Detection method and device for vehicle-mounted network intrusion signal, and medium

Abstract

The invention discloses a vehicle-mounted network intrusion signal detection method and device and a medium, and the method comprises the steps: carrying out the layer-by-layer analysis of an application protocol of a captured network data package, and obtaining an analysis result comprising the load content of a network data package application layer; according to the analysis result, removing the data packet of which the protocol attribute information is not matched with the preset protocol feature library to obtain a target data packet; and detecting the load content of the target data packet by using a pre-established rule base comprising intrusion event characteristics so as to determine whether an intrusion event occurs in the vehicle-mounted network. Therefore, malicious data can be timely and effectively identified and intercepted based on layer-by-layer analysis of a data packet application protocol and deep detection of load content of an application layer. In addition, whether the data packets are matched with the preset protocol feature library or not is judged in real time, and the data packets which do not accord with the protocol are quickly eliminated, so that the network attack type is quickly determined according to the load content and the rule library, the network attack is stopped in time, and the safety of the vehicle-mounted network is improved.

Description

Technical Field

[0001] The present application relates to the field of vehicle networking technology, and in particular to a method, device and medium for detecting intrusion signals in a vehicle network. Background Art

[0002] With the continuous development of Internet of Vehicles technology, in order to improve the safety of vehicle systems, Internet of Vehicles security protection has become one of the most important research directions.

[0003] In order to prevent illegal intrusion into the vehicle network system, a feasible implementation method is to obtain network traffic data packets and perform security detection on the network layer and transport layer of the data packets to prevent malicious or abnormal data packets from attacking the vehicle network. However, if only the network layer and transport layer are detected, the accuracy of identifying and intercepting malicious or abnormal data packets is low, and the vehicle system is still at great risk of being attacked.

[0004] It can be seen that how to reduce the risk of vehicle networking systems being attacked and improve the security of vehicle systems is an urgent problem to be solved by technical personnel in this field. Summary of the invention

[0005] In view of this, one aspect of the present application provides a method for detecting an in-vehicle network intrusion signal, the method comprising:

[0006] Capture network data packets transmitted in the vehicle network;

[0007] Parsing the application protocol of the network data packet layer by layer to obtain a parsing result; wherein the parsing result includes the payload content of the application layer of the network data packet;

[0008] According to the analysis result, the data packets whose protocol attribute information in the network data packets does not match the preset protocol feature library are removed to obtain the target data packets;

[0009] The payload content of the target data packet is detected using a pre-established rule base including intrusion event characteristics to determine whether an intrusion event occurs in the vehicle network.

[0010] Optionally, the application protocol of the network data packet is parsed layer by layer to obtain a parsing result, including:

[0011] Based on the network communication protocol rules, extract the bytes to be analyzed in the network layer of the network data packet;

[0012] Extracting the bytes to be analyzed at the transport layer in the network data packet according to the bytes to be analyzed at the network layer;

[0013] Extracting the bytes to be analyzed at the application layer in the network data packet according to the bytes to be analyzed at the transport layer;

[0014] The bytes to be analyzed of the application layer are analyzed to obtain the analysis result; the analysis result also includes the destination port number and application layer header information of the network data packet.

[0015] Optionally, removing the protocol attribute information in the network data packet that does not match a preset protocol feature library includes:

[0016] Preprocessing the network data packet to obtain a data packet to be matched;

[0017] The application layer header information and payload content of the data packet to be matched are matched with the preset protocol feature library to eliminate the data packets whose protocol attribute information does not match the preset protocol feature library.

[0018] Optionally, preprocessing the network data packet to obtain a data packet to be matched includes:

[0019] After stream reassembling the network data packet, a reassembled data packet is obtained;

[0020] After filtering out the data packets whose destination port numbers do not belong to the preset port library in the reassembled data packets, the data packets to be matched are obtained.

[0021] Optionally, the preset protocol feature library includes multiple preset protocol feature libraries, each of which stores attribute information of a different protocol, and each of the preset protocol feature libraries is provided with a different handle.

[0022] Optionally, matching the application layer header information and the payload content of the data packet to be matched with the preset protocol feature library includes:

[0023] Determine the protocol type of the data packet to be matched according to the application layer header information of the data packet to be matched;

[0024] Retrieving a target preset protocol feature library by calling the handle corresponding to the protocol type;

[0025] The application layer header information and payload content of the data packet to be matched are matched with the target preset protocol feature library.

[0026] Optionally, after determining whether an intrusion event occurs in the vehicle network, the method further includes:

[0027] If the intrusion event occurs in the vehicle network, determining whether the intrusion data packet in which the intrusion event occurs in the target data packet belongs to the whitelist according to the analysis result;

[0028] If so, it is determined that the intrusion data packet is legitimate;

[0029] If not, determine the threat level of the intrusion event, and perform corresponding alarm processing according to the threat level.

[0030] Optionally, performing corresponding alarm processing according to the threat level includes:

[0031] If the threat level is a low threat level, the intrusion event is reported to the management platform so that the management platform can determine whether to block the intrusion data packet;

[0032] If the threat level is higher than the low threat level, perform the following steps:

[0033] Associating the intrusion events belonging to the same attack type within a preset period to obtain a first alarm set;

[0034] Aggregating the first alarm set with the same source address to obtain a second alarm set;

[0035] Determining a target processing decision corresponding to the second alarm set according to a historical alarm decision database;

[0036] The intrusion event corresponding to the second alarm set is processed through the target processing decision.

[0037] Optionally, the application protocol of the network data packet is parsed layer by layer, including:

[0038] Multithreading is called to perform layer-by-layer analysis of application protocols on different network data packets.

[0039] Optionally, the method further includes:

[0040] Collecting statistics on traffic usage information corresponding to the target data packet;

[0041] storing the traffic usage information in a traffic database;

[0042] Traffic resources are allocated to each of the target data packets according to the traffic database.

[0043] Another aspect of the present application provides a method and device for detecting an in-vehicle network intrusion signal, the device comprising:

[0044] A capture module, used to capture network data packets transmitted in the vehicle network;

[0045] A parsing module, used to parse the application protocol of the network data packet layer by layer to obtain a parsing result; wherein the parsing result includes the payload content of the application layer of the network data packet;

[0046] A removal module is used to remove the data packets whose protocol attribute information in the network data packets does not match the preset protocol feature library according to the analysis result, so as to obtain the target data packets;

[0047] The detection module is used to detect the payload content of the target data packet using a pre-established rule base including intrusion event characteristics to determine whether an intrusion event occurs in the vehicle network.

[0048] Another aspect of the present application provides a device for detecting an in-vehicle network intrusion signal, comprising a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and when the processor executes the program, the steps of the method for detecting an in-vehicle network intrusion signal are implemented.

[0049] Another aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for detecting intrusion signals in a vehicle network.

[0050] The present application provides a method, device and medium for detecting intrusion signals in a vehicle network, and the beneficial effects are as follows: based on the layer-by-layer analysis of the data packet application protocol, the application layer of the data packet is deeply analyzed, and the payload content encapsulated in the application layer is detected, and malicious data packets or abnormal data packets are timely and effectively identified and intercepted, thereby reducing the risk of the vehicle network system being attacked. In addition, by determining whether the data packet matches the preset protocol feature library, that is, judging in real time whether the data packet conforms to the standard protocol, the data packets that do not conform to the protocol are quickly eliminated, and the type of network attack is further quickly determined according to the payload content and rule library of the data packet, so as to block it in time and improve the security of the vehicle network. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A schematic diagram of a flow chart of a method for detecting an in-vehicle network intrusion signal provided in an embodiment of the present application;

[0052] Figure 2 A flowchart of a method for detecting an in-vehicle network intrusion signal provided by another embodiment of the present application;

[0053] Figure 3 A schematic diagram of the principle of a network data packet detection component provided in an embodiment of the present application;

[0054] Figure 4 A schematic diagram of a preset protocol feature library provided in an embodiment of the present application;

[0055] Figure 5 A flowchart of a method for detecting an in-vehicle network intrusion signal provided by another embodiment of the present application;

[0056] Figure 6 A schematic diagram of the structure of a vehicle network intrusion signal detection device provided in an embodiment of the present application;

[0057] Figure 7 A schematic diagram of the structure of a vehicle network intrusion signal detection device provided in another embodiment of the present application.

[0058] The figure numbers are as follows: 50 is a data packet capture tool, 51 is an application protocol parsing unit, 52 is a feature matching unit, 53 is a processing unit, 70 is a memory, 71 is a processor, 72 is a display screen, 73 is an input and output interface, 74 is a communication interface, 75 is a power supply, 76 is a communication bus, 701 is a computer program, 702 is an operating system, and 703 is data. DETAILED DESCRIPTION

[0059] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0060] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0061] Figure 1 A flow chart of a method for detecting an in-vehicle network intrusion signal provided in an embodiment of the present application is shown as follows: Figure 1 As shown, the method includes:

[0062] S10: Capture network data packets transmitted in the vehicle network;

[0063] First of all, it should be noted that the execution subject of the vehicle network intrusion signal detection method provided in the embodiment of the present application can be a vehicle controller or a domain controller, and the present application does not limit this. In addition, the detection method provided in the present application can be applied to vehicles including but not limited to sedans, sport utility vehicles (SUV), multi-purpose vehicles (MPV), off-road vehicles, pickup trucks or other power-driven non-track-borne vehicles.

[0064] In an optional embodiment, the network data packets transmitted in the residential vehicle network can be captured by the Libcap message high-speed capture tool, wherein the network data packets include information such as source address, destination address, protocol type, port number, data packet length, timestamp, protocol identifier, etc.

[0065] S11: parsing the application protocol of the network data packet layer by layer to obtain a parsing result; wherein the parsing result includes the payload content of the application layer of the network data packet;

[0066] Furthermore, after the network data packet is captured in step S10, the application protocol of the network data packet is parsed layer by layer in step S11. It can be understood that the application protocol includes the network layer, the transport layer and the application layer. In a specific embodiment, when the network data packet is parsed for the application protocol, the network layer, the transport layer and the application layer can be parsed layer by layer in turn to obtain the parsing result.

[0067] It is worth noting that in order to deeply mine abnormal data in network data packets, the detection method provided in the embodiment of the present application, step S11 goes deep into the application layer of the network data packet to perform analysis and determine the payload content of the application layer of the network data packet.

[0068] S12: according to the analysis result, the data packets whose protocol attribute information in the network data packets does not match the preset protocol feature library are removed to obtain the target data packets;

[0069] Furthermore, we can deeply mine the subtle data changes in the macro data flow, judge in real time whether the protocol attribute information of the network data packet complies with the standard protocol, and eliminate the network data packets that do not comply with the standard protocol.

[0070] Specifically, the protocol attribute information of the network data packet can be determined according to the analysis result, thereby eliminating the data packets whose protocol attribute information does not match the preset protocol feature library in the network data packet, and obtaining the target data packet after elimination. The preset protocol feature library stores the protocol attribute features under different protocols, and according to the preset protocol feature library, it can be determined whether the data packet in the data stream conforms to the standard protocol.

[0071] It should be noted that the preset protocol feature library includes but is not limited to the protocol attribute information of the Hypertext Transfer Protocol (HTTP), the Secure Transport Layer (TLS Record Protocol, TLS), the Domain Name System (DNS), the Message Queuing Telemetry Transport (MQTT), the Diagnostic Communication over Internet Protocol (DoIP), the SOME / IP and GB / T 32960.3 protocols.

[0072] In an optional embodiment, the protocols in the preset protocol feature library and the attribute information corresponding to the protocols can be flexibly configured, modified, deleted and extended according to different scenarios and business requirements. Therefore, based on the preset protocol feature library, the detection method provided in the embodiment of the present application can support interception of multiple types of signals, that is, a comprehensive data packet detection method is provided.

[0073] S13: Using a pre-established rule base including intrusion event characteristics, the payload content of the target data packet is detected to determine whether an intrusion event occurs in the vehicle network.

[0074] In an optional embodiment, a rule base including intrusion event characteristics is pre-established. After filtering and determining the target data packets that comply with the standard protocol, the payload content of the target data packets can be detected based on the rule base to determine whether an intrusion event has occurred in the vehicle network.

[0075] It is understandable that the rule base stores features of different intrusion events. For example, in DOIP protocol communication, if a DOIP payload of 0x0002 is detected, it can be determined that the target data packet is an abnormal data packet.

[0076] In an optional embodiment, after determining the data packet payload content and the specific protocol type through step S11 and step S12, the payload content is parsed to restore each field to obtain plain text, and further determine whether the restored plain text is abnormal data through the rule base, thereby determining whether the target data packet is an abnormal data packet. Table 1 is a schematic table of a rule base provided in an embodiment of the present application. For ease of understanding, an example will be given below in conjunction with Table 1.

[0077] Table 1 Rule base

[0078]

[0079]

[0080] For example, the payload content parsing result is: alert doip any any->any any(msg:"doip invalid(Vehicle identification request)";doip.payload.type:0x0002;classtype:misc-attack;sid:5100001;rev:2;).

[0081] After obtaining the parsing result, it is determined whether the data packet is an abnormal data packet according to Table 1. It can be understood that Table 1 is used to monitor the DOIP protocol communication in the network, and when a DOIP payload of type 0x0002 (assumed to be an invalid vehicle identification request) is detected, an alarm is triggered, that is, the data packet is determined to be an abnormal data packet, marked as a potential attack or abnormal behavior, and an intrusion event is determined to have occurred.

[0082] Therefore, the detection method of the vehicle network intrusion signal provided by the embodiment of the present application is based on the layer-by-layer analysis of the data packet application protocol, goes deep into the application layer of the data packet, detects the payload content encapsulated by the application layer, and promptly and effectively identifies and intercepts malicious data packets or abnormal data packets, thereby reducing the risk of the vehicle network system being attacked. In addition, by determining whether the data packet matches the preset protocol feature library, that is, judging in real time whether the data packet conforms to the standard protocol, the data packets that do not conform to the protocol are quickly removed, and the type of network attack is further quickly determined based on the payload content of the data packet and the rule library, so as to block it in time and improve the security of the vehicle network.

[0083] Figure 2 A flow chart of a method for detecting an in-vehicle network intrusion signal provided by another embodiment of the present application is shown in FIG. Figure 2 As shown, the application protocol of the network data packet is parsed layer by layer to obtain the parsing results, including:

[0084] S20: extracting the bytes to be analyzed at the network layer in the network data packet based on the network communication protocol rules;

[0085] In an optional embodiment, the application protocol includes a network layer, a transport layer and an application layer. Therefore, when the application protocol of a network data packet is parsed layer by layer, the network layer, the transport layer and the application layer need to be parsed layer by layer in turn.

[0086] It is understandable that there is a certain relationship between different application protocol layers, and the network communication protocol is highly ordered. That is to say, the network communication protocol is not a randomly changing byte stream, but is highly ordered. The structure in the data packet is completely knowable and closely related to a series of protocol rules.

[0087] Therefore, in a specific embodiment, in order to improve the efficiency of network data packet detection, it is not necessary to analyze and compare the bytes of the network data packet one by one, but to directly find the position of the byte to be analyzed, and take out the byte to be analyzed for analysis.

[0088] Specifically, based on the network communication protocol rules, the bytes to be analyzed in the network layer of the network data packet are first extracted. For ease of understanding, a detailed description will be given below with reference to specific examples.

[0089] For example, the network request sent by the attacker is: http: / / ip address or domain name / ..%C1%9C.. / winnt / system32 / cmd.exe, and the network data packet content generated by the request is expressed in hexadecimal to obtain the following result:

[0090] 00A0 C9 8F FF C1 00 00E8 6F AD 59 08 00 45 00

[0091] 01 90 85 00 40 00 80 06E3 4E C8 00C8 00 00 45

[0092] 00 50 04 0B 00 50 00 15 33FB 6F CC C1 00 45 00

[0093] 22 38 28D1 00 00 47 45 54 20 2F 2E 2E 25 68 31

[0094] 65 6D 33 32 2F 63 6D 64 2E 65 78 65 20 48 54 54

[0095] According to the Ethernet protocol rules, the two bytes starting at the 13th byte are the second layer protocol type flag of the TCP / IP protocol family. From the above hexadecimal result, we can see that the value of the two bytes starting at the 13th byte of the first line is "0800", that is, the byte to be analyzed at the network layer is "0800", so we can know that the protocol carried in the Ethernet frame data area is the IP protocol.

[0096] S21: extracting the bytes to be analyzed at the transport layer in the network data packet according to the bytes to be analyzed at the network layer;

[0097] S22: extracting the bytes to be analyzed at the application layer in the network data packet according to the bytes to be analyzed at the transport layer;

[0098] S23: Parse the bytes to be analyzed in the application layer to obtain a parsing result; the parsing result also includes the destination port number of the network data packet and the application layer header information.

[0099] Further, the bytes to be analyzed of the transport layer in the network data packet are extracted according to the bytes to be analyzed of the network layer, that is, the bytes to be analyzed of the transport layer can be located based on the parsing results of the bytes to be analyzed of the network layer.

[0100] For example, in the above example, according to the IP protocol structure, the byte at the 24th byte is the protocol type flag of the transport layer. From the above hexadecimal result, we can see that the value of the 24th byte of the second line is "06", that is, the byte to be analyzed in the transport layer is "06", so we can know that the protocol carried in the data area of ​​the IP frame is the TCP protocol.

[0101] Based on the analysis result of the bytes to be analyzed of the transport layer, the bytes to be analyzed of the application layer can be located, thereby extracting the bytes to be analyzed of the application layer in the network data packet according to the bytes to be analyzed of the transport layer. Further, through step S23, the bytes to be analyzed of the application layer are analyzed to obtain the analysis result including the destination port number of the network data packet, the application layer header information and the payload content.

[0102] For example, in the above example, according to the structure of the TCP protocol, the two bytes starting at the 37th byte are the application layer protocol flag, that is, the destination port number. From the above hexadecimal result, it can be seen that the value of the two bytes starting at the 37th byte of the third line is "0050", and "0050" is converted to decimal as "80", that is, the destination port number is 80, and according to the port number 80, it can be known that the network data packet is HTTP access.

[0103] Furthermore, based on the rules of network communication protocols, the Uniform Resource Locator (URL) starts at the 55th byte of the TCP packet. Therefore, the URL can be directly read at the 55th byte of the data area and restored to: GET / ..%C1%9C.. / winnt / system32 / cmd.exe.

[0104] Figure 3 This is a schematic diagram of the principle of a network data packet detection component provided in an embodiment of the present application. In order to make those skilled in the art more aware of the technical solution provided in the embodiment of the present application, the above example and Figure 3 Further explanation will be given in combination.

[0105] like Figure 3As shown, the layer-by-layer analysis of the application protocol of the network data packet can be set as a network data packet component, which can also be understood as a deep packet inspection component. In a specific embodiment, the network data packet is analyzed layer by layer through the component.

[0106] For example, in the above example, after locating, extracting and analyzing the bytes to be analyzed at the network layer, the IP header is determined, thereby determining the source IP address and the destination IP address. Further, based on the bytes to be analyzed at the network layer, the bytes to be analyzed at the transport layer are extracted, and the TCP header is determined after parsing the bytes to be analyzed at the network layer, thereby determining the source port and the destination port.

[0107] Furthermore, based on the bytes to be analyzed at the transport layer, the bytes to be analyzed at the application layer in the network data packet are extracted, and the bytes to be analyzed at the application layer are parsed to determine the application layer HTTP header information and HTTP payload content, thereby determining information such as the visited URL, UserAgent, and status code, as well as the specific elements and content of the web page.

[0108] Therefore, the detection method of the vehicle network intrusion signal provided by the embodiment of the present application parses the application protocol of the network data packet layer by layer based on the network communication protocol rules, without analyzing the bytes one by one, and directly locates the position of the bytes to be analyzed, thereby improving the detection speed and efficiency. In addition, by deeply analyzing the network data packets, potential security threats can be discovered and intercepted in time, thereby improving the security of the vehicle network.

[0109] In an optional embodiment, removing the protocol attribute information in the network data packet that does not match the preset protocol feature library includes:

[0110] Preprocess the network data packets to obtain the data packets to be matched;

[0111] The application layer header information and payload content of the data packet to be matched are matched with the preset protocol feature library to eliminate the data packets whose protocol attribute information does not match the preset protocol feature library.

[0112] On the basis of the above embodiments, after determining the application layer header information and payload content of the data packet, it is possible to determine whether the data packet conforms to the standard protocol based on the preset protocol feature library. However, in a specific embodiment, in order to improve the efficiency of data packet detection, in an optional embodiment, when the protocol attribute information in the network data packet does not match the preset protocol feature library and is eliminated, the network data packet is first preprocessed to obtain a data packet to be matched, wherein the preprocessing may include but is not limited to filtering and stream reassembling the network data packet.

[0113] Furthermore, the application layer header information and payload content of the data packet to be matched obtained after preprocessing are matched with a preset protocol feature library, so as to eliminate the data packet whose protocol attribute information does not match the preset protocol feature library.

[0114] It can be understood that the preset protocol feature library stores the attribute information corresponding to the protocol types that the user is interested in or concerned about. Therefore, when matching the data packet to be matched with the preset protocol feature library, the data packets that do not conform to the standard protocol and are not of interest or concern to the user can be eliminated, thereby improving the accuracy of abnormal signal interception and the detection efficiency.

[0115] Based on the above embodiment, as an optional embodiment, preprocessing the network data packet to obtain the data packet to be matched includes:

[0116] After reassembling the network data packet, a reassembled data packet is obtained;

[0117] After filtering out the data packets whose destination port numbers do not belong to the preset port library in the reassembled data packets, the data packets to be matched are obtained.

[0118] In an optional embodiment, in order to cope with the reliance of the load characteristics on the integrity of the data packets and to prevent the problems of disorder, retransmission and fragmentation that may occur during the transmission process, the technical solution provided in the embodiment of the present application introduces a stream reassembly technology. Before matching with the preset protocol feature library, the network data packets are first stream reassembled, that is, the data packets are sorted and reassembled, and duplicate data packets are excluded, thereby ensuring that each piece of data is complete.

[0119] It is understandable that during the data packet transmission process, stream reassembly technology can sub-packetize overly long data packets. During deep packet inspection, stream reassembly technology is used to reassemble the data packets and then detect the complete data packets, which can solve the problems of disordered, repeated, and incomplete received data packets.

[0120] After the stream is reassembled to obtain the reassembled data packet, based on the above embodiment, the data packet whose destination port number does not belong to the preset port library in the reassembled data packet is filtered out to obtain the data packet to be matched. It can be understood that the preset port library stores the port number based on the user's needs, that is, the port number that the user is concerned about, and thus, the data packet that the user is not concerned about can be eliminated based on the preset port number, that is, the preliminary filtering of the network data packet is performed, thereby improving the detection efficiency.

[0121] Therefore, the vehicle network intrusion signal detection method provided in the embodiment of the present application is based on process group technology and uses a preset port library to perform preliminary filtering on data packets, thereby improving the accuracy of protocol recognition based on load characteristics and improving detection efficiency.

[0122] Figure 4 A schematic diagram of a preset protocol feature library provided in an embodiment of the present application, in an optional embodiment, such as Figure 4 As shown, the preset protocol feature library includes multiple preset protocol feature libraries, each preset protocol feature library stores attribute information of different protocols, and each preset protocol feature library is set with a different handle.

[0123] Table 2 is a schematic table of protocol attribute information provided in an embodiment of the present application. It can be understood that different protocols have different attribute characteristics. As shown in Table 2, different protocols correspond to different standard attribute information.

[0124] Table 2 Protocol attribute information

[0125]

[0126]

[0127]

[0128] In an optional embodiment, different protocol feature libraries may be set for different protocols, for example, Figure 4 As shown, the multiple preset protocol feature libraries may include but are not limited to HTTP protocol feature library, TLS protocol feature library, DNS protocol feature library, MQTT protocol feature library, DoIP protocol feature library, SOME / IP protocol feature library and GB / T 32960.3 protocol feature library.

[0129] It should be noted that the present application does not limit the number and type of preset protocol feature libraries, and the preset protocol feature libraries can be configured, modified, deleted and expanded according to different application scenarios and user needs.

[0130] Combination Figure 4 As can be seen from Table 2, different protocol feature libraries store attribute information corresponding to different protocols. In a specific embodiment, it can be determined whether a network data packet complies with a standard protocol based on a pre-established protocol feature library.

[0131] In an optional embodiment, in order to further improve the detection efficiency, different handles can be set for different preset protocol feature libraries, wherein the handle refers to the identification and operation of specific objects or items by the handle in program design. In other words, the protocol feature library that needs to be matched can be quickly locked by calling the handle.

[0132] Based on the above embodiment, as an optional embodiment, matching the application layer header information and payload content of the data packet to be matched with a preset protocol feature library includes:

[0133] Determine the protocol type of the data packet to be matched according to the application layer header information of the data packet to be matched;

[0134] By calling the handle corresponding to the protocol type, the target preset protocol feature library is retrieved;

[0135] The application layer header information and payload content of the data packet to be matched are matched with the target preset protocol feature library.

[0136] On the basis of the above embodiment, after determining the application layer header information of the data packet to be matched, the protocol type of the data packet to be matched can be determined based on the application layer header information. Furthermore, based on the handle pre-set for each protocol feature library, the handle corresponding to the protocol type is called to quickly determine the target preset protocol feature library of the data packet to be matched.

[0137] Furthermore, the application layer header information and the payload content of the data packet to be matched are matched with the target preset protocol feature library, so as to determine whether the data packet to be matched conforms to the standard protocol.

[0138] Therefore, the method for detecting in-vehicle network intrusion signals provided in the embodiment of the present application sets different handles for different preset protocol feature libraries so as to quickly determine the feature library corresponding to the protocol type of the data packet to be matched according to the handle, thereby improving the accuracy and efficiency of data packet identification.

[0139] In an optional embodiment, after determining whether an intrusion event occurs in the vehicle network, the method further includes:

[0140] If an intrusion event occurs in the vehicle network, determine whether the intrusion data packet in which the intrusion event occurred in the target data packet belongs to the whitelist based on the analysis result;

[0141] If so, the intrusion data packet is determined to be legitimate;

[0142] If not, determine the threat level of the intrusion event and perform corresponding alarm processing according to the threat level.

[0143] After the network data packet detection of the above embodiment, it can be determined whether an intrusion event occurs in the vehicle network. When an intrusion event occurs in the vehicle network, in order to build a comprehensive network security protection system, in an optional embodiment, it is determined based on the analysis results whether the intrusion data packet in which the intrusion event occurs in the target data packet belongs to the whitelist.

[0144] Among them, the whitelist includes the IP or port occupied by normal applications in the device. It can be understood that when an intrusion data packet belongs to the whitelist, it can be determined that the intrusion data packet is actually a legitimate data packet. At this time, the data packet belonging to the whitelist will not be intercepted and processed.

[0145] Of course, if there are data packets that do not belong to the whitelist, that is, for data packets that do not match the whitelist, they need to be intercepted immediately and further analyzed for their threat. Specifically, the threat level of the intrusion event is determined, and corresponding alarm processing is performed according to the threat level.

[0146] In an optional embodiment, for intrusion events that do not match the whitelist, a blocking strategy can also be automatically generated and sent to the firewall through a specific code. After receiving the blocking strategy, the firewall immediately executes corresponding blocking measures to prevent subsequent attack traffic from entering the network.

[0147] Therefore, the in-vehicle network intrusion signal detection method provided by the embodiment of the present application generally sets a whitelist and matches the intrusion data packet of the intrusion event with the whitelist first, which can quickly and accurately pass some legal data packets and improve the detection efficiency. Furthermore, threat analysis is performed on data packets that do not belong to the whitelist to effectively intercept abnormal data packets.

[0148] On the basis of the above embodiment, when the intrusion data packet of the intrusion event does not belong to the whitelist, it is necessary to determine the threat level of the intrusion event and perform corresponding alarm processing according to the threat level. As an optional embodiment, performing corresponding alarm processing according to the threat level includes:

[0149] If the threat level is low, the intrusion event will be reported to the management platform so that the management platform can determine whether to block the intrusion data packet;

[0150] In a specific embodiment, the threat level of the intrusion event can be judged according to threat influencing factors such as the characteristics of the target data packet and the impact range, and different alarm processing methods are set for different threat levels. Specifically, when the threat level is a low threat level, that is, the threat level is low and the threat coefficient to vehicle safety is low, the intrusion event can be reported to the management platform, and the staff of the management platform will review and determine whether to issue an instruction to intercept the intrusion data packet.

[0151] In another optional embodiment, if the threat level is higher than the low threat level, the following steps are performed:

[0152] Associating intrusion events of the same attack type within a preset period to obtain a first alarm set;

[0153] Aggregating the first alarm set with the same source address to obtain a second alarm set;

[0154] Determine, according to the historical alarm decision database, a target processing decision corresponding to the second alarm set;

[0155] The intrusion event corresponding to the second alarm set is processed through the target processing decision.

[0156] In a specific embodiment, when the threat level is higher than the low threat level, it is determined that the current intrusion event has a high impact on vehicle safety. In order to ensure vehicle network security, the intrusion event is immediately intercepted and associated processing is performed on the intrusion event.

[0157] Specifically, the intrusion events of the same attack type within a preset period are associated to obtain the first alarm set. In a specific embodiment, through association analysis, multiple repeated or similar intrusion events triggered by a single event can be identified, so as to merge these alarm events and reduce the number of false alarms.

[0158] At the same time, by integrating the information of multiple alarm events, potential threats that have been missed due to improper configuration or system anomalies can be identified, reducing the risk of missed reports. In addition, associating multiple related alarm events can provide richer contextual information to more accurately determine the nature and scope of the event, thereby making more appropriate response decisions.

[0159] After obtaining the first alarm set, the source address of the intrusion event is analyzed. If multiple intrusion events have the same source address, it is considered that these events may originate from the same attacker. At this time, the first alarm set with the same source address is aggregated to obtain the second alarm set.

[0160] Further, according to the historical alarm decision database, the target processing decision corresponding to the second alarm set is determined, and the intrusion event corresponding to the second alarm set is processed by the target processing decision. It can be understood that in the historical alarm decision database, processing decisions corresponding to different intrusion events are stored, and these processing decisions can be maintained and stored in advance, or can be processing decisions determined based on real-time data packet analysis. Of course, in a specific embodiment, the historical alarm decision database can be updated and maintained according to real-time intrusion events.

[0161] In an optional embodiment, if there is no processing decision corresponding to the intrusion event in the historical alarm decision database, the information corresponding to the intrusion event is uploaded to the management platform, and the management personnel further determine whether to intercept it.

[0162] It should be noted that in some optional embodiments, the threat level can be divided into low threat level, medium threat level and high threat level, and is divided according to data packet characteristics and impact range. In fact, the embodiments of the present application do not limit the threat level classification and classification rules of intrusion events.

[0163] In an optional embodiment, the vehicle network intrusion signal detection method provided by the present application is provided with a log management component, which can record all behaviors generated by the deep packet inspection component, including policy application, traffic identification, control operations, etc. Operation and maintenance personnel can adjust system configuration and optimize policy application based on log information. In addition, network security and compliance checks can be performed by analyzing logs to provide data support for security audits.

[0164] In an optional embodiment, after an intrusion event is determined, the information of the intrusion event is promptly recorded and stored in real time, and the intrusion event can also be sent to a display screen for display so that maintenance personnel can view it in time.

[0165] In an optional embodiment, in order to further improve the detection efficiency, the application protocol of the network data packet is parsed layer by layer, including:

[0166] Call multiple threads to perform layer-by-layer analysis of application protocols for different network data packets.

[0167] It is understandable that vehicles generate massive amounts of data every day. Therefore, in order to improve detection accuracy, multiple threads can be called to perform layer-by-layer analysis of the application protocols on different data packets. Of course, after different threads perform application protocol analysis on the data packets, security analysis can also be performed on the data packets based on different threads, that is, different data packets can be detected to determine whether an intrusion incident has occurred in the vehicle.

[0168] It should be noted that this application does not limit the number of multi-threads and the number of data packets processed by different threads.

[0169] In an optional embodiment, the method for detecting an in-vehicle network intrusion signal provided by the present application further includes:

[0170] Collect statistics on traffic usage information corresponding to the target data packet;

[0171] storing traffic usage information in a traffic database;

[0172] Allocate traffic resources to each target data packet based on the traffic database.

[0173] In a specific embodiment, statistics are collected on the traffic usage information of the target data packet, wherein the traffic usage information includes traffic identification, control, statistics, etc. Furthermore, the traffic usage information is stored in a traffic database. In real time, it can be understood that the traffic database is responsible for storing various strategies used in the deep packet inspection component.

[0174] When the deep packet inspection component needs to process network traffic, the policy cache module can quickly retrieve the corresponding policy, that is, it can allocate traffic resources to each target data packet based on the traffic database.

[0175] In an optional embodiment, when business demands in the network environment change, the traffic database can load new policies into the cache in a timely manner. That is, when the traffic usage information of the target data packet changes, the traffic database can be updated and adjusted in a timely manner so as to adaptively adjust the traffic control policy according to the network environment and application characteristics to achieve optimal allocation of network resources.

[0176] Figure 5 A flow chart of a method for detecting an in-vehicle network intrusion signal provided by another embodiment of the present application is provided. In order to make the technical solution of the present application more clear to those skilled in the art, the following will be combined with Figure 5 Further explanation.

[0177] like Figure 5 As shown, in an optional embodiment, the vehicle network intrusion signal detection method provided by the present application is implemented by a system including a data packet capture tool 50, an application protocol parsing unit 51, a feature matching unit 52 and a processing unit 53. In a specific embodiment, the vehicle network intrusion signal detection method includes the following steps:

[0178] S1: Send network data packets;

[0179] S2: parse the network data packets layer by layer according to the application protocol;

[0180] In a specific embodiment, the data packet capture tool 50 may be a Libcap message high-speed capture tool, which captures network data packets transmitted in the vehicle network and transmits the captured network data packets to the application protocol parsing unit 51 .

[0181] Further, the application protocol parsing unit 51 parses the application protocol of the network data packet layer by layer to obtain a parsing result; wherein the parsing result includes the payload content of the application layer of the network data packet. For the specific layer-by-layer parsing method, please refer to the description of the above embodiment. It is worth noting that when performing the application protocol, multiple threads are called to parse different data packets.

[0182] S3: Send the parsing result;

[0183] S4: Matching with the preset protocol feature library;

[0184] S5: Send the target data packet;

[0185] After the application protocol parsing unit 51 is parsed, the parsing result is sent to the feature matching unit 52, and the feature matching unit 52 removes the data packets whose protocol attribute information in the network data packets does not match the preset protocol feature library according to the parsing result, and obtains the target data packet. Further, the feature matching unit 52 transmits the target data packet to the processing unit 53.

[0186] S6: Determine the intrusion event and handle the intrusion event.

[0187] In a specific embodiment, the processing unit 53 uses a pre-established rule base including intrusion event characteristics to detect the payload content of the target data packet to determine whether an intrusion event occurs in the vehicle network, and processes the intrusion event.

[0188] Specifically, if an intrusion event occurs in the vehicle network, determine whether the intrusion data packet in the target data packet where the intrusion event occurs belongs to the whitelist according to the analysis result; if so, determine that the intrusion data packet is legal; if not, determine the threat level of the intrusion event, and perform corresponding alarm processing according to the threat level. For the specific intrusion event judgment method and alarm processing method, please refer to the description of the above embodiment.

[0189] In the above embodiments, the method for detecting an in-vehicle network intrusion signal is described in detail. The present application also provides an embodiment corresponding to a device for detecting an in-vehicle network intrusion signal.

[0190] Figure 6 A schematic diagram of a vehicle network intrusion signal detection device provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the device comprises:

[0191] A capture module 60, used to capture network data packets transmitted in the vehicle network;

[0192] The parsing module 61 is used to parse the application protocol of the network data packet layer by layer to obtain a parsing result; wherein the parsing result includes the payload content of the application layer of the network data packet;

[0193] The elimination module 62 is used to eliminate the data packets whose protocol attribute information in the network data packets does not match the preset protocol feature library according to the analysis result, and obtain the target data packets;

[0194] The detection module 63 is used to detect the payload content of the target data packet using a pre-established rule base including intrusion event characteristics to determine whether an intrusion event occurs in the vehicle network.

[0195] In addition, the vehicle network intrusion signal detection device provided in the embodiment of the present application also includes:

[0196] A first extraction module is used to extract the bytes to be analyzed at the network layer in the network data packet based on the network communication protocol rules;

[0197] A second extraction module is used to extract the bytes to be analyzed in the transport layer of the network data packet according to the bytes to be analyzed in the network layer;

[0198] A third extraction module is used to extract the bytes to be analyzed at the application layer in the network data packet according to the bytes to be analyzed at the transport layer;

[0199] The first processing module is used to parse the bytes to be analyzed in the application layer to obtain the parsing result; the parsing result also includes the destination port number of the network data packet and the application layer header information.

[0200] A preprocessing module is used to preprocess network data packets to obtain data packets to be matched;

[0201] The first matching module is used to match the application layer header information and payload content of the data packet to be matched with the preset protocol feature library to eliminate the data packet whose protocol attribute information does not match the preset protocol feature library.

[0202] A stream reassembly module is used to reassemble the network data packets to obtain reassembled data packets;

[0203] The filtering module is used to filter out the data packets whose destination port numbers do not belong to the preset port library in the reassembled data packets, and obtain the data packets to be matched.

[0204] A determination module, used to determine the protocol type of the data packet to be matched according to the application layer header information of the data packet to be matched;

[0205] A handle calling module is used to call the handle corresponding to the protocol type to retrieve the target preset protocol feature library;

[0206] The second matching module is used to match the application layer header information and payload content of the data packet to be matched with the target preset protocol feature library.

[0207] The second processing module is used to determine whether the intrusion data packet where the intrusion event occurs in the vehicle network belongs to the whitelist based on the analysis results; if so, determine that the intrusion data packet is legal; if not, determine the threat level of the intrusion event and perform corresponding alarm processing based on the threat level.

[0208] The third processing module is used to report the intrusion event to the management platform when the threat level is a low threat level, so that the management platform can determine whether to block the intrusion data packet;

[0209] The fourth processing module is configured to execute the following steps when the threat level is higher than the low threat level:

[0210] Associating intrusion events of the same attack type within a preset period to obtain a first alarm set;

[0211] Aggregating the first alarm set with the same source address to obtain a second alarm set;

[0212] Determine, according to the historical alarm decision database, a target processing decision corresponding to the second alarm set;

[0213] The intrusion event corresponding to the second alarm set is processed through the target processing decision.

[0214] The multi-thread calling module is used to call multiple threads to perform layer-by-layer analysis of application protocols on different network data packets.

[0215] A statistics module is used to collect statistics on traffic usage information corresponding to the target data packet;

[0216] A storage module, used for storing traffic usage information in a traffic database;

[0217] The allocation module is used to allocate traffic resources to each target data packet according to the traffic database.

[0218] Figure 7 A schematic diagram of a vehicle network intrusion signal detection device provided in another embodiment of the present application is shown in FIG. Figure 7 As shown, the detection device for vehicle network intrusion signals includes: a memory 70 for storing computer programs;

[0219] The processor 71 is used to implement the steps of the vehicle network intrusion signal detection method mentioned in the above embodiment when executing the computer program.

[0220] The vehicle network intrusion signal detection device provided in this embodiment may include but is not limited to a vehicle controller, a domain controller, etc.

[0221] Among them, the processor 71 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 71 can be implemented in at least one hardware form of a digital signal processor (Digital Signal Processor, referred to as DSP), a field programmable gate array (Field-Programmable Gate Array, referred to as FPGA), and a programmable logic array (Programmable Logic Array, referred to as PLA). The processor 71 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (Central Processing Unit, referred to as CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 71 may be integrated with a graphics processing unit (Graphics Processing Unit, referred to as GPU), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 71 may also include an artificial intelligence (Artificial Intelligence, referred to as AI) processor, which is used to process computing operations related to machine learning.

[0222] The memory 70 may include one or more computer-readable storage media, which may be non-transitory. The memory 70 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 70 is at least used to store the following computer program 701, wherein, after the computer program is loaded and executed by the processor 71, it can implement the relevant steps of the method for detecting the intrusion signal of the vehicle network disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 70 may also include an operating system 702 and data 703, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 702 may include Windows, Unix, Linux, etc. Data 703 may include but is not limited to relevant data involved in the method for detecting the intrusion signal of the vehicle network.

[0223] In some embodiments, the vehicle network intrusion signal detection device may also include a display screen 72 , an input / output interface 73 , a communication interface 74 , a power supply 75 , and a communication bus 76 .

[0224] Those skilled in the art will understand that Figure 7 The structure shown in does not constitute a limitation on the detection device for vehicle network intrusion signals, and may include more or fewer components than those shown in the figure.

[0225] The vehicle network intrusion signal detection device provided in an embodiment of the present application includes a memory and a processor. When the processor executes the program stored in the memory, it can implement the vehicle network intrusion signal detection method in the above embodiment.

[0226] It should be noted that, although the operations are depicted in a specific order in the accompanying drawings, this should not be understood as requiring these operations to be performed in the specific order shown or to be performed sequentially, or requiring all illustrated operations to be performed to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system modules and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product, or packaged into multiple software products.

Claims

1. A method for detecting an intrusion signal in a vehicle network, characterized in that: The method comprises: Capture network data packets transmitted in the vehicle network; Parsing the application protocol of the network data packet layer by layer to obtain a parsing result; wherein the parsing result includes the payload content of the application layer of the network data packet; According to the analysis result, the data packets whose protocol attribute information in the network data packets does not match the preset protocol feature library are removed to obtain the target data packets; The payload content of the target data packet is detected using a pre-established rule base including intrusion event characteristics to determine whether an intrusion event occurs in the vehicle network.

2. The method for detecting an in-vehicle network intrusion signal according to claim 1, characterized in that: The application protocol of the network data packet is parsed layer by layer to obtain parsing results, including: Based on the network communication protocol rules, extract the bytes to be analyzed in the network layer of the network data packet; Extracting the bytes to be analyzed at the transport layer in the network data packet according to the bytes to be analyzed at the network layer; Extracting the bytes to be analyzed at the application layer in the network data packet according to the bytes to be analyzed at the transport layer; The bytes to be analyzed of the application layer are analyzed to obtain the analysis result; the analysis result also includes the destination port number and application layer header information of the network data packet.

3. The method for detecting an in-vehicle network intrusion signal according to claim 2, characterized in that: Eliminating the network data packets whose protocol attribute information does not match the preset protocol feature library includes: Preprocessing the network data packet to obtain a data packet to be matched; The application layer header information and payload content of the data packet to be matched are matched with the preset protocol feature library to eliminate the data packets whose protocol attribute information does not match the preset protocol feature library.

4. The method for detecting an in-vehicle network intrusion signal according to claim 3, characterized in that: Preprocessing the network data packet to obtain a data packet to be matched includes: After stream reassembling the network data packet, a reassembled data packet is obtained; After filtering out the data packets whose destination port numbers do not belong to the preset port library in the reassembled data packets, the data packets to be matched are obtained.

5. The method for detecting an in-vehicle network intrusion signal according to claim 3, characterized in that: The preset protocol feature libraries include a plurality of preset protocol feature libraries, each of which stores attribute information of a different protocol, and each of which is provided with a different handle.

6. The method for detecting an in-vehicle network intrusion signal according to claim 5, characterized in that: Matching the application layer header information and the payload content of the data packet to be matched with the preset protocol feature library includes: Determine the protocol type of the data packet to be matched according to the application layer header information of the data packet to be matched; Retrieving a target preset protocol feature library by calling the handle corresponding to the protocol type; The application layer header information and payload content of the data packet to be matched are matched with the target preset protocol feature library.

7. The method for detecting an in-vehicle network intrusion signal according to claim 1, characterized in that: After determining whether an intrusion event occurs in the vehicle network, the method further includes: If the intrusion event occurs in the vehicle network, determining whether the intrusion data packet in which the intrusion event occurs in the target data packet belongs to the whitelist according to the analysis result; If so, it is determined that the intrusion data packet is legitimate; If not, determine the threat level of the intrusion event, and perform corresponding alarm processing according to the threat level.

8. The method for detecting an in-vehicle network intrusion signal according to claim 7, characterized in that: Perform corresponding alarm processing according to the threat level, including: If the threat level is a low threat level, the intrusion event is reported to the management platform so that the management platform can determine whether to block the intrusion data packet; If the threat level is higher than the low threat level, perform the following steps: Associating the intrusion events belonging to the same attack type within a preset period to obtain a first alarm set; Aggregating the first alarm set with the same source address to obtain a second alarm set; Determining a target processing decision corresponding to the second alarm set according to a historical alarm decision database; The intrusion event corresponding to the second alarm set is processed through the target processing decision.

9. The method for detecting an in-vehicle network intrusion signal according to claim 1, characterized in that: The application protocol of the network data packet is parsed layer by layer, including: Multithreading is called to perform layer-by-layer analysis of application protocols on different network data packets.

10. The method for detecting an in-vehicle network intrusion signal according to claim 1, characterized in that: The method further comprises: Collecting statistics on traffic usage information corresponding to the target data packet; storing the traffic usage information in a traffic database; Traffic resources are allocated to each of the target data packets according to the traffic database.

11. A method and device for detecting intrusion signals in a vehicle network, characterized in that: The device comprises: A capture module, used to capture network data packets transmitted in the vehicle network; A parsing module, used to parse the application protocol of the network data packet layer by layer to obtain a parsing result; wherein the parsing result includes the payload content of the application layer of the network data packet; A removal module is used to remove the data packets whose protocol attribute information in the network data packets does not match the preset protocol feature library according to the analysis result, so as to obtain the target data packets; The detection module is used to detect the payload content of the target data packet using a pre-established rule base including intrusion event characteristics to determine whether an intrusion event occurs in the vehicle network.

12. A vehicle network intrusion signal detection device, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the program, the steps of the method for detecting intrusion signals of a vehicle network as described in any one of claims 1 to 10 are implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method for detecting intrusion signals in a vehicle network as described in any one of claims 1 to 10 are implemented.

Images