Automatic configuration method and device of intrusion detection rule and controller

Abstract

The embodiment of the invention relates to the technical field of data security, and discloses an automatic configuration method and device for an intrusion detection rule and a controller, and the method comprises the steps that the controller can detect the computing power condition of a vehicle end in real time; the controller can flexibly adjust the use state of the intrusion detection rule in the vehicle according to the real-time computing power of the vehicle end. By applying the technical scheme of the invention, the dynamic loading of the computing power and the actual demand can be ensured under the condition that the core function is not influenced in the process of performing security detection on the data by the controller, and the effective optimization and utilization of resources in the controller are realized.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data security technology, and in particular to an automatic configuration method, device and controller for intrusion detection rules. Background Art

[0002] At present, the vehicle-mounted intrusion detection and prevention system can perform security detection on the data sent from the cloud based on the intrusion detection rules synchronized with the cloud, thereby improving the data security on the vehicle side. However, the intrusion detection rules on the vehicle side have the problem of low execution efficiency. Summary of the invention

[0003] In view of the above problems, an embodiment of the present invention provides an automatic configuration method, device and controller for intrusion detection rules, which are used to solve the problem of low execution efficiency of intrusion detection rules on the vehicle side in the prior art.

[0004] According to one aspect of an embodiment of the present invention, there is provided a method for automatically configuring intrusion detection rules, the method comprising:

[0005] Obtain the vehicle’s computing power in real time;

[0006] According to the computing power of the vehicle, the usage status of the intrusion detection rules in the vehicle is adjusted; wherein the intrusion detection rules are used to perform security detection on data.

[0007] According to another aspect of an embodiment of the present invention, there is provided an automatic configuration device for intrusion detection rules, comprising:

[0008] Acquisition module, used to obtain the computing power of the vehicle in real time;

[0009] A configuration module is used to adjust the usage status of intrusion detection rules in the vehicle according to the computing power of the vehicle; wherein the intrusion detection rules are used to perform security detection on data.

[0010] According to another aspect of an embodiment of the present invention, there is provided a controller comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, wherein the executable instruction enables the processor to execute the operation of the automatic configuration method of intrusion detection rules.

[0011] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables a controller to execute the operation of the automatic configuration method of intrusion detection rules.

[0012] After acquiring the computing power of the vehicle, the embodiment of the present invention flexibly adjusts the use status of the intrusion detection rules in the vehicle according to the real-time computing power of the vehicle, thereby ensuring the dynamic loading of the computing power and actual needs of the controller without affecting the core functions of the controller in the process of data security detection, thereby realizing effective optimization and utilization of resources in the controller.

[0013] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings are only used to illustrate the embodiments and are not to be considered as limiting the present invention. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings. In the accompanying drawings:

[0015] Figure 1 A flow chart showing a first embodiment of the method for automatically configuring intrusion detection rules provided by the present invention;

[0016] Figure 2 A flow chart showing another embodiment of the method for automatically configuring intrusion detection rules provided by the present invention;

[0017] Figure 3 A schematic diagram showing the structure of an embodiment of an automatic configuration device for intrusion detection rules provided by the present invention;

[0018] Figure 4 A schematic structural diagram of an embodiment of a controller provided by the present invention is shown. DETAILED DESCRIPTION

[0019] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0020] At present, an on-board intrusion detection and prevention system (IDPS) can be set up on the vehicle side. The IDPS can be used to implement data security detection on the vehicle side to avoid the potential risks that may be brought by the data sent from the cloud during the vehicle-cloud interaction. The vehicle side can obtain intrusion detection rules from the cloud and implement data security detection based on the intrusion detection rules. However, this method relies on the intrusion detection rules sent from the cloud, and there is a situation where the coupling with the cloud is too high. In addition, in actual use, the computing power resources on the vehicle side are limited, and the computing power used by vehicles in different scenarios is not the same, and the use of computing power for different vehicles is also different. Therefore, when the fixed loaded intrusion detection rules are executed in different scenarios or on different vehicles, there may be problems such as insufficient computing power that cannot be executed, or reduced execution efficiency. These situations will not only cause abnormalities in the vehicle's network security protection capabilities, but may even cause abnormalities in the operation of the vehicle.

[0021] Therefore, in order to solve the above problems, the present application proposes an automatic configuration method for intrusion detection rules. The present application is completely implemented on the vehicle side and applied to the controller on the vehicle side, aiming to provide an efficient, safe and flexible intrusion detection rule loading and configuration mechanism, avoid potential risks arising in the process of vehicle-cloud interaction, and improve the availability and efficiency of the vehicle-mounted intrusion detection and prevention system. In the present application, the controller can divide the intrusion detection rules into main detection rules and slave detection rules. The controller can selectively load the slave detection rules on the basis of loading the main detection rules, so as to dynamically allocate and save computing power on the basis of ensuring the effectiveness of data security detection. Specifically, when the computing power is sufficient, the controller can control more slave detection rules to run; and when the computing power is insufficient, the controller can shut down some slave detection rules. In addition, the controller can also meet the computing power requirements of the controller by dynamically adjusting the configuration parameters of the intrusion detection rules.

[0022] Based on the dynamic adjustment process on the vehicle side, in this application, the intrusion detection rules issued from the cloud only need to update the primary and secondary strategy sets. The vehicle side can make real-time decisions based on the actual computing power and situation of each vehicle according to the primary and secondary strategy sets, thereby improving the adaptability to the actual conditions of different vehicles. The primary and secondary strategy sets may include at least one main detection rule and at least one secondary detection rule. The primary and secondary strategy sets may include security checks that need to be performed during the secondary communication process. For example, the primary and secondary strategy sets may include two main detection rules for detecting the integrity and unauthorized modification of key system files, and monitoring the communication of the vehicle core control unit for abnormal instructions, as well as two secondary detection rules for detecting whether a specific type of network data packet meets security standards and HIDs monitoring of some configuration files.

[0023] Figure 1FIG. 1 is a flow chart showing a first embodiment of the method for automatically configuring intrusion detection rules provided by the present invention, the method being executed by a controller. Figure 1 As shown, the method comprises the following steps:

[0024] Step 110: Obtain the computing power of the vehicle in real time.

[0025] Among them, the controller can detect the computing power of the vehicle in real time. The computing power is used to indicate the computing power currently used by the vehicle. Optionally, the computing power may include CPU usage, memory occupancy, etc. Optionally, the present application can obtain the computing power through hardware sensors or system performance detection tools on the vehicle. Since the present application is mainly used in situations where the computing power on the vehicle is limited. Therefore, compared to periodically obtaining the computing power of the vehicle, real-time acquisition of the computing power of the vehicle can reduce one clock control command, which can better save computing power.

[0026] Step 120: According to the computing power of the vehicle, the use status of the intrusion detection rules in the vehicle is adjusted. The intrusion detection rules are used to perform security detection on the data.

[0027] Among them, after obtaining the computing power of the vehicle, the controller can flexibly adjust the use status of the intrusion detection rules in the vehicle according to the real-time computing power of the vehicle. Among them, the intrusion detection rule is a rule for implementing security detection of data. Optionally, a plurality of intrusion detection rules may be included in the controller on the vehicle side. Optionally, the intrusion detection rule may be stored in the memory of the controller. Optionally, the intrusion detection rule may be stored in the format of a configuration file, a data table, etc. Optionally, the use status of the intrusion detection rule may include an operating status and configuration parameters. The controller may adjust the operating status and / or configuration parameters of the intrusion detection rule according to the computing power of the vehicle. Optionally, the operating status may include enabled or not enabled. The configuration parameters may include detection frequency, calculation logic, etc.

[0028] In one example, the controller may adjust the operating state of the intrusion detection rules in the vehicle according to the computing power of the vehicle and the priority of the intrusion detection rules. Optionally, each intrusion detection rule may correspond to a priority. When the computing power is sufficient, the controller may enable more intrusion detection rules according to the priority. When the computing power is insufficient, the controller may not enable some intrusion detection rules according to the priority. Optionally, the process of not enabling or enabling the intrusion detection rules is the process of adjusting the operating state.

[0029] In another example, the controller can adjust the configuration parameters of the intrusion detection rules in the vehicle according to the computing power of the vehicle and the priority of the intrusion detection rules. When the computing power is sufficient, the controller can load and open all the rules one by one to ensure comprehensive intrusion detection coverage. The controller can also reduce the detection frequency of certain rules and simplify the calculation logic of complex rules when the computing power is insufficient to save computing power.

[0030] In the present application, after obtaining the computing power of the vehicle, the controller can flexibly adjust the use status of the intrusion detection rules in the vehicle according to the real-time computing power of the vehicle, to ensure that the computing power and actual needs of the controller are dynamically loaded without affecting the core functions of the controller in the process of data security detection, so as to achieve effective optimization and utilization of resources in the controller. This dynamic configuration method can enable the vehicle to make real-time decisions based on the actual computing power and situation when the same parameters are sent from the cloud, thereby improving the adaptability to the actual conditions of different vehicles. In addition, the method of the present application realizes the design and automatic configuration of the localized IDPs on the vehicle side, enhances the security and stability of the controller, and makes the intrusion detection rules not interfered by external network factors. In addition, the process of executing the dynamic configuration completely on the vehicle side can reduce the risk of rule tampering that may occur during the vehicle-cloud interaction process.

[0031] On the basis of the above-mentioned embodiments, the intrusion detection rules of the present application can be sent from the cloud to the controllers of each vehicle end after the intrusion detection rules are updated. Optionally, the cloud can send the intrusion detection rules in the form of sending data packets. Optionally, the data packet under the cloud can also include the priority of each intrusion detection rule. After obtaining the data packet, the controller can update the intrusion detection rules in the vehicle according to the intrusion detection rules in the data packet. Optionally, the updated intrusion detection rules are stored in the local memory of the controller.

[0032] On the basis of the above-mentioned embodiments, the intrusion detection rules of the present application may also be intrusion detection rules issued by the cloud according to a preset policy. Optionally, the preset policy may be a policy determined by the cloud according to the business corresponding to the currently interacted data. Alternatively, the preset policy may be a policy determined by the cloud according to the communication method in the current interaction process. During the interaction process, the cloud may issue the intrusion detection rules corresponding to the preset policy to the controller. Optionally, during this process, the intrusion detection rules issued by the cloud may be the name or identifier of the intrusion detection rules. After obtaining the intrusion detection rules issued by the cloud, the controller may obtain the corresponding execution information from the intrusion detection rules stored locally according to the name or identifier.

[0033] On the basis of the above embodiments, the present application adopts a loosely coupled architecture to implement the execution of each intrusion detection rule. This method can make each intrusion detection rule in the vehicle-mounted IDPS correspond to a model. The modules can be independent of each other but work together. This design ensures that the failure or abnormality of a single rule module will not affect the operation of the entire system, greatly improving the availability of the vehicle-mounted IDPS. This setting can ensure that even if some intrusion detection rules cannot be enabled due to special circumstances, other intrusion detection rules can continue to play a role and ensure the basic safety protection of the vehicle.

[0034] Figure 2 FIG. 2 is a flow chart showing another embodiment of the method for automatically configuring intrusion detection rules provided by the present invention, wherein the method is executed by a controller. Figure 2 As shown, the types of intrusion detection rules include main detection rules and slave detection rules. Among them, the priority of the main detection rule is higher than that of the slave detection rule. And different slave detection rules have different priorities. Based on the priorities of the main detection rule and the slave detection rule, the controller adjusts the operating state of the intrusion detection rule in the vehicle according to the computing power of the vehicle. The method includes the following steps:

[0035] Step 210: If there is a main detection rule that is not enabled, the operation state of the main detection rule is adjusted to enabled, and the computing power of the vehicle is updated.

[0036] Among them, the controller can first determine whether the intrusion detection rule contains a main detection rule whose running status is not enabled. If there are main detection rules that are not enabled, the controller can adjust the running status of these main detection rules to enabled. Optionally, the main detection rule is a key rule to ensure the basic security of vehicle data and core functions. The activation of the main detection rule can be regardless of the computing power situation and ensure that it is always in the enabled state. The controller can re-acquire the computing power of the vehicle after completing the activation of the main detection rule. At this time, the computing power acquired by the controller is the computing power after all the main detection rules are activated.

[0037] Step 220: Adjust the operating status of the slave detection rules in the vehicle according to the updated computing power and the priority of the slave detection rules in the vehicle.

[0038] The controller may determine whether there is surplus computing power or insufficient computing power based on the updated computing power. If there is surplus computing power, the controller may start a new slave detection rule based on the priority of the slave detection rule in the vehicle. If there is insufficient computing power, the controller may not enable an already enabled slave detection rule based on the priority of the slave detection rule in the vehicle.

[0039] In one example, the specific process of the controller adjusting the operating state of the vehicle from the detection rule may include the following steps:

[0040] Step 221: If the updated computing power is less than or equal to the first threshold, the running status of some or all of the inactivated slave detection rules is adjusted to activated according to the computing power and the priority of the inactivated slave detection rules.

[0041] Among them, after obtaining the updated computing power, the controller may first compare the computing power with the first threshold. Optionally, when the computing power includes CPU usage and memory occupancy, the first threshold may include a first CPU threshold and a first memory threshold. For example, the first CPU threshold may be 50%, and the first memory threshold may be 70%. Optionally, the first threshold may be determined based on the performance of the controller. When the computing power usage of the controller is greater than the first threshold, the controller will no longer add new slave detection rules, thereby ensuring that the remaining computing power can cope with the needs of the controller during the operation of the existing process. When the computing power is less than or equal to the first threshold, the controller may determine that there is sufficient surplus computing power. At this time, the controller may adjust the running state of at least one slave detection rule from not started to enabled.

[0042] In one implementation, a third threshold may be pre-stored in the controller. The third threshold may be a value greater than or equal to the first threshold. When the computing power in the controller is greater than or equal to the third threshold, it means that the remaining computing power in the controller is only sufficient for the operation of the existing processes in the controller and the handling of emergency situations. Therefore, the controller can calculate the difference between the computing power and the preset third threshold and obtain the available computing power. The available computing power is the computing power that can be allocated to the unenabled slave detection rules. The controller can select at least one slave detection rule with the highest priority from the unenabled slave detection rules. When the at least one unstarted slave detection rule is running, the total computing power required is less than or equal to the available computing power. The controller can adjust the running state of at least one unenabled slave detection rule to enabled.

[0043] In another implementation, the controller may adjust the running state of the slave detection rule by sequentially enabling the slave detection rule. Specifically, the process may include the following steps:

[0044] Step 2211: The controller may first determine whether the computing power is less than the third threshold value. If yes, step 2212 is executed, and if no, the controller may end the loop.

[0045] Step 2212: The controller may obtain the highest priority slave detection rule among the unenabled slave detection rules, and may enable the highest priority unenabled slave detection rule.

[0046] Step 2213: When the running status of the highest priority unenabled slave detection rule is adjusted to enabled, the controller can obtain the updated computing power and return to step 2211.

[0047] Step 222: If the updated computing power is greater than or equal to a second threshold, the running status of some or all enabled slave detection rules is adjusted to be disabled according to the computing power and the priority of the enabled slave detection rules, wherein the second threshold is greater than the first threshold.

[0048] Among them, after obtaining the updated computing power, the controller can first compare the computing power with the second threshold. The second threshold is a value greater than or equal to the first threshold. Optionally, when the computing power includes CPU usage and memory occupancy, the second threshold may include a second CPU threshold and a first memory threshold. For example, the second CPU threshold may be 80%, and the first memory threshold may be 80%. Optionally, the second threshold may be determined based on the performance of the controller. When the computing power of the controller is greater than or equal to the second threshold, it means that the computing power of the controller is seriously insufficient. Therefore, when the computing power is greater than or equal to the second threshold, the controller can turn off some of the enabled slave detection rules to release the computing power. For example, the controller can temporarily turn off some computationally intensive slave detection rules. For example, the rules for in-depth analysis of a large amount of historical data can be turned off.

[0049] In one implementation, a fourth threshold may be pre-stored in the controller. The fourth threshold may be a value less than or equal to the second threshold. When the computing power in the controller is less than or equal to the third threshold, it means that there is enough remaining computing power in the controller to be used for the operation of existing processes in the controller and the handling of emergency situations. Therefore, the controller can calculate the difference between the computing power and the preset fourth threshold, and obtain the computing power to be released. The computing power to be released is the computing power that needs to be released by stopping the operation of some slave rules. The controller can select at least one slave detection rule with the lowest priority from the enabled slave detection rules. The computing power required for the operation of at least one enabled slave detection rule is greater than or equal to the computing power to be released. The controller can adjust the operating state of at least one enabled slave detection rule to not enabled.

[0050] In another implementation, the controller may adjust the running state of the slave detection rule by sequentially shutting down the enabled slave detection rules. Specifically, the process may include the following steps:

[0051] Step 2221: The controller may first determine whether the computing power is greater than the fourth threshold value. If yes, step 2222 is executed; if no, the controller may end the loop.

[0052] Step 2222: The controller may obtain the slave detection rule with the lowest priority among the enabled slave detection rules. The controller may adjust the running state of the enabled slave detection rule with the lowest priority to not enabled.

[0053] Step 2223: When the running state of the enabled slave detection rule with the lowest priority is adjusted to not enabled, the controller can obtain the updated computing power and return to step 2221.

[0054] In the present application, when the controller detects that the running state of the main detection rule is not enabled, the controller can adjust the running state of the main detection rule to enabled, so as to ensure the activation of the key rules that guarantee the basic security of the vehicle data and the core functions. Secondly, when the controller detects that the computing power is less than or equal to the first threshold, according to the computing power and the priority of the unenabled slave detection rules, it can enable some or all of the unenabled slave detection rules to improve the vehicle's detection accuracy of the data. And, when the controller detects that the computing power is greater than or equal to the second threshold, according to the computing power and the priority of the enabled slave detection rules, it can disable some or all of the enabled slave detection rules to ensure the normal operation of the controller. The present application realizes the dynamic adjustment of the intrusion detection rules by enabling and disabling the intrusion detection rules, and improves the detection efficiency of data security detection on the basis of ensuring the basic needs of data security detection.

[0055] Based on the above embodiment, the controller can also adjust the configuration parameters of the intrusion detection rules in the vehicle according to the computing power of the vehicle and the priority of the intrusion detection rules. Different configuration parameters can correspond to different adjustment strategies. When the configuration parameter is the detection frequency, the specific adjustment process of the configuration parameter can include the following steps:

[0056] Step 310: If the computing power is less than or equal to the fifth threshold, the detection frequency of some or all of the intrusion detection rules in operation is increased according to the computing power and the priority of the intrusion detection rules in operation.

[0057] Among them, the controller can first compare the computing power and the fifth threshold. Optionally, when the computing power includes CPU usage and memory occupancy, the fifth threshold may include a fifth CPU threshold and a fifth memory threshold. For example, the fifth CPU threshold may be 50%, and the fifth memory threshold may be 70%. Optionally, the fifth threshold may be determined according to the performance of the controller. When the computing power usage of the controller is greater than the fifth threshold, the controller will no longer increase the detection frequency, thereby ensuring that the remaining computing power can cope with the needs of the controller during the operation of the existing process. When the computing power is less than or equal to the fifth threshold, the controller can determine that there is sufficient surplus computing power. At this time, the controller can increase the detection frequency of at least one detection rule.

[0058] In one implementation, the controller may set multiple levels of intrusion detection rules for an intrusion detection rule that can adjust the detection frequency. When the controller needs to increase the intrusion detection rule, the controller may determine the detection frequency after increasing one level as the target frequency according to the current detection frequency.

[0059] In another implementation, the controller may be provided with an increase step length of the detection frequency. When the controller determines that the intrusion detection rule needs to be increased, the controller may add the increase step length to the current detection frequency to obtain a new target frequency.

[0060] In another implementation, the controller may determine a frequency adjustment ratio according to the computing power and the seventh threshold value. The controller may determine an increase frequency according to the frequency adjustment ratio. The controller may calculate a target frequency according to the increase frequency and the current frequency.

[0061] In one example, the process of the controller increasing the detection frequency of some or all intrusion detection rules in a running state may include the following steps:

[0062] Step 311: The controller may determine whether the computing power is greater than or equal to the seventh threshold. If yes, step 312 is executed. If no, the controller ends the loop. The seventh threshold is greater than or equal to the fifth threshold.

[0063] Step 312: The controller may obtain an intrusion detection rule with the highest priority among the enabled intrusion detection rules and capable of increasing the detection frequency. The controller may preset a step size and determine a target frequency after the intrusion detection rule is increased. The controller may adjust the detection frequency of the intrusion detection rule according to the target frequency and update the computing power.

[0064] Step 320: If the computing power is greater than or equal to the sixth threshold, the detection frequency of some or all intrusion detection rules in operation is lowered according to the computing power and the priority of the intrusion detection rules in operation. The sixth threshold is less than the fifth threshold.

[0065] Among them, the controller can first compare the computing power and the sixth threshold. Optionally, when the computing power includes CPU usage and memory occupancy, the sixth threshold may include a sixth CPU threshold and a sixth memory threshold. For example, the sixth CPU threshold may be 80%, and the sixth memory threshold may be 80%. Optionally, the sixth threshold may be determined according to the performance of the controller. When the computing power is less than or equal to the sixth threshold, the controller may determine that the computing power is sufficient to cope with the computing power requirements for continued use of the controller. When the computing power usage of the controller is greater than the sixth threshold, the controller will experience insufficient computing power. At this point, the controller may lower the detection frequency of at least one detection rule. For example, it can be adjusted from detecting once per second to detecting once per minute.

[0066] In one implementation, the controller may set multiple levels of intrusion detection rules for an intrusion detection rule that can adjust the detection frequency. When the controller needs to lower the intrusion detection rule, the controller may determine the detection frequency after lowering one level as the target frequency based on the current detection frequency.

[0067] In another implementation, the controller may be provided with a downward adjustment step size for the detection frequency. When the controller determines that the intrusion detection rule needs to be adjusted downward, the controller may add the upward adjustment step size according to the current detection frequency to obtain a new target frequency.

[0068] In another implementation, the controller may determine a frequency adjustment ratio according to the computing power and the seventh threshold value. The controller may determine a lower frequency according to the frequency adjustment ratio. The controller may calculate a target frequency according to the lower frequency and the current frequency.

[0069] In one example, the process of the controller lowering the detection frequency of some or all intrusion detection rules in operation may include the following steps:

[0070] Step 321: The controller may determine whether the computing power is less than or equal to the eighth threshold. If yes, step 322 is executed. If no, the controller ends the loop. The eighth threshold is less than or equal to the sixth threshold.

[0071] Step 322: The controller may obtain an intrusion detection rule with the lowest priority among the enabled intrusion detection rules and capable of reducing the detection frequency. The controller may determine the target frequency after the intrusion detection rule is reduced according to a preset step size. The controller may adjust the detection frequency of the intrusion detection rule according to the target frequency and update the computing power.

[0072] In the present application, when the controller detects that the computing power is less than or equal to the fifth threshold, the controller can also increase the detection frequency of some or all of the enabled slave detection rules according to the computing power and the priority of the enabled slave detection rules to improve the vehicle's detection accuracy of the data. And, when the controller detects that the computing power is greater than or equal to the sixth threshold, the controller can also reduce the detection frequency of some or all of the enabled slave detection rules according to the computing power and the priority of the enabled slave detection rules to ensure the normal operation of the controller.

[0073] On the basis of the above embodiment, during the operation of the controller, the controller may also detect the data to be detected after acquiring the data to be detected. The specific process may include:

[0074] Step 410: Obtain data to be detected.

[0075] Among them, the controller can obtain the data to be detected sent by the cloud.

[0076] Step 420: Use the intrusion detection rules in operation to detect the data to be detected.

[0077] After receiving the data to be detected, the controller may use the intrusion detection rules in an enabled state to detect the rules to be detected and obtain a detection result.

[0078] Step 430: If the detection result indicates that the data to be detected is abnormal, the data to be detected is intercepted and an abnormality report is generated.

[0079] The controller may judge the detection result. If the detection result indicates that the data to be detected is normal, the controller may continue to use the data to be detected for subsequent processing. If the detection result indicates that the data to be detected is abnormal, the controller may intercept the data to be detected. At the same time, the controller may also generate an abnormality report. The abnormality report is used to remind the user that the data to be detected has a security risk and the user needs to further process the data to be detected.

[0080] Figure 3 FIG. 2 is a schematic diagram showing a structure of an embodiment of an automatic configuration device for intrusion detection rules provided by the present invention. Figure 3 As shown, the automatic configuration device 500 for intrusion detection rules includes: an acquisition module 510 and a configuration module 520 .

[0081] An acquisition module 510 is used to acquire the computing power of the vehicle in real time;

[0082] Configuration module 520 is used to adjust the usage status of intrusion detection rules in the vehicle according to the computing power of the vehicle; wherein the intrusion detection rules are used to perform security detection on data.

[0083] Optionally, the configuration module 520 is used to:

[0084] According to the computing power of the vehicle and the priority of the intrusion detection rules, the running status of the intrusion detection rules in the vehicle is adjusted.

[0085] Optionally, the type of the intrusion detection rule is a primary detection rule, or a secondary detection rule; wherein the priority of the primary detection rule is higher than that of the secondary detection rule; and different secondary detection rules have different priorities.

[0086] Optionally, the configuration module 520 is used to:

[0087] If there is an inactive main detection rule, the running state of the main detection rule is adjusted to active; and the computing power of the vehicle is updated;

[0088] According to the updated computing power and the priority of the slave detection rules in the vehicle, the operating status of the slave detection rules in the vehicle is adjusted.

[0089] Optionally, the configuration module 520 is used to:

[0090] If the updated computing power is less than or equal to the first threshold, adjusting the running status of some or all of the inactivated slave detection rules to activated according to the computing power and the priority of the inactivated slave detection rules;

[0091] If the updated computing power is greater than or equal to the second threshold, adjusting the running status of some or all of the enabled slave detection rules to not enabled according to the computing power and the priority of the enabled slave detection rules;

[0092] The second threshold is greater than or equal to the first threshold.

[0093] Optionally, the configuration module 520 is used to:

[0094] Determine the available computing power according to the difference between the computing power and a preset third threshold; the third threshold is greater than or equal to the first threshold;

[0095] Selecting at least one slave detection rule with the highest priority from the slave detection rules that have not been enabled; wherein the computing power required to run the at least one slave detection rule that has not been enabled is less than or equal to the available computing power;

[0096] Change the running status of at least one disabled slave detection rule to enabled.

[0097] Optionally, the configuration module 520 is used to:

[0098] Determine the computing power to be released according to the difference between the computing power and a preset fourth threshold; the fourth threshold is less than or equal to the second threshold;

[0099] Select at least one slave detection rule with the lowest priority from the enabled slave detection rules; wherein the computing power required to run at least one slave detection rule is greater than or equal to the computing power to be released;

[0100] Change the running status of at least one enabled slave detection rule to disabled.

[0101] Optionally, the configuration module 520 is used to:

[0102] According to the computing power of the vehicle and the priority of the intrusion detection rules, the configuration parameters of the intrusion detection rules in the vehicle are adjusted.

[0103] Optionally, when the configuration parameter is a detection frequency, the configuration module 520 is configured to:

[0104] If the computing power is less than or equal to the fifth threshold, the detection frequency of some or all of the intrusion detection rules in operation is increased according to the computing power and the priority of the intrusion detection rules in operation;

[0105] If the computing power is greater than or equal to the sixth threshold, the detection frequency of some or all of the intrusion detection rules in operation is lowered according to the computing power and the priority of the intrusion detection rules in operation;

[0106] The sixth threshold is smaller than the fifth threshold.

[0107] Optionally, the configuration module 520 is used to:

[0108] Repeat the following steps until the computing power is greater than or equal to the seventh threshold;

[0109] Obtain an intrusion detection rule with the highest priority among the enabled intrusion detection rules and capable of increasing the detection frequency; determine the target frequency of the intrusion detection rule after the intrusion detection rule is increased according to the preset step size; adjust the detection frequency of the intrusion detection rule according to the target frequency, and update the computing power;

[0110] Among them, the seventh threshold is greater than or equal to the fifth threshold.

[0111] Optionally, the configuration module 520 is used to:

[0112] Repeat the following steps until the computing power is less than or equal to the eighth threshold;

[0113] Obtain an intrusion detection rule with the lowest priority among the enabled intrusion detection rules and whose detection frequency can be lowered; determine the target frequency after the intrusion detection rule is lowered according to the preset step size; adjust the detection frequency of the intrusion detection rule according to the target frequency, and update the computing power;

[0114] Among them, the eighth threshold is less than or equal to the sixth threshold.

[0115] Optionally, the acquisition module 510 is used to:

[0116] Obtaining a data packet from the cloud, where the data packet includes an intrusion detection rule and a priority of each intrusion detection rule;

[0117] Based on the data packet, the intrusion detection rules in the vehicle are updated.

[0118] Optionally, the detection module is used to:

[0119] Obtain the data to be tested;

[0120] Use the enabled intrusion detection rules to detect the data to be detected;

[0121] If the detection result indicates that the data to be detected is abnormal, the data to be detected is intercepted and an abnormality report is generated.

[0122] The automatic configuration device for intrusion detection rules provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0123] Figure 4 A schematic diagram of the structure of an embodiment of the controller provided by the present invention is shown, and the specific embodiment of the present invention does not limit the specific implementation of the controller.

[0124] like Figure 4 As shown, the controller may include: a processor (processor) 602 , a communications interface (Communications Interface) 604 , a memory (memory) 606 , and a communication bus 608 .

[0125] The processor 602, the communication interface 604, and the memory 606 communicate with each other via a communication bus 608. The communication interface 604 is used to communicate with other devices such as a client or other server network elements. The processor 602 is used to execute a program 610, which can specifically execute the relevant steps in the above-mentioned embodiment of the automatic configuration method for intrusion detection rules.

[0126] Specifically, the program 610 may include program code including computer executable instructions.

[0127] The processor 602 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention. The one or more processors included in the controller may be processors of the same type, such as one or more CPUs. They may also be processors of different types, such as one or more CPUs and one or more ASICs.

[0128] The memory 606 is used to store the program 610. The memory 606 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0129] The program 610 may be specifically called by the processor 602 to enable the controller to execute the automatic configuration method of the intrusion detection rules in any of the above method embodiments.

[0130] An embodiment of the present invention provides a computer-readable storage medium storing at least one executable instruction. When the executable instruction is executed on a controller, the controller executes the automatic configuration method of intrusion detection rules in any of the above method embodiments.

[0131] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system or other device. In addition, the embodiments of the present invention are not directed to any particular programming language.

[0132] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. Similarly, in order to simplify the present invention and help understand one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. Wherein, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself is a separate embodiment of the present invention.

[0133] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and further may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive.

[0134] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

Claims

1. An automatic configuration method for intrusion detection rules, characterized in that: The method comprises: Obtain the vehicle’s computing power in real time; According to the computing power of the vehicle, the usage status of the intrusion detection rules in the vehicle is adjusted; wherein the intrusion detection rules are used to perform security detection on data.

2. The method according to claim 1, characterized in that According to the computing power of the vehicle, adjusting the usage status of the intrusion detection rules in the vehicle includes: The operating status of the intrusion detection rules in the vehicle is adjusted according to the computing power of the vehicle and the priority of the intrusion detection rules.

3. The method according to claim 2, characterized in that The type of the intrusion detection rule is a primary detection rule, or a secondary detection rule; wherein the priority of the primary detection rule is higher than that of the secondary detection rule; and different secondary detection rules have different priorities.

4. The method according to claim 3, characterized in that According to the computing power of the vehicle and the priority of the intrusion detection rule, adjusting the running state of the intrusion detection rule in the vehicle includes: If there is an inactive main detection rule, adjusting the operation state of the main detection rule to active; and updating the computing power of the vehicle; According to the updated computing power and the priority of the slave detection rules in the vehicle, the operating status of the slave detection rules in the vehicle is adjusted.

5. The method according to claim 4, characterized in that According to the updated computing power and the priority of the slave detection rule in the vehicle, the operation state of the slave detection rule in the vehicle is adjusted, including: If the updated computing power is less than or equal to the first threshold, adjusting the running status of some or all of the inactivated slave detection rules to activated according to the computing power and the priority of the inactivated slave detection rules; If the updated computing power is greater than or equal to the second threshold, adjusting the running status of some or all of the enabled slave detection rules to not enabled according to the computing power and the priority of the enabled slave detection rules; The second threshold is greater than or equal to the first threshold.

6. The method according to claim 5, characterized in that According to the computing power and the priority of the inactivated secondary detection rule, adjusting the running status of some or all of the inactivated secondary detection rules to activated, including: Determining available computing power according to a difference between the computing power and a preset third threshold value; the third threshold value is greater than or equal to the first threshold value; Selecting at least one slave detection rule with the highest priority from the slave detection rules that have not been enabled; wherein the computing power required to run at least one of the slave detection rules that has not been enabled is less than or equal to the available computing power; The running state of at least one of the disabled slave detection rules is adjusted to enabled.

7. The method according to claim 5, characterized in that According to the computing power and the priority of the enabled slave detection rule, adjusting the running status of some or all of the enabled slave detection rules to be disabled, including: Determine the computing power to be released according to the difference between the computing power and a preset fourth threshold value; the fourth threshold value is less than or equal to the second threshold value; Selecting at least one slave detection rule with the lowest priority from the enabled slave detection rules; wherein the computing power required to run at least one of the slave detection rules is greater than or equal to the computing power to be released; The running state of at least one enabled slave detection rule is adjusted to be disabled.

8. The method according to any one of claims 1 to 7, characterized in that According to the computing power of the vehicle, adjusting the usage status of the intrusion detection rules in the vehicle includes: Adjust the configuration parameters of the intrusion detection rules in the vehicle according to the computing power of the vehicle and the priority of the intrusion detection rules.

9. The method according to claim 8, characterized in that When the configuration parameter is the detection frequency, adjusting the configuration parameter of the intrusion detection rule in the vehicle according to the computing power of the vehicle and the priority of the intrusion detection rule includes: If the computing power is less than or equal to the fifth threshold, increasing the detection frequency of some or all of the intrusion detection rules in operation according to the computing power and the priority of the intrusion detection rules in operation; If the computing power is greater than or equal to the sixth threshold, lowering the detection frequency of some or all of the intrusion detection rules in operation according to the computing power and the priority of the intrusion detection rules in operation; The sixth threshold is smaller than the fifth threshold.

10. The method according to claim 9, characterized in that According to the computing power and the priority of the intrusion detection rules in operation, increasing the detection frequency of some or all of the intrusion detection rules in operation, including: Repeat the following steps until the computing power is greater than or equal to the seventh threshold; Obtaining an intrusion detection rule with the highest priority among the enabled intrusion detection rules and capable of increasing the detection frequency; determining a target frequency after the intrusion detection rule is increased according to a preset step size; adjusting the detection frequency of the intrusion detection rule according to the target frequency, and updating the computing power; Wherein, the seventh threshold is greater than or equal to the fifth threshold.

Images