Lightweight vehicle-mounted network security defense system

Abstract

The invention belongs to the technical field of Internet of Vehicles, and discloses a lightweight vehicle-mounted network security defense system, which specifically comprises the following steps: step 1, constructing a lightweight vehicle-mounted network security defense system, and extracting rules from a rule base by a rule initialization engine to generate a rule chain table; step 2, the T-BOX traffic probe captures network traffic from T-BOX equipment of the automobile; step 3, the traffic analysis engine performs protocol analysis and related data collection on the captured traffic; and step 4, the traffic detection engine performs security detection on the captured traffic. According to the invention, security detection can be carried out on the traffic of the Internet of Vehicles.

Description

Technical Field

[0001] The present invention belongs to the technical field of vehicle networking and relates to a lightweight vehicle-mounted network security defense system. Background Art

[0002] With the rapid development of the Internet of Vehicles, its security issues are becoming increasingly prominent, and security accidents continue to emerge. Especially with the emergence of intelligent driving and assisted driving, if security issues are not resolved, it will endanger the personal safety of users. The present invention proposes a lightweight vehicle-mounted network security defense system that can perform security detection on the Internet of Vehicles traffic and ensure the security of the Internet of Vehicles. Summary of the invention

[0003] The purpose of the present invention is to provide a lightweight vehicle-mounted network security defense system, which can effectively perform security detection on vehicle network data.

[0004] The technical solution adopted by the present invention is a lightweight vehicle-mounted network security defense system, which specifically includes the following steps: Step 1: Build a lightweight vehicle-mounted network security defense system. The rule initialization engine extracts rules from the rule library to generate a rule list. Step 2: The T-BOX (Telematics BOX) traffic probe captures network traffic from the car’s T-BOX device. Step 3, the traffic analysis engine performs protocol analysis and relevant data collection on the captured traffic; Step 4: The traffic detection engine performs security detection on the captured traffic.

[0005] The present invention is also characterized in that: The specific process of step 1 is: A lightweight vehicle-mounted network security defense system, characterized in that the system includes: a T-BOX flow probe, a flow analysis engine, a rule base, a rule initialization engine, and a flow detection engine; wherein the T-BOX flow probe is responsible for capturing network flow from the T-BOX device of the car. The flow analysis engine is responsible for decoding and analyzing the flow according to the protocol; the rule base stores attack features extracted for various security issues of the Internet of Vehicles, and each attack feature includes the protocol, address, port number, and malicious feature information; the rule initialization engine extracts rules from the rule base to generate a rule chain list; the flow detection engine uses the rule chain list to perform security detection on all flows. After the system is started, since the rules will be frequently read during the detection process of the traffic detection engine in step 4, and the attack features extracted for various security issues of the Internet of Vehicles are stored in the rule base file, the reading speed is slow; in order to improve the reading speed, the present invention extracts rules from the rule base through the rule initialization engine to generate a rule list stored in the memory; in order to quickly retrieve the rules, the rule list is designed as a multi-dimensional structure, the first dimension is classified according to different protocols, including CAN (Controller Area Network), TCP (Transmission Control Protocol), IP (Internet Protocol) and other protocols, the second dimension is classified according to the source address and the destination address, the third dimension is classified according to the source address port number and the destination address port number, and the fourth dimension is the feature information of the specific Internet of Vehicles security issues recorded in each rule; the rule initialization engine reads all rules from the rule base and analyzes the protocol, address, port number and feature information in each rule, and classifies them in multiple dimensions to form a rule list stored in the memory, which is convenient for the traffic detection engine to detect.

[0006] The specific process of step 2 is: The T-BOX traffic probe captures network traffic from the mobile communication module, WIFI communication module, CAN protocol module and Bluetooth communication module of the T-BOX. The specific implementation method is: first turn on the transceivers of the mobile communication module, WIFI communication module, Bluetooth communication module and CAN protocol module, and then read the network traffic being received by the transceiver in a circular manner.

[0007] The specific process of step 3 is: The traffic analysis engine unpacks the captured continuous traffic according to the packet start markers that appear at intervals, forming independent data packets, and then performs protocol parsing and related data collection starting from the packet header protocol; the protocol parsing method is to parse multiple protocols starting from a packet header one by one; for the Ethernet protocol, the 6-byte packet sender physical address and 6-byte receiver physical address in the header and the 2-byte subsequent protocol will be analyzed; for the IP protocol, the 4-bit IP version number and 4-bit header length identifier of the IP protocol header will be parsed from the beginning, and then the 8-bit service type field and 16-bit packet length will be parsed; finally, the 3-bit flag, 8-bit lifetime and 8-bit subsequent protocol will be parsed; for the TCP protocol, first parse the 2-byte source port, 2-byte destination port, 4-byte sequence number and 4-byte confirmation number from the front; then parse the 4-byte The data offset of the binary bit, the checksum of 2 bytes and the urgent pointer of 16 binary bits; the vehicle is controlled by the CAN protocol, which consists of seven fields, including the start of frame (SoF), arbitration, control, data, cyclic redundancy check (CRC), confirmation (ACK) and end of frame (EoF); each CAN protocol data packet carries an ID to indicate the priority and type of the message; different IDs and data contents in the CAN protocol match the vehicle status; many IDs have their own cycles, which help to appear regularly in the data traffic; based on this, the present invention not only parses the CAN protocol data packet according to the fields of the CAN protocol, but also needs to collect the time and voltage in the CAN protocol data packet, and sample these data at a rate of 12Mb / s; for the L2CAP protocol in the Bluetooth module, first identify the packet header of the first 2 bytes and the code of the first byte of the data packet, and then identify the identifier of the last 1 byte, the instruction length of 2 bytes and the subsequent data.

[0008] The specific process of step 4 is: The traffic detection engine performs security detection on the captured traffic. The specific method is to compare the protocol, address, port number and load information carried in the data packet with the corresponding protocol, address, port number and feature information in the rule list one by one; if the protocols are the same, check whether the addresses are the same; if the addresses are also the same, check whether the port numbers are the same; if the port numbers are also the same, check whether the feature information is the same; when comparing whether the specific information is the same, it will start from the first character of the two parties. If the first characters are the same, continue to compare subsequent characters; if they are not the same, compare the next character. If all the information is successfully compared, it means that the data packet may carry a threat; at this time, the system will intercept the threatening data packet and alarm the on-board communication system; after the detection is completed, the traffic detection engine will clear the data packet in the memory to make memory space for subsequent data packets.

[0009] The beneficial effect of the present invention is that the present invention can perform security detection on the traffic of the Internet of Vehicles to ensure the security of the Internet of Vehicles. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a work flow chart of a lightweight vehicle-mounted network security defense system of the present invention.

[0011] Figure 2 It is the number of detections of various attack features in the CAR-HACKING public dataset in Example 1 of the present invention. DETAILED DESCRIPTION

[0012] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0013] Based on a lightweight vehicle-mounted network security defense system, the system is characterized by comprising the following steps: Step 1: Build a lightweight vehicle-mounted network security defense system. The rule initialization engine extracts rules from the rule library to generate a rule list. Step 2: The T-BOX (Telematics BOX) traffic probe captures network traffic from the car’s T-BOX device. Step 3, the traffic analysis engine performs protocol analysis and relevant data collection on the captured traffic; Step 4: The traffic detection engine performs security detection on the captured traffic.

[0014] The specific process of step 1 is: A lightweight vehicle-mounted network security defense system, characterized in that the system includes: a T-BOX traffic probe, a traffic analysis engine, a rule base, a rule initialization engine, and a traffic detection engine; wherein the T-BOX traffic probe is responsible for capturing network traffic from the T-BOX device of the car. The traffic analysis engine is responsible for decoding and analyzing the traffic according to the protocol; the rule base stores attack features extracted for various security issues of the Internet of Vehicles; the rule initialization engine is responsible for extracting rules from the rule base to generate a rule list; the traffic detection engine uses the rule list to perform security detection on all traffic. After the system is started, since the rules will be read frequently during the detection process of the traffic detection engine in step 4, and the attack features extracted for various security issues of the Internet of Vehicles are stored in the rule base file, the reading speed is slow; in order to improve the reading speed, the rule initialization engine extracts rules from the rule base to generate a rule list stored in the memory; in order to quickly retrieve the rules, the rule list is designed as a multi-dimensional structure, the first dimension is classified according to different protocols, including CAN (Controller Area Network), TCP, IP and Bluetooth protocols, the second dimension is classified according to the source address and destination address, the third dimension is classified according to the source address port number and the destination address port number, and the fourth dimension is the feature information of the specific Internet of Vehicles security issues recorded in each rule; the rule initialization engine reads all rules from the rule base and analyzes the protocol, address, port number and feature information in each rule, and classifies them in multiple dimensions to form a rule list stored in the memory, which is convenient for the traffic detection engine to detect.

[0015] The specific process of step 2 is: The T-BOX traffic probe captures network traffic from the mobile communication module, WIFI communication module, GNSS (Global Navigation Satellite System) communication module, CAN protocol module and Bluetooth communication module of the T-BOX. The specific implementation method is: first open the mobile communication module, WIFI communication module and CAN protocol module, and then read the current network data packet and subsequent data packets in a loop.

[0016] The specific process of step 3 is: The traffic analysis engine unpacks the captured continuous traffic according to the packet start markers that appear at intervals, forming independent data packets, and then performs protocol parsing and related data collection starting from the packet header protocol; the protocol parsing method is to parse multiple protocols starting from a packet header one by one; for the Ethernet protocol, the 6-byte packet sender physical address and 6-byte receiver physical address in the header and the 2-byte subsequent protocol will be analyzed; for the IP protocol, the 4-bit IP version number and 4-bit header length identifier of the IP protocol header will be parsed from the beginning, followed by the 8-bit service type field and the 16-bit packet length; finally, the 3-bit flag, 8-bit lifetime and 8-bit subsequent protocol will be parsed; for the TCP protocol, first parse the 2-byte IP version number from the front. The source port, the destination port of 2 bytes, the sequence number of 4 bytes and the confirmation number of 4 bytes are then parsed. The data offset of 4 binary bits, the checksum of 2 bytes and the urgent pointer of 16 binary bits are then parsed. The vehicle is controlled by the CAN protocol, which consists of seven fields, including the start of frame (SoF), arbitration, control, data, cyclic redundancy check (CRC), confirmation (ACK) and end of frame (EoF). Each CAN protocol data packet carries an ID to indicate the priority and type of the message. Different IDs and data contents in the CAN protocol match the vehicle status. Many IDs have their own cycles, which help to appear regularly in the data traffic. Based on this, the present invention not only parses the CAN protocol data packet according to the fields of the CAN protocol, but also needs to collect the time and voltage in the CAN protocol data packet and sample these data at a rate of 12Mb / s.

[0017] The specific process of step 4 is: The traffic detection engine performs security detection on the captured traffic by comparing the protocol, address, port number and load information carried in the data packet with the corresponding protocol, address, port number and feature information in the rule list one by one; if the protocols are the same, check whether the addresses are the same; if the addresses are the same, check whether the port numbers are the same; if the port numbers are the same, check whether the feature information is the same; when comparing whether the specific information is the same, it will start from the first character of the two parties. If the first characters are the same, continue to compare subsequent characters; if they are different, compare the next character. If all the information is successfully compared, it means that the data packet may carry a threat; at this time, the system will intercept the threatening data packet and alarm the on-board communication system.

[0018] Example 1 This paper uses the CAR-HACKING public dataset produced by the HCRL laboratory of Korea University to test the system. The dataset is constructed from a real vehicle environment. The dataset contains 4 types of attacks, namely, Spoofing the RPM gauze (SRPMG), Spoofing the drive gear (SDG), Denial of Service (DOS), Fuzzy and 1 normal behavior. The total number of features for each attack type is detailed in Figure 2 The total number column. After testing, Figure 2 In the column of detection number, we can see the number of detections of various attack features by the vehicle network security defense system established by the present invention. After calculation, the detection rate is above 96.8%, which proves the effectiveness of the present invention.

Claims

1. Based on a lightweight vehicle-mounted network security defense system, the characteristics are: The specific steps include: Step 1: Build a lightweight vehicle-mounted network security defense system. The rule initialization engine extracts rules from the rule library to generate a rule list. Step 2, the T-BOX traffic probe captures network traffic from the car's T-BOX device; Step 3, the traffic analysis engine performs protocol analysis and relevant data collection on the captured traffic; Step 4: The traffic detection engine performs security detection on the captured traffic.

2. The lightweight vehicle-mounted network security defense system according to claim 1 is characterized in that: The specific process of step 1 is as follows: A lightweight vehicle-mounted network security defense system, characterized in that the system includes: a T-BOX (TelematicsBOX, remote communication box) flow probe, a flow analysis engine, a rule base, a rule initialization engine, and a flow detection engine; wherein the T-BOX flow probe is responsible for capturing network flow from the T-BOX device of the car; the flow analysis engine is responsible for decoding and analyzing the flow according to the protocol; the rule base stores attack features extracted for various security issues of the Internet of Vehicles, and each attack feature includes the protocol, address, port number and malicious feature information; the rule initialization engine extracts rules from the rule base to generate a rule chain list; the flow detection engine uses the rule chain list to perform security detection on all flows. After the system is started, since the rules will be frequently read during the detection process of the traffic detection engine in step 4, and the attack features extracted for various security issues of the Internet of Vehicles are stored in the rule base file, the reading speed is slow; in order to improve the reading speed, the rule initialization engine extracts rules from the rule base to generate a rule list stored in the memory; in order to quickly retrieve the rules, the rule list is designed as a multi-dimensional structure, the first dimension is classified according to different protocols, including CAN (Controller Area Network), TCP (Transmission Control Protocol), IP (Internet Protocol), MQTT protocol, the second dimension is classified according to the source address and destination address, the third dimension is classified according to the source address port number and the destination address port number, and the fourth dimension is the feature information of the specific Internet of Vehicles security issues recorded in each rule; the rule initialization engine reads all rules from the rule base and analyzes the protocol, address, port number and feature information in each rule, and classifies them in multiple dimensions to form a rule list stored in the memory, which is convenient for the traffic detection engine to detect.

3. The lightweight vehicle-mounted network security defense system according to claim 2 is characterized in that: The specific process of step 2 is: The T-BOX traffic probe captures network traffic from the mobile communication module, WIFI communication module, CAN (Controller Area Network) protocol module and Bluetooth communication module of the T-BOX. The specific implementation method is: first turn on the transceivers of the mobile communication module, WIFI communication module, Bluetooth communication module and CAN protocol module, and then read the network traffic being received by the transceiver in a circular manner.

4. The lightweight vehicle-mounted network security defense system according to claim 3 is characterized in that: The specific process of step 3 is as follows: The traffic analysis engine unpacks the captured continuous traffic according to the packet start markers that appear at intervals, forming independent packets, and then performs protocol analysis and related data collection starting from the packet header protocol; The protocol parsing method is to parse multiple protocols starting from a data packet header one by one; for the Ethernet protocol, the 6-byte data packet sender physical address and the 6-byte receiver physical address and the 2-byte subsequent protocol will be analyzed in the header; for the IP protocol, the 4-bit IP version number and the 4-bit header length identifier of the IP protocol header will be parsed from the beginning, and then the 8-bit service type field and the 16-bit data packet length will be parsed; finally, the 3-bit flag, the 8-bit lifetime and the 8-bit subsequent protocol will be parsed; for the TCP protocol, first parse the 2-byte source port, the 2-byte destination port, the 4-byte sequence number and the 4-byte confirmation number from the front; then parse the 4-bit data offset, the 2-byte checksum and the 16-bit urgent pointer; The vehicle is controlled by the CAN protocol, which consists of seven fields, including Start of Frame (SoF), Arbitration, Control, Data, Cyclic Redundancy Check (CRC), Acknowledgement (ACK), and End of Frame (EoF). Each CAN protocol packet carries an ID indicating the priority and type of the message. Different IDs and data contents in the CAN protocol match the vehicle status. Many IDs have their own cycles, which help to appear regularly in the data traffic. Based on this, the system not only parses the CAN protocol packets according to the fields of the CAN protocol, but also needs to collect the time and voltage in the CAN protocol packets and sample these data at a rate of 12Mb / s. For the L2CAP protocol in the Bluetooth module, first identify the 2-byte packet header and 1-byte code in front of the data packet header, and then identify the 1-byte identifier, 2-byte instruction length and subsequent data behind it.

5. The lightweight vehicle-mounted network security defense system according to claim 4 is characterized in that: The specific process of step 4 is as follows: The traffic detection engine performs security detection on the captured traffic. The specific method is to compare the protocol, address, port number and load information carried in the data packet with the corresponding protocol, address, port number and feature information in the rule list one by one; if the protocols are the same, check whether the addresses are the same; if the addresses are also the same, check whether the port numbers are the same; if the port numbers are also the same, check whether the feature information is the same; when comparing whether the specific information is the same, it will start from the first character of the two parties. If the first characters are the same, continue to compare subsequent characters; if they are not the same, compare the next character. If all the information is successfully compared, it means that the data packet may carry a threat; at this time, the system will intercept the threatening data packet and alarm the on-board communication system; after the detection is completed, the traffic detection engine will clear the data packet in the memory to make memory space for subsequent data packets.

Images