Vehicle-mounted terminal host monitoring method and device, electronic equipment and storage medium

Abstract

The invention provides a vehicle-mounted terminal host monitoring method and device, electronic equipment and a storage medium, and relates to the technical field of vehicle safety, and the method comprises the steps: building a monitoring rule for monitoring a preset safety risk event, and generating a safety monitoring program according to the monitoring rule; dynamically loading and operating a safety monitoring program in the vehicle-mounted terminal host kernel, so as to monitor a currently loaded event in the vehicle-mounted terminal host kernel by using the safety monitoring program; and if the monitored current loaded event is matched with the preset security risk event, processing the current loaded event according to a monitoring result. By adopting the vehicle-mounted terminal host monitoring method and device, the electronic equipment and the storage medium, the problem of high safety risk of the vehicle-mounted terminal is solved.

Description

Technical Field

[0001] The present application relates to the field of vehicle safety technology, and in particular to a vehicle-mounted terminal host monitoring method, device, electronic equipment and storage medium. Background Art

[0002] With the rapid development of intelligent transportation and Internet of Vehicles technology, the vehicle terminal host, as the core equipment for vehicle information processing and communication, plays an increasingly important role. The vehicle terminal host is not only responsible for the navigation, entertainment and information services of the vehicle, but also interacts with various subsystems of the vehicle to ensure the safety and efficiency of the vehicle. However, as the functions of the vehicle terminal become increasingly rich, the security threats it faces are also increasing. The introduction of monitoring technology in the vehicle terminal host is particularly important. By real-time monitoring of the operating status, data transmission and external interface of the vehicle terminal, potential safety hazards and faults can be discovered in time to ensure the normal operation of the vehicle.

[0003] However, existing vehicle terminals are usually only able to upload simple data such as system logs, memory usage, CPU usage, disk space, etc. These data can only simply analyze the status of the vehicle terminal. For complex vehicle terminal systems, they cannot meet current security requirements, causing the vehicle terminals to face great security risks. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a vehicle-mounted terminal host monitoring method, device, electronic device and storage medium to solve the problem of high security risk of vehicle-mounted terminals.

[0005] In a first aspect, an embodiment of the present application provides a vehicle terminal host monitoring method, comprising:

[0006] Establish monitoring rules for monitoring preset security risk events for target monitoring objects, and generate security monitoring programs based on the monitoring rules;

[0007] Dynamically loading and running a security monitoring program in the vehicle terminal host kernel, so as to monitor currently loaded events in the vehicle terminal host kernel by using the security monitoring program;

[0008] If the monitored currently loaded event matches the preset security risk event, the currently loaded event is processed according to the monitoring result.

[0009] Optionally, monitoring rules are established for monitoring preset security risk events for target monitoring objects, including: determining the function to be monitored corresponding to the preset security risk event, the parameter to be monitored corresponding to the function to be monitored, the filter for screening the preset security risk events, and the target action to be performed when the preset security risk event is triggered; and constructing monitoring rules based on the function to be monitored, the parameter to be monitored, the filter and the target action.

[0010] Optionally, the currently loaded events in the kernel of the vehicle terminal host are monitored in the following manner, including: using a filter to filter the currently loaded events to determine whether the currently loaded events meet the filtering conditions; if they meet the filtering conditions, obtaining the current event parameters corresponding to the currently loaded event, and determining whether the current event parameters match the parameters to be monitored; if the current event parameters match the parameters to be monitored, determining that the currently loaded event matches the preset security risk event.

[0011] Optionally, the current event parameters include at least one current function parameter and a current return parameter, the parameters to be monitored include at least one preset function parameter and a preset return parameter, and determining whether the current event parameters match the parameters to be monitored includes: determining in turn whether each current function parameter matches the corresponding preset function parameter; if each current function parameter matches the corresponding preset function parameter, determining whether the current return parameter matches the preset return parameter; if the current return parameter matches the preset return parameter, determining that the current event parameter matches the parameter to be monitored.

[0012] Optionally, the currently loaded event is processed according to the monitoring result, including: adjusting the monitoring rules according to the monitoring result to generate new monitoring rules; and using the new monitoring rules to perform security monitoring on the vehicle terminal host.

[0013] Optionally, after generating the security monitoring program according to the monitoring rules, the method further includes: compiling the security monitoring program into bytecodes to load and run the bytecodes in a kernel of a vehicle terminal host.

[0014] Optionally, dynamically loading and running the security monitoring program in the vehicle terminal host kernel includes: loading the security monitoring program in the vehicle terminal host kernel in a multi-threaded concurrent manner.

[0015] In a second aspect, an embodiment of the present application further provides a vehicle terminal host monitoring device, the device comprising:

[0016] A monitoring program generation module, used to establish monitoring rules for monitoring preset security risk events for target monitoring objects, and generate a security monitoring program according to the monitoring rules;

[0017] An event monitoring module is used to dynamically load and run a security monitoring program in the vehicle terminal host kernel, so as to monitor currently loaded events in the vehicle terminal host kernel using the security monitoring program;

[0018] The event processing module is used to process the currently loaded event according to the monitoring result if the currently loaded event monitored matches the preset security risk event.

[0019] In the third aspect, an embodiment of the present application also provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the above-mentioned vehicle terminal host monitoring method are performed.

[0020] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the vehicle terminal host monitoring method as described above are executed.

[0021] The embodiments of the present application bring the following beneficial effects:

[0022] The vehicle terminal host monitoring method, device, electronic device and storage medium provided by the embodiment of the present application can generate a security monitoring program according to the monitoring rules, and dynamically load the security monitoring program directly into the kernel of the vehicle terminal host for operation, and detect the events loaded in the kernel without changing the kernel source code, thereby improving the detection efficiency. At the same time, it can also automatically perform corresponding security processing when a preset security risk event is triggered, thereby realizing security monitoring of the vehicle terminal host. Compared with the vehicle terminal host monitoring method in the prior art, it solves the problem of high security risk of the vehicle terminal.

[0023] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flow chart showing a vehicle terminal host monitoring method provided in an embodiment of the present application is shown;

[0026] Figure 2 A schematic diagram showing the structure of a vehicle terminal host monitoring device provided in an embodiment of the present application is shown;

[0027] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0028] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0029] It is worth noting that before this application was filed, with the rapid development of intelligent transportation and Internet of Vehicles technology, the vehicle-mounted terminal host, as the core equipment for vehicle information processing and communication, played an increasingly important role. The vehicle-mounted terminal host is not only responsible for the navigation, entertainment and information services of the vehicle, but also interacts with the various subsystems of the vehicle to ensure the safety and efficiency of the vehicle. However, as the functions of the vehicle-mounted terminal become increasingly rich, the security threats it faces are also increasing. It is particularly important to introduce monitoring technology in the vehicle-mounted terminal host. By real-time monitoring of the operating status, data transmission and external interface of the vehicle-mounted terminal, potential safety hazards and faults can be discovered in time to ensure the normal operation of the vehicle. Monitoring technology can cover multiple aspects, including but not limited to: data flow monitoring, system status monitoring, security event monitoring, and user behavior monitoring. Among them, data flow monitoring is to monitor the data interaction between the vehicle terminal and the external network (such as Bluetooth, WLAN, USB, etc.) in real time, and identify abnormal traffic and potential attack behaviors; system status monitoring is to monitor the hardware and software status of the vehicle terminal, including CPU usage, memory usage, storage status, etc., to timely discover system failures and performance bottlenecks; security event monitoring is to monitor the security events of the vehicle terminal through the intrusion detection and prevention system (IDPS), and identify security threats such as malicious attacks, unauthorized access and data leakage; user behavior monitoring is to analyze the user's operation behavior on the vehicle terminal, identify abnormal operations and potential security risks. By introducing advanced monitoring technology, the vehicle terminal host can realize comprehensive monitoring of the vehicle's operating status and safety, improve the safety and reliability of the vehicle, and provide strong support for the construction of intelligent transportation systems. However, existing vehicle terminals are usually only able to upload simple data such as system logs, memory usage, CPU usage, disk space, etc. These data can only simply analyze the status of the vehicle terminal. For complex vehicle terminal systems, they cannot meet current security requirements, causing the vehicle terminal to face great security risks.

[0030] Based on this, an embodiment of the present application provides a vehicle-mounted terminal host monitoring method to improve the security of the vehicle-mounted terminal.

[0031] See also Figure 1 , Figure 1 This is a flow chart of a vehicle terminal host monitoring method provided by an embodiment of the present application. Figure 1 As shown, the vehicle terminal host monitoring method provided by the embodiment of the present application includes:

[0032] Step S101, establishing monitoring rules for monitoring preset security risk events for a target monitoring object, and generating a security monitoring program according to the monitoring rules;

[0033] Step S102, dynamically loading and running a security monitoring program in the vehicle terminal host kernel, so as to monitor currently loaded events in the vehicle terminal host kernel using the security monitoring program;

[0034] Step S103: If the monitored currently loaded event matches the preset security risk event, the currently loaded event is processed according to the monitoring result.

[0035] Through the above steps, the application can generate a security monitoring program according to the monitoring rules, and dynamically load the security monitoring program directly into the kernel of the vehicle terminal host to run, and detect the events loaded in the kernel without changing the kernel source code, thereby improving the detection efficiency. At the same time, it can also automatically perform corresponding security processing when a preset security risk event is triggered, realize the security monitoring of the vehicle terminal host, and solve the problem of high security risk of the vehicle terminal.

[0036] Below Figure 1 Each step is described in detail.

[0037] In step S101, monitoring rules for monitoring preset security risk events for a target monitoring object are established, and a security monitoring program is generated according to the monitoring rules.

[0038] The target monitoring object may refer to the object that needs to be monitored in the vehicle terminal host. The target monitoring object includes but is not limited to: network data, file operations, process information, system calls, permission modifications, and hardware input and output.

[0039] Among them, network data may refer to data such as network traffic, connection requests, and data packet transmission; file operations may refer to operations such as creating, modifying, deleting, and reading files; process information may refer to information such as the start, termination, and status change of a process; system calls may refer to the execution of system calls; permission modification may refer to operations that change user permissions; hardware input and output may refer to input and output operations of hardware devices, such as input or output of data through USB, Bluetooth, WLAN, etc.

[0040] The preset security risk event may refer to an event with security risk executed on the target monitoring object. For example, the preset security risk event may be the deletion of a startup file or the binding behavior for a specific IP port.

[0041] Monitoring rules may refer to the rules used when performing security monitoring on preset security risk events. Monitoring rules include, but are not limited to: functions to be monitored, parameters to be monitored, filters, and target actions.

[0042] The function to be monitored may refer to a function that needs to be monitored. Exemplarily, the function to be monitored may be a system function or a kernel function. For example, the function to be monitored may be an inet_bind function.

[0043] The parameter to be monitored is a function parameter corresponding to the function to be monitored, and the parameter to be monitored indicates which function parameters need to be monitored. Taking the above example, the parameter to be monitored may be a parameter of the inet_bind function.

[0044] Filters are used to set filter conditions to filter specific security risk events. For example, the filter condition you set can be "filter out curl's IP port binding behavior."

[0045] Target actions are used to define the actions that need to be performed when a preset security risk event is triggered. Target actions include but are not limited to: logging, blocking operations, or sending alerts.

[0046] The security monitoring program may refer to a kernel program used to monitor behaviors or data that threaten the security of the vehicle-mounted terminal. Exemplarily, the security monitoring program may refer to an extended Berkeley Packet Filter (eBPF) program.

[0047] In an embodiment of the present application, the function to be monitored corresponding to the preset security risk event can be determined first, and the parameters to be monitored under the function to be monitored, the filter for screening the preset security risk event, and the target action to be performed when the preset security risk event is triggered can be determined. Then, based on the function to be monitored, the parameters to be monitored, the filter and the target action, the monitoring rules are constructed. Finally, the established monitoring rules can be stored in a file, which is equivalent to the rule description of the security monitoring program. Taking the above example as an example, the following monitoring rules can be generated:

[0048] kprobes:

[0049] -call:"inet_bind";

[0050] syscall:false;

[0051] args:

[0052] -index:0;

[0053] type:"sock";

[0054] -index:1;

[0055] type: "sockaddr";

[0056] selectors:

[0057] -matchArgs:

[0058] -index:0;

[0059] operator:"Protocol";

[0060] values: "IPPROTO_IP";

[0061] matchBinaries:

[0062] -operator:"ln";

[0063] values: " / usr / bin / curl";

[0064] machActions:

[0065] -action:Sigkill.

[0066] In the above monitoring rules, inet_bind is the function to be monitored, the Selectors part is the filter, the filter sets the filtering conditions, and the parameters to be monitored include two parameters, which are the protocol type parameter 0 and the port binding information 1. " / usr / bin / curl" is the process name. The above monitoring rules can filter out the IP port binding behavior of curl and execute the Sigkill (process end) operation on the curl process that triggers the preset security risk event.

[0067] After establishing monitoring rules, you can write eBPF code according to the monitoring rules to generate a security monitoring program. Here, you can use eBPF's C language or other languages ​​supported by eBPF to write code. The written code can set the mount point in the vehicle terminal kernel, that is, set the inet_bind function entry, and define the inspection logic of the parameters to be monitored, define the event matching conditions and the response target action.

[0068] In step S102 , a security monitoring program is dynamically loaded and run in the vehicle terminal host kernel, so as to monitor currently loaded events in the vehicle terminal host kernel by using the security monitoring program.

[0069] In an embodiment of the present application, the target monitoring object may be one or more. When there are multiple target monitoring objects, the types of the multiple target monitoring objects may be different, for example: one of the target monitoring objects is network data, another target monitoring object is a process, and another target monitoring object is a file. Each target monitoring object corresponds to its own security monitoring program. When there are multiple target monitoring objects, a main monitoring program will be used as the entrance to multiple security monitoring programs to uniformly manage these security monitoring programs, and then the main monitoring program and multiple security monitoring programs will be loaded into the vehicle terminal host kernel by using the API provided by the bpf system call or the libbpf library. Among them, each eBPF security monitoring program is an independent host monitoring probe, and the main monitoring program is also an eBPF program.

[0070] After the security monitoring program is generated, the eBPF compiler is used to compile the security monitoring program into bytecode to load and run the bytecode in the vehicle terminal host kernel. The compiled bytecode is a low-level instruction set that can be loaded and executed by the kernel. The vehicle terminal host kernel uses the Linux operating system, and the generated security monitoring program can be mounted in the vehicle terminal host kernel to run the bytecode corresponding to the security monitoring program. In addition, the eBPF compiler can be an extension of Clang or a part of LLVM.

[0071] In addition, the eBPF bytecode corresponding to the security monitoring program can be loaded into the kernel of the vehicle terminal host by using the bpf system call or the API provided by the libbpf library in a multi-threaded concurrent manner. During the loading process, in addition to loading the bytecode of the eBPF program, the type and attachment point of the eBPF program must also be set. The type of the eBPF program can be BPF_PROG_TYPE_KPROBE or BPF_PROG_TYPE_UPROBE; the attachment point can refer to the address or name of the function to be monitored (such as inet_bind).

[0072] It should be noted that if you use the bpf_attach_kprobe function to load, you need to specify the name of the kernel probe (kprobe) to be attached and the ID of the eBPF program. In the above example, the name of the kernel probe is inet_bind, and the ID of the eBPF program is returned by the previous bpf system call function. In addition, the loading process also includes loading map objects used to transmit various rules and information. Map objects are an eBPF communication mechanism used to store and share data between eBPF programs and user space.

[0073] In an embodiment of the present application, after loading the security monitoring program, it is also possible to verify whether the security monitoring program has been successfully loaded and whether the monitored function has been successfully monitored by checking the system log or using a specific tool. The specific tool may be bpftrace or bpftool. If an error occurs during the loading process, such as insufficient memory, insufficient permissions, or the specified function does not exist, the corresponding error information may be obtained, and the eBPF program may be adjusted according to the error information.

[0074] After the safety monitoring program is successfully loaded and attached to the vehicle terminal host kernel, the main monitoring program and each safety monitoring program can be used to monitor the loaded events in the vehicle terminal host kernel.

[0075] Taking the preset security risk event as a port binding event as an example, after the vehicle terminal system is started, the user side loads the security monitoring program into the kernel and runs it through the system call program or the API provided by the libbpf library. At this time, the security monitoring program will continue to monitor the loaded events in the kernel. If a loaded event for port binding appears in the kernel, the security monitoring program will obtain the detailed context information corresponding to the current loaded event, which includes process information and permission information.

[0076] Then, the security monitoring program uses the filter to filter the currently loaded events to determine whether the currently loaded events meet the filtering conditions. For example, the process information of the currently loaded events is matched with the process information in the preset monitoring rule (" / usr / bin / curl"). If the match is successful, it is determined that the filtering conditions are met; if the match is unsuccessful, it is determined that the filtering conditions are not met, and the program returns to continue monitoring other loaded events in the kernel.

[0077] If the filtering conditions are met, the tail call function corresponding to the inet_bind function is entered to obtain the parameters and parameter types of the function to be monitored, and obtain the current event parameters corresponding to the currently loaded event, and then determine whether the current event parameters match the parameters to be monitored. Among them, the current event parameters include at least one current function parameter and / or current return parameter, and the parameters to be monitored include at least one preset function parameter and / or preset return parameter.

[0078] If the current event parameters include at least one current function parameter, and the parameters to be monitored include at least one preset function parameter, then determine in turn whether each current function parameter matches the corresponding preset function parameter, and if each current function parameter matches the corresponding preset function parameter, then determine that the current event parameters match the parameters to be monitored. For example: if there are three current function parameters, then match each function parameter in turn with the preset function parameter at the corresponding position, and when all current function parameters match the preset function parameters, then determine that the current event parameters match the parameters to be monitored.

[0079] If the current event parameters include the current return parameters and the parameters to be monitored include the preset return parameters, it is determined whether the current return parameters match the preset return parameters. If the current return parameters match the preset return parameters, it is determined that the current event parameters match the parameters to be monitored.

[0080] If the current event parameters include at least one current function parameter and a current return parameter, and the parameters to be monitored include at least one preset function parameter and a preset return parameter, then determine in turn whether each current function parameter matches the corresponding preset function parameter, and if each current function parameter matches the corresponding preset function parameter, then determine whether the current return parameter matches the preset return parameter. If the current return parameter matches the preset return parameter, then determine that the current event parameters match the parameters to be monitored.

[0081] If the current event parameters match the parameters to be monitored, it is determined that the currently loaded event matches the preset security risk event. If the current event parameters do not match the parameters to be monitored, it is determined that the currently loaded event does not match the preset security risk event, and returns to continue monitoring other loaded events in the kernel.

[0082] If the currently loaded event matches the preset security risk event, the event information of the currently recorded event is sent to the user space program for processing through the eBPF map mechanism.

[0083] In step S103, if the monitored currently loaded event matches the preset security risk event, the currently loaded event is processed according to the monitoring result.

[0084] In the embodiment of the present application, after receiving the time information of the currently loaded event, the user space program will generate a detailed security event log, which includes event time, type, involved processes, parameters, etc. At the same time, if the preset security risk event is set as a malicious operation in the monitoring rule, the currently loaded event will be processed according to the target action set in the monitoring rule, for example: immediately call the kernel function through the eBPF probe to prevent the execution of the malicious operation, and return after the processing is completed to continue monitoring the loaded events in the kernel.

[0085] Here, the monitoring rules can also be adjusted according to the monitoring results to generate new monitoring rules, and new security monitoring programs can be generated using the new monitoring rules to monitor the vehicle terminal host. For example, when the above malicious operation deletes files, it will also affect network data. Network data can be used as the target monitoring object, and new monitoring rules for network data can be added to the monitoring rules to monitor the preset security risk events under network data.

[0086] In addition, after collecting event information, you can also conduct statistical analysis on the collected event information to count the frequency and distribution of various security risk events. Then, use data analysis tools to conduct trend analysis on security risk events to predict potential security risks that may occur. Based on the statistical analysis results, generate a detailed security risk report, including security risk event overview, risk analysis, defense recommendations, etc., to provide to system administrators for reference.

[0087] It should be noted that in the entire monitoring and processing process, the monitoring data needs to be anonymized to ensure that user privacy is not leaked. Access to monitoring data is strictly controlled, and only authorized personnel can access sensitive data. At the same time, regular compliance audits are conducted to ensure that the monitoring system complies with the requirements of relevant laws and regulations, and potential privacy leakage risks are discovered and corrected in a timely manner.

[0088] Based on the same inventive concept, an on-board terminal host monitoring device corresponding to the on-board terminal host monitoring method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned on-board terminal host monitoring method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0089] See also Figure 2 , Figure 2 This is a schematic diagram of the structure of a vehicle terminal host monitoring device provided in an embodiment of the present application. Figure 2 As shown in , the vehicle terminal host monitoring device 200 includes:

[0090] A monitoring program generation module 201 is used to establish monitoring rules for monitoring preset security risk events for a target monitoring object, and to generate a security monitoring program according to the monitoring rules;

[0091] The event monitoring module 202 is used to dynamically load and run the security monitoring program in the vehicle terminal host kernel, so as to monitor the currently loaded events in the vehicle terminal host kernel by using the security monitoring program;

[0092] The event processing module 203 is used to process the currently loaded event according to the monitoring result if the monitored currently loaded event matches the preset security risk event.

[0093] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 3 As shown in , the electronic device 300 includes a processor 310 , a memory 320 and a bus 330 .

[0094] The memory 320 stores machine-readable instructions executable by the processor 310. When the electronic device 300 is running, the processor 310 communicates with the memory 320 via the bus 330. When the machine-readable instructions are executed by the processor 310, the above-mentioned Figure 1 The steps of the vehicle terminal host monitoring method in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0095] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 The steps of the vehicle terminal host monitoring method in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0096] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0097] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0098] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0099] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0100] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0101] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A vehicle terminal host monitoring method, characterized in that: include: Establishing monitoring rules for monitoring preset security risk events for target monitoring objects, and generating a security monitoring program according to the monitoring rules; Dynamically loading and running the security monitoring program in the vehicle terminal host kernel, so as to monitor currently loaded events in the vehicle terminal host kernel using the security monitoring program; If the monitored currently loaded event matches the preset security risk event, the currently loaded event is processed according to the monitoring result.

2. The method according to claim 1, characterized in that The step of establishing monitoring rules for monitoring preset security risk events for a target monitoring object includes: Determine the function to be monitored corresponding to the preset security risk event, the parameter to be monitored corresponding to the function to be monitored, the filter for screening the preset security risk event, and the target action to be performed when the preset security risk event is triggered; A monitoring rule is constructed based on the function to be monitored, the parameter to be monitored, the filter and the target action.

3. The method according to claim 2, characterized in that The currently loaded events in the vehicle terminal host kernel are monitored in the following manners, including: Filtering the currently loaded events using the filter to determine whether the currently loaded events meet the filtering conditions; If the filtering condition is met, the current event parameter corresponding to the currently loaded event is obtained, and it is determined whether the current event parameter matches the parameter to be monitored; If the current event parameter matches the parameter to be monitored, it is determined that the currently loaded event matches the preset security risk event.

4. The method according to claim 3, characterized in that: The current event parameters include at least one current function parameter and a current return parameter, the parameters to be monitored include at least one preset function parameter and a preset return parameter, and determining whether the current event parameters match the parameters to be monitored includes: Determine in turn whether each current function parameter matches the corresponding preset function parameter; If each current function parameter matches the corresponding preset function parameter, determining whether the current return parameter matches the preset return parameter; If the current return parameter matches the preset return parameter, it is determined that the current event parameter matches the parameter to be monitored.

5. The method according to claim 1, characterized in that The processing according to the monitoring result for the currently loaded event includes: Adjust the monitoring rules according to the monitoring results to generate new monitoring rules; The new monitoring rules are used to perform security monitoring on the vehicle-mounted terminal host.

6. The method according to claim 1, characterized in that After generating the security monitoring program according to the monitoring rules, the method further includes: The safety monitoring program is compiled into bytecodes, so as to load and run the bytecodes in the vehicle terminal host kernel.

7. The method according to claim 1, characterized in that The dynamically loading and running the security monitoring program in the vehicle terminal host kernel includes: The safety monitoring program is loaded into the vehicle terminal host kernel in a multi-threaded concurrent manner.

8. A vehicle terminal host monitoring device, characterized in that: include: A monitoring program generation module, used to establish monitoring rules for monitoring preset security risk events for target monitoring objects, and generate a security monitoring program according to the monitoring rules; An event monitoring module, used for dynamically loading and running the security monitoring program in the vehicle terminal host kernel, so as to monitor the currently loaded events in the vehicle terminal host kernel by using the security monitoring program; The event processing module is used to process the currently loaded event according to the monitoring result if the currently loaded event monitored matches the preset security risk event.

9. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the vehicle terminal host monitoring method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the vehicle terminal host monitoring method according to any one of claims 1 to 7 are executed.

Images