine learning algorithm.
[0094] Specifically, hidden association patterns and abnormal behaviors can be discovered in model data through machine learning and data mining techniques to identify potential malicious network attacks. For example, based on the mining and analysis of network traffic and other data, the features that best characterize the attack behavior are extracted and selected, and appropriate machine learning algorithms are selected to build a malicious attack detection model, identify normal and abnormal network behavior patterns, and classify malicious network attacks based on these patterns. Among them, commonly used machine learning algorithms include support vector machines (SVM), decision trees, naive Bayes, and deep learning. By learning from labeled training data, it is possible to identify and track the patterns of malicious network attacks, discover potential malicious traffic attack trends in advance, and improve the detection effect of malicious traffic.
[0095] Traditional attack detection methods, such as IDPS, rely on known attack features or patterns to detect malicious traffic, and may not be able to effectively detect unknown attacks or new malware. With the trend of encryption of network communications, traditional IDPS has limited detection capabilities for encrypted traffic and is difficult to identify malicious behavior. At the same time, the detection results of traditional IDPS may have high false alarm rates and missed alarm rates, causing security personnel to spend a lot of time and energy on analysis and judgment. However, this application uses a domain controller to count the intra-domain traffic information of each domain, compare it with the second traffic information, and set a corresponding threshold. If the ratio of the application in any one or more domains to the second traffic information is greater than the preset threshold, it means that there may be traffic that does not belong to the various areas of the vehicle system, that is, malicious traffic, which effectively detects malicious attacks on the vehicle system. This application combines cellular network port traffic statistics and intra-domain traffic calculation to achieve refined monitoring and management of intra-domain application traffic, and can locate the scope of malicious attacks, realize flexible and comprehensive traffic monitoring, and reduce the risk of false alarms and missed alarms in traditional IDPS detection.
[0096] Figure 2 FIG. 1 is a flow chart showing an embodiment of the protection control method of the present application, which is executed by a protection control device. Figure 2 As shown, the method comprises the following steps:
[0097] Step 210: Use the attack detection method described in this embodiment to detect whether there is a malicious attack on the entire vehicle system.
[0098] Step 220: If the whole vehicle system has a malicious attack, determine the application or domain where the malicious attack occurs, and disconnect the application or domain where the malicious attack occurs.
[0099] Specifically, if the sum of the traffic sizes generated by all applications in one of the domain controllers within the first preset time period is taken as the fourth traffic information, and the ratio of the fourth traffic information to the second traffic information is greater than a preset threshold, it can be determined that there is a malicious attack in the domain controller, and the domain controller is disconnected from the network.
[0100] Specifically, if the traffic size generated by a target application in one of the domain controllers within a first preset time period is used as the fourth traffic information, and the ratio of the fourth traffic information to the second traffic information is greater than a preset threshold, it can be determined that there is a malicious attack in the target application, and the target application is disconnected from the network, or the domain controller is disconnected from the network.
[0101] This application can locate the scope of malicious attacks through the ratio of application flow information and second flow information counted by the domain controller, realize flexible and comprehensive flow monitoring, and improve the detection effect and accuracy of malicious flow. Furthermore, it automatically adopts appropriate security protection measures to protect the entire vehicle system, thereby improving the security of the entire vehicle system.
[0102] Figure 3 FIG. 1 is a schematic diagram showing the structure of an embodiment of the attack detection device of the present application. Figure 3 As shown, the device 300 includes: a parsing module 310 and a judging module 320 .
[0103] In an optional manner, the parsing module 310 is used to obtain first traffic information sent by at least one domain controller; wherein the first traffic information is the traffic generated by an application within the domain within a first preset time period.
[0104] In an optional manner, the judgment module 320 is used to judge whether there is a malicious attack on the whole vehicle system based on the first flow information and the second flow information generated by the whole vehicle system within the first preset time period.
[0105] In an optional manner, the obtaining the first flow information sent by at least one domain controller includes:
[0106] Obtaining a configuration file sent by the domain controller;
[0107] The configuration file is generated by the domain controller according to traffic generated by one or more applications in the domain within a first preset time period, and is encrypted and transmitted by the domain controller based on a communication protocol;
[0108] The configuration file is parsed to obtain first flow information.
[0109] In an optional manner, the domain controller is a domain controller corresponding to the intelligent driving domain or the intelligent cockpit domain.
[0110] In an optional manner, before judging whether the whole vehicle system has been subjected to a malicious attack based on the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, the method includes:
[0111] Acquire second flow information generated by the vehicle system within the first preset time period;
[0112] Among them, the second traffic information is the traffic information generated by the cellular traffic outlet of the whole vehicle system.
[0113] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period includes:
[0114] using the first flow information sent by one or more domain controllers as the third flow information;
[0115] When the third flow information and the second flow information meet preset conditions, it is determined that there is a malicious attack on the entire vehicle system.
[0116] In an optional manner, when the third flow information and the second flow information meet a preset condition, it is determined that there is a malicious attack on the entire vehicle system, including:
[0117] Calculate the sum of one or more first flow information in the third flow information to obtain fourth flow information;
[0118] If the ratio of the fourth flow information to the second flow information is greater than a preset threshold, it is determined that a malicious attack exists in the entire vehicle system.
[0119] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period further includes:
[0120] Inputting the first flow information and the second flow information generated within the first preset time period into the malicious attack detection model to analyze and predict the malicious attack, and obtain a detection result;
[0121] Among them, the malicious attack detection model is constructed based on a preset machine learning algorithm.
[0122] The malicious attack detection device of the present application counts the traffic generated by applications in the domain controlled by the domain controller through a parsing unit to obtain the first traffic information, thereby modeling the traffic behavior in each area of the vehicle. The present application uses a judgment unit to analyze the traffic generated by applications in the domain within a first preset time period and the traffic generated by the entire vehicle system as a whole to determine whether there is a malicious attack on the entire vehicle system, thereby improving the accuracy and pertinence of traffic monitoring and the granularity of traffic analysis. In addition, by analyzing traffic information to determine whether there is a malicious attack on the entire vehicle system, the risk of false positives and false negatives in the detection of traditional IDPS is reduced, and the detection effect of malicious traffic is improved.
[0123] Figure 4 The schematic diagram of the structure of the embodiment of the protection control device of the present application is shown. Figure 4 As shown, the device 400 includes: a detection module 410 and a protection module 420 .
[0124] The detection module 410 is used to detect whether there is a malicious attack on the vehicle system using the attack detection method described in this embodiment;
[0125] The protection module 420 is used to determine the application or domain where the malicious attack occurs if the whole vehicle system is attacked maliciously, and disconnect the application or domain where the malicious attack occurs from the network.
[0126] The safety protection control device of the present application identifies whether there is a malicious attack on the entire vehicle system through a detection unit. After the protection unit identifies that there is a malicious attack on the entire vehicle system, it automatically takes appropriate protection measures to protect the entire vehicle system, thereby improving the safety of the entire vehicle system.
[0127] Figure 5 A schematic diagram of the structure of an embodiment of the terminal device of the present application is shown, and the specific embodiment of the present application does not limit the specific implementation of the terminal device.
[0128] like Figure 5 As shown, the terminal device may include: a processor (processor) 502, a communication interface (Communications Interface) 504, a memory (memory) 506, and a communication bus 508.
[0129] The processor 502, the communication interface 504, and the memory 506 communicate with each other via the communication bus 508. The communication interface 504 is used to communicate with other devices such as a client or other server network elements. The processor 502 is used to execute the program 510, which can specifically execute the above-mentioned attack detection method embodiment or the related steps in the protection control method embodiment.
[0130] Specifically, the program 510 may include program code including computer-executable instructions.
[0131] The processor 502 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the terminal device may be processors of the same type, such as one or more CPUs; or may be processors of different types, such as one or more CPUs and one or more ASICs.
[0132] The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.
[0133] The program 510 may be specifically called by the processor 502 to enable the terminal device to perform the following operations:
[0134] Acquire first traffic information sent by at least one domain controller; wherein the first traffic information is traffic generated by an application within the domain within a first preset time period;
[0135] According to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, it is determined whether the whole vehicle system has been attacked maliciously.
[0136] In an optional manner, the obtaining the first flow information sent by at least one domain controller includes:
[0137] Obtaining a configuration file sent by the domain controller;
[0138] The configuration file is generated by the domain controller according to traffic generated by one or more applications in the domain within a first preset time period, and is encrypted and transmitted by the domain controller based on a communication protocol;
[0139] The configuration file is parsed to obtain first flow information.
[0140] In an optional manner, the domain controller is a domain controller corresponding to the intelligent driving domain or the intelligent cockpit domain.
[0141] In an optional manner, before judging whether the whole vehicle system has been subjected to a malicious attack based on the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, the method includes:
[0142] Acquire second flow information generated by the vehicle system within the first preset time period;
[0143] Among them, the second traffic information is the traffic information generated by the cellular traffic outlet of the whole vehicle system.
[0144] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period includes:
[0145] using the first flow information sent by one or more domain controllers as the third flow information;
[0146] When the third flow information and the second flow information meet preset conditions, it is determined that there is a malicious attack on the entire vehicle system.
[0147] In an optional manner, when the third flow information and the second flow information meet a preset condition, it is determined that there is a malicious attack on the entire vehicle system, including:
[0148] Calculate the sum of one or more first flow information in the third flow information to obtain fourth flow information;
[0149] If the ratio of the fourth flow information to the second flow information is greater than a preset threshold, it is determined that a malicious attack exists in the entire vehicle system.
[0150] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period further includes:
[0151] Inputting the first flow information and the second flow information generated within the first preset time period into the malicious attack detection model to analyze and predict the malicious attack, and obtain a detection result;
[0152] Among them, the malicious attack detection model is constructed based on a preset machine learning algorithm.
[0153] In an optional manner, the program 510 is called by the processor 502 to enable the terminal device to perform the following operations:
[0154] Use the attack detection method of this embodiment to detect whether there is a malicious attack on the entire vehicle system;
[0155] If there is a malicious attack on the entire vehicle system, the application or domain where the malicious attack occurs is determined, and the application or domain where the malicious attack occurs is disconnected from the network.
[0156] An embodiment of the present application provides a computer-readable storage medium, which stores at least one executable instruction. When the executable instruction is executed on a terminal device, the terminal device executes the attack detection method or the protection control method in any of the above method embodiments.
[0157] The executable instructions can be specifically used to enable the terminal device to perform the following operations:
[0158] Acquire first traffic information sent by at least one domain controller; wherein the first traffic information is traffic generated by an application within the domain within a first preset time period;
[0159] According to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, it is determined whether the whole vehicle system has been attacked maliciously.
[0160] In an optional manner, the obtaining the first flow information sent by at least one domain controller includes:
[0161] Obtaining a configuration file sent by the domain controller;
[0162] The configuration file is generated by the domain controller according to traffic generated by one or more applications in the domain within a first preset time period, and is encrypted and transmitted by the domain controller based on a communication protocol;
[0163] The configuration file is parsed to obtain first flow information.
[0164] In an optional manner, the domain controller is a domain controller corresponding to the intelligent driving domain or the intelligent cockpit domain.
[0165] In an optional manner, before judging whether the whole vehicle system has been subjected to a malicious attack based on the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, the method includes:
[0166] Acquire second flow information generated by the vehicle system within the first preset time period;
[0167] Among them, the second traffic information is the traffic information generated by the cellular traffic outlet of the whole vehicle system.
[0168] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period includes:
[0169] using the first flow information sent by one or more domain controllers as the third flow information;
[0170] When the third flow information and the second flow information meet preset conditions, it is determined that there is a malicious attack on the entire vehicle system.
[0171] In an optional manner, when the third flow information and the second flow information meet a preset condition, it is determined that there is a malicious attack on the entire vehicle system, including:
[0172] Calculate the sum of one or more first flow information in the third flow information to obtain fourth flow information;
[0173] If the ratio of the fourth flow information to the second flow information is greater than a preset threshold, it is determined that a malicious attack exists in the entire vehicle system.
[0174] In an optional manner, judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period further includes:
[0175] Inputting the first flow information and the second flow information generated within the first preset time period into the malicious attack detection model to analyze and predict the malicious attack, and obtain a detection result;
[0176] Among them, the malicious attack detection model is constructed based on a preset machine learning algorithm.
[0177] In an optional manner, the executable instruction enables the terminal device to perform the following operations:
[0178] Use the attack detection method of this embodiment to detect whether there is a malicious attack on the entire vehicle system;
[0179] If there is a malicious attack on the entire vehicle system, the application or domain where the malicious attack occurs is determined, and the application or domain where the malicious attack occurs is disconnected from the network.
[0180] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system or other device. In addition, the embodiments of the present application are not directed to any particular programming language.
[0181] In the specification provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. Similarly, in order to simplify the application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, the various features of the embodiments of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. Wherein, the claims that follow the specific embodiment are thus clearly incorporated into the specific embodiment, wherein each claim itself is used as a separate embodiment of the application.
[0182] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and further may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive.
[0183] It should be noted that the above embodiments illustrate the present application rather than limit the present application, and that those skilled in the art may design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be constructed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The present application may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.
Claims
1. An attack detection method, characterized in that: include: Acquire first traffic information sent by at least one domain controller; wherein the first traffic information is traffic generated by an application within the domain within a first preset time period; According to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, it is determined whether the whole vehicle system has been attacked maliciously.
2. The attack detection method according to claim 1, characterized in that: The obtaining of first flow information sent by at least one domain controller includes: Obtaining a configuration file sent by the domain controller; The configuration file is generated by the domain controller according to traffic generated by one or more applications in the domain within a first preset time period, and is encrypted and transmitted by the domain controller based on a communication protocol; The configuration file is parsed to obtain first flow information.
3. The attack detection method according to claim 2, characterized in that: The domain controller is a domain controller corresponding to the intelligent driving domain or the intelligent cockpit domain.
4. The attack detection method according to claim 1, characterized in that: Before determining whether the whole vehicle system has been subjected to a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, the method includes: Acquire second flow information generated by the vehicle system within the first preset time period; Among them, the second traffic information is the traffic information generated by the cellular traffic outlet of the whole vehicle system.
5. The attack detection method according to any one of claims 1 to 4, characterized in that: Judging whether the whole vehicle system has been subjected to a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period includes: using the first flow information sent by one or more domain controllers as the third flow information; When the third flow information and the second flow information meet preset conditions, it is determined that there is a malicious attack on the entire vehicle system.
6. The attack detection method according to claim 5, characterized in that: When the third flow information and the second flow information meet a preset condition, it is determined that a malicious attack exists in the vehicle system, including: Calculate the sum of one or more first flow information in the third flow information to obtain fourth flow information; If the ratio of the fourth flow information to the second flow information is greater than a preset threshold, it is determined that a malicious attack exists in the entire vehicle system.
7. The attack detection method according to claim 1, characterized in that: Judging whether the whole vehicle system has a malicious attack according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period, further comprising: Inputting the first flow information and the second flow information generated within the first preset time period into the malicious attack detection model to analyze and predict the malicious attack, and obtain a detection result; Among them, the malicious attack detection model is constructed based on a preset machine learning algorithm.
8. A protection control method, characterized in that: include: Using the attack detection method according to any one of claims 1 to 7 to detect whether there is a malicious attack on the entire vehicle system; If there is a malicious attack on the entire vehicle system, the application or domain where the malicious attack occurs is determined, and the application or domain where the malicious attack occurs is disconnected from the network.
9. An attack detection device, characterized in that: The device comprises: an analysis module and a judgment module; The parsing module is used to obtain first traffic information sent by at least one domain controller; wherein the first traffic information is the traffic generated by an application in the domain within a first preset time period; The judgment module is used to judge whether there is a malicious attack on the whole vehicle system according to the first flow information and the second flow information generated by the whole vehicle system within the first preset time period.
10. A protection control device, characterized in that: The device comprises: a detection module and a protection module; The detection module is used to detect whether there is a malicious attack on the vehicle system using the attack detection method according to any one of claims 1 to 7; The protection module is used to determine the application or domain where the malicious attack occurs if the whole vehicle system is attacked maliciously, and disconnect the application or domain where the malicious attack occurs from the network.