Automobile data transmission monitoring method and system

Abstract

The invention discloses an automobile data transmission monitoring method and system, and belongs to the field of automobile data transmission monitoring, and the method comprises the steps: scanning a data packet transmitted to the outside by an automobile in real time through an automobile end data transmission monitoring system, and analyzing the data packet to obtain automobile data transmission behavior characteristics; obtaining a first classification result according to the automobile data transmission behavior characteristics; according to the first classification result, the data packet is sent to a platform end data transmission monitoring system, and the platform end data transmission monitoring system analyzes the data packet and judges whether the data packet is an abnormal transmission data packet; according to the invention, the accuracy of identifying the data packet transmitted to the outside by the vehicle can be improved.

Description

Technical Field

[0001] The invention belongs to the field of automobile data transmission monitoring, and in particular relates to an automobile data transmission monitoring method and system. Background Art

[0002] There are two main traditional data transmission monitoring technologies. One is to test the data transmission equipment to verify the communication mode, transmission destination, data scale, usage scenario, data transmission protocol, encryption measures, etc. of the data transmission to ensure the security and compliance of the data during the transmission process; the other is to deploy transmission monitoring equipment on the enterprise computer room egress gateway to analyze and log the data packets, identify the data flow, transmission content and its compliance of the transmission through real-time monitoring of network traffic, record and analyze the log information of data transmission behavior, audit and manage the transmission, and alarm and block abnormal behavior. Both methods have great shortcomings in the scenario of vehicle-side data transmission monitoring. For the first method, a large amount of real-time data will be generated during the operation of the vehicle, and it often involves complex communication protocols and encryption technologies. The traditional equipment testing method may not be able to monitor and evaluate the data transmission situation in real time, and it is difficult to deeply analyze and verify. For the second method, the vehicle-side data may be directly transmitted without passing through the enterprise computer room egress gateway (such as through the vehicle-mounted satellite communication system), making it impossible for the monitoring equipment deployed on the gateway to capture and analyze these data. Summary of the invention

[0003] Based on the above problems, the present invention proposes a method for monitoring automobile data transmission, which specifically includes the following steps: S1. The vehicle-side data transmission monitoring system scans the data packets transmitted by the vehicle to the outside in real time; S2. The vehicle-side data transmission monitoring system parses each data packet scanned in real time to form a first parsed data packet for each data packet; S3. The vehicle-side data transmission monitoring system extracts the first analytical data from the vehicle data transmission behavior characteristics; S4. The vehicle-side data transmission monitoring system determines the type of data packet corresponding to the first parsed data according to the characteristics of the vehicle data transmission behavior; When the type of the data packet is a first type data packet, discarding the data packet; When the type of the data packet is a second type data packet, executing step S5; When the type of the data packet is a third type data packet, the first classification result of the data packet is set as an abnormal transmission data packet, and the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet are sent to the platform-side data transmission monitoring system, and step S6 is executed; S5. Input the vehicle data transmission behavior characteristics corresponding to the data packet into the vehicle-side feature model to obtain the first classification result of the data packet; Among them, the vehicle-side feature model is a neural network model; The first classification result includes: suspected abnormal transmission data packets, abnormal transmission data packets; Sending the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet to the platform-side data transmission monitoring system; Execute step S6; S6. The platform-side data transmission monitoring system inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the first classification result corresponding to the data packet into the platform-side feature model to obtain the second classification result of the data packet, and the platform-side data transmission monitoring system sends the second classification result of the data packet to the vehicle-side data transmission monitoring system; Among them, the platform-side feature model is a neural network model; The second classification result includes: a non-abnormal transmission data packet and an abnormal transmission data packet; When the second classification result of the data packet is a non-abnormal transmission data packet, executing step S7; When the second classification result of the data packet is an abnormal transmission data packet, executing step S8; S7. When the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the vehicle data transmission behavior characteristics corresponding to the data packet as negative samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the vehicle data transmission behavior characteristics corresponding to the data packet as negative samples. Both the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system store the data packet, the vehicle data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; When the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples; the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; The platform-side data transmission monitoring system shows no abnormal results for the data packet in the display interface; S8. When the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the vehicle data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the vehicle data transmission behavior characteristics corresponding to the data packet as escape samples; the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the vehicle data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; When the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior feature corresponding to the data packet as a positive sample, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior feature corresponding to the data packet as a positive sample. The platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior feature corresponding to the data packet, and the mark corresponding to the data packet; The platform-side data transmission monitoring system displays the data packet information of the abnormal transmission data packets in the second classification result in the form of a list in the interface.

[0004] The present invention also provides an automobile data transmission monitoring system, the system comprising a vehicle-side data transmission monitoring system and a platform-side data transmission monitoring system; The vehicle-side data transmission monitoring system scans the data packets transmitted by the vehicle to the outside in real time; The vehicle-side data transmission monitoring system analyzes each data packet scanned in real time to form first analysis data for each data packet; The vehicle-side data transmission monitoring system extracts the vehicle data transmission behavior characteristics in the first parsed data; The vehicle-side data transmission monitoring system determines the type of the data packet corresponding to the first parsed data according to the vehicle data transmission behavior characteristics; When the type of the data packet is a first type data packet, discarding the data packet; When the type of the data packet is a second type data packet, the automobile data transmission behavior characteristics corresponding to the data packet are input into the vehicle-side feature model to obtain a first classification result of the data packet; the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet are sent to the platform-side data transmission monitoring system; wherein the vehicle-side feature model is a neural network model; the first classification result includes: suspected abnormal transmission data packet, abnormal transmission data packet; When the type of the data packet is a third type data packet, the first classification result of the data packet is set as an abnormal transmission data packet, and the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet are sent to the platform-side data transmission monitoring system; The platform-side data transmission monitoring system inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the first classification result corresponding to the data packet into the platform-side feature model to obtain the second classification result of the data packet, and the platform-side data transmission monitoring system sends the second classification result of the data packet to the vehicle-side data transmission monitoring system; Among them, the platform-side feature model is a neural network model; The second classification result includes: a non-abnormal transmission data packet and an abnormal transmission data packet; When the second classification result of the data packet is a non-abnormal transmission data packet: when the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as negative samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as negative samples, and both the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; when the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples; both the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; the platform-side data transmission monitoring system displays that there is no abnormal result for the data packet in the display interface; When the second classification result of the data packet is an abnormal transmission data packet: when the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples; the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; when the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as positive samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as positive samples, and the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; the platform-side data transmission monitoring system displays the data packet information whose second classification result is an abnormal transmission data packet in a list form in the interface.

[0005] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above description and other purposes, features and advantages of the present invention more obvious and easy to understand, the preferred embodiments are specifically cited and described in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings: Figure 1 This is the structural diagram of the automobile data transmission monitoring system. DETAILED DESCRIPTION

[0007] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0008] In the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be connected, detachably connected, or integrated; it can be mechanically connected or electrically connected; it can be directly connected or indirectly connected through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0009] Example 1 The present invention provides a method for monitoring automobile data transmission, the method comprising the following steps: S1. The vehicle-side data transmission monitoring system scans the data packets transmitted by the vehicle to the outside in real time; S2. The vehicle-side data transmission monitoring system parses each data packet scanned in real time to form a first parsed data packet for each data packet; S3. The vehicle-side data transmission monitoring system extracts the first analytical data from the vehicle data transmission behavior characteristics; S4. The vehicle-side data transmission monitoring system determines the type of data packet corresponding to the first parsed data according to the characteristics of the vehicle data transmission behavior; When the type of the data packet is a first type data packet, discarding the data packet; When the type of the data packet is a second type data packet, executing step S5; When the type of the data packet is a third type data packet, the first classification result of the data packet is set as an abnormal transmission data packet, and the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet are sent to the platform-side data transmission monitoring system, and step S6 is executed; S5. Input the vehicle data transmission behavior characteristics corresponding to the data packet into the vehicle-side feature model to obtain the first classification result of the data packet; Among them, the vehicle-side feature model is a neural network model; The first classification result includes: suspected abnormal transmission data packets, abnormal transmission data packets; Sending the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet to the platform-side data transmission monitoring system; Execute step S6; S6. The platform-side data transmission monitoring system inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the first classification result corresponding to the data packet into the platform-side feature model to obtain the second classification result of the data packet, and the platform-side data transmission monitoring system sends the second classification result of the data packet to the vehicle-side data transmission monitoring system; Among them, the platform-side feature model is a neural network model; The second classification result includes: a non-abnormal transmission data packet and an abnormal transmission data packet; When the second classification result of the data packet is a non-abnormal transmission data packet, executing step S7; When the second classification result of the data packet is an abnormal transmission data packet, executing step S8; S7. When the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the vehicle data transmission behavior characteristics corresponding to the data packet as negative samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the vehicle data transmission behavior characteristics corresponding to the data packet as negative samples. Both the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system store the data packet, the vehicle data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; When the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples; the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; The platform-side data transmission monitoring system shows no abnormal results for the data packet in the display interface; S8. When the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the vehicle data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the vehicle data transmission behavior characteristics corresponding to the data packet as escape samples; the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the vehicle data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; When the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior feature corresponding to the data packet as a positive sample, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior feature corresponding to the data packet as a positive sample. The platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior feature corresponding to the data packet, and the mark corresponding to the data packet; The platform-side data transmission monitoring system displays the data packet information of the abnormal transmission data packets in the second classification result in the form of a list in the interface.

[0010] Furthermore, the first parsed data in step S2 includes: {{data type ,Data volume ,Data Source }, {Data type ,Data volume ,Data Source } …{data type ,Data volume ,Data Source }, data transmission destination M, data transmission protocol C, current time T, total data volume Z, vehicle model}; Among them, {data type ,Data volume ,Data Source } is the nth data type in the first parsed data All corresponding data information; n is the total number of data types contained in the first parsed data; when the first parsed data corresponding to the data packet does not contain the data type, set the data type, data volume, and data source to empty; data type is the name of the data; the amount of data The data type in the packet Amount of data; Data source The data type in the packet The source component or acquisition terminal name of the data packet; the data transmission destination M is the destination to which the data packet is transmitted; the data transmission protocol C is the name of the protocol used to transmit the data packet; the current time T is the time when the vehicle transmits the data packet to the outside, and the total data volume is the data volume of the data packet corresponding to the first parsed data; Among them, the data type can be divided into: a first data type and a second data type; The first data type is private data, and the second data type is non-private data.

[0011] Furthermore, the step S3 specifically includes the following steps: S31. The vehicle-side data transmission monitoring system determines the category of each data type in the first parsed data, and calculates the proportion r of the first data type in the first parsed data; The categories of the data types include: first data type and second data type; r= ; S33. The vehicle-side data transmission monitoring system counts the sum of the data volume of the first data type , and calculate the sum of the data volume The proportion f of the total data volume Z in the first parsed data; f= ; S34. The vehicle-side data transmission monitoring system determines whether the data transmission protocol C in the first parsed data exists in the first transmission protocol list. If so, the data transmission protocol flag b is set to a non-abnormal transmission protocol; if not, the data transmission protocol flag is set to an abnormal transmission protocol; The data transmission protocol flag b includes: abnormal transmission protocol and non-abnormal transmission protocol; the first transmission protocol list is stored in the vehicle-side data transmission monitoring system; the first transmission protocol list stores all non-abnormal transmission protocol names; S35. The vehicle-side data transmission monitoring system obtains the first N packets of the data packet corresponding to the first parsed data, and obtains the current time sequence corresponding to the first N packets { ,…, }, and the sum g of the data volume of the first data type corresponding to each data packet in the first N data packets, to obtain the data volume sequence of the first data type { ,…, }; in, The current time corresponding to the previous data packet corresponding to the first parsed data; The current time corresponding to the first N data packets of the data packet corresponding to the first parsed data; The sum of the data amounts of the first data type corresponding to the previous data packet corresponding to the first parsed data; The sum of the data amounts of the first data type corresponding to the first N data packets of the data packet corresponding to the first parsed data; S36. Calculate the average time difference in the current time sequence ; ; S37. The sum of the proportion r of the first data type in the first parsed data and the amount of data of the first data type , percentage f, data transmission protocol flag b, current time sequence { …, }、Data quantity sequence of the first data type { …, }、Time difference average , the data transmission destination M is used as the automobile data transmission behavior feature in the first parsed data.

[0012] Furthermore, the step S4 specifically includes the following steps: S41. When the data transmission destination M does not exist in the first data transmission destination list, and the proportion r of the first data type is greater than a preset threshold When the data packet is set to the third type of data packet; Alternatively, when the data transmission destination M does not exist in the first data transmission destination list, and the category is the sum of the data amounts of the first data type Greater than the preset threshold When the data packet is set to the third type of data packet; Alternatively, when the data transmission destination M does not exist in the first data transmission destination list, and the proportion f is greater than a preset threshold When the data packet is set to the third type of data packet; Wherein, the first data transmission destination list is stored in the vehicle-side data transmission monitoring system, and the first data transmission destination list stores a plurality of non-abnormal data transmission destinations; S42. When the data transmission destination M exists in the first data transmission destination list, and the data transmission protocol flag b is an abnormal transmission protocol, the type of the data packet is set to the second type of data packet; Alternatively, when the data transmission destination M exists in the first data transmission destination list and the average time difference Less than the preset threshold When the data packet is set to the second type of data packet; Or, with the current time sequence { …, } are the horizontal coordinates, with the data amount sequence of the first data type { …, } are the vertical coordinates, with {( , ),( , )…,( , )} is a coordinate point in a two-dimensional coordinate system, and a coordinate point {( , ),( , )…,( , )}, and use the curve S as the curve corresponding to the data packet; Get the curves corresponding to all positive samples in the vehicle-side data transmission monitoring system ( … ), Pearson correlation coefficient algorithm was used to calculate S and ( … ) similarity, and obtain K similarity values ​​( … ); When the data transmission destination M exists in the first data transmission destination list, and the K similarity values ​​( … ) has any similarity value greater than the preset threshold When the data packet is set to the second type of data packet; S43. When the data packet is not set as a third type data packet or a second type data packet, set the data packet as a first type data packet.

[0013] Furthermore, in step S6, before the platform-side data transmission monitoring system inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the classification result corresponding to the data packet into the platform-side feature model, the platform-side data transmission monitoring system further performs the following steps: S601. The platform-side data transmission monitoring system selects all positive samples with the same vehicle model from the positive samples stored in the platform-side data transmission monitoring system according to the vehicle model in the data packet; S602. Obtain the data transmission destination M in the vehicle data transmission behavior characteristics corresponding to the data packet, the proportion r of the first data type in the first parsed data, and the average time difference ; S603. Filter out all positive samples with the same data transmission destination M as in step S602 from all positive samples with the same vehicle model obtained in step S601; S604. Obtain the automobile data transmission behavior feature corresponding to each positive sample in all positive samples with the same data transmission destination M as the step S602 in step S603, and extract the proportion of the first data type and the average time difference in the automobile data transmission behavior feature; S605. Calculate the similarity between the data packet and the positive sample ; in, ;in, and are respectively the proportion of the first data type in the first parsed data in the automobile data transmission behavior characteristics corresponding to the positive samples and the average time difference; , are the first weight value and the second weight value respectively; S606. For all positive samples in step S603, step S605 is executed to obtain the similarity between the data packet and each positive sample, and the maximum value of the similarity is obtained; When the maximum value of the similarity is greater than the preset threshold When the platform-side data transmission monitoring system inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the first classification result corresponding to the data packet into the first platform-side feature model; When the maximum value of the similarity is less than or equal to the preset threshold When the data transmission monitoring system on the platform side inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the first classification result corresponding to the data packet into the second platform side feature model; The first platform-side feature model is a neural network model corresponding to the vehicle model in the data packet; The second platform-side feature model is a neural network model corresponding to all vehicle models; Among them, the platform-side feature model in the platform-side data transmission monitoring system includes V first platform-side feature models and 1 second platform-side feature model; V is the total number of vehicle models included in the platform-side data transmission monitoring system.

[0014] Furthermore, the vehicle-side feature model is composed of a data packet collected at the vehicle-side and a vehicle data transmission behavior feature corresponding to the data packet to form a training sample, the training sample is divided into a positive sample and a negative sample, and the vehicle-side feature model is obtained by training the multiple positive samples and the multiple negative samples; The first platform-side feature model is obtained by training a plurality of positive samples and negative samples corresponding to a vehicle model on the platform side; the positive samples and negative samples both contain a data packet corresponding to the vehicle model and a vehicle data transmission behavior feature corresponding to the data packet; The second platform-side feature model is obtained by training multiple positive samples and negative samples of all vehicle models on the platform side; the positive samples and negative samples both contain a data packet corresponding to the vehicle model and a vehicle data transmission behavior feature corresponding to the data packet.

[0015] Furthermore, the step S8 further includes: The vehicle-side data transmission monitoring system updates the vehicle-side feature model using the escape sample at fixed intervals; The platform-side data transmission monitoring system uses the escape sample to update the first platform-side feature model and the second platform-side feature model at fixed intervals.

[0016] Embodiment 2 The present invention provides an automobile data transmission monitoring system, the system comprising a vehicle-side data transmission monitoring system and a platform-side data transmission monitoring system; The vehicle-side data transmission monitoring system scans the data packets transmitted by the vehicle to the outside in real time; The vehicle-side data transmission monitoring system analyzes each data packet scanned in real time to form first analysis data for each data packet; The vehicle-side data transmission monitoring system extracts the vehicle data transmission behavior characteristics in the first parsed data; The vehicle-side data transmission monitoring system determines the type of the data packet corresponding to the first parsed data according to the vehicle data transmission behavior characteristics; When the type of the data packet is a first type data packet, discarding the data packet; When the type of the data packet is a second type data packet, the automobile data transmission behavior characteristics corresponding to the data packet are input into the vehicle-side feature model to obtain a first classification result of the data packet; the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet are sent to the platform-side data transmission monitoring system; wherein the vehicle-side feature model is a neural network model; the first classification result includes: suspected abnormal transmission data packet, abnormal transmission data packet; When the type of the data packet is a third type data packet, the first classification result of the data packet is set as an abnormal transmission data packet, and the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet are sent to the platform-side data transmission monitoring system; The platform-side data transmission monitoring system inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the first classification result corresponding to the data packet into the platform-side feature model to obtain the second classification result of the data packet, and the platform-side data transmission monitoring system sends the second classification result of the data packet to the vehicle-side data transmission monitoring system; Among them, the platform-side feature model is a neural network model; The second classification result includes: a non-abnormal transmission data packet and an abnormal transmission data packet; When the second classification result of the data packet is a non-abnormal transmission data packet: when the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as negative samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as negative samples, and both the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; when the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples; both the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; the platform-side data transmission monitoring system displays that there is no abnormal result for the data packet in the display interface; When the second classification result of the data packet is an abnormal transmission data packet: when the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples; the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; when the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as positive samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as positive samples, and the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; the platform-side data transmission monitoring system displays the data packet information whose second classification result is an abnormal transmission data packet in a list form in the interface.

[0017] The vehicle data transmission monitoring system executes a vehicle data transmission monitoring method in the first embodiment.

[0018] The beneficial effects of the present invention are as follows: 1) The present invention monitors and analyzes data packets transmitted from the vehicle end to the outside by setting up a vehicle-end data transmission monitoring system and a platform-end data transmission monitoring system, thereby realizing effective identification and early warning of abnormal data packet transmission.

[0019] 2) In the vehicle-side data transmission monitoring system, the present invention extracts the characteristics of automobile data transmission behavior from data packets, and adopts a method of first classifying the data packets and then performing neural network model classification operations on the data packets to make a preliminary judgment on the abnormal situation of the data packets, thereby improving the accuracy of judging the abnormal transmission behavior of the data packets; 3) The present invention uses the current time sequence { …, }、Data quantity sequence of the first data type { …, } as horizontal and vertical coordinates respectively, and the Pearson correlation coefficient algorithm is used for calculation, which improves the accuracy of data packet classification; 4) In the platform data transmission monitoring system of the present invention, the same vehicle model similarity calculation method and the first platform-side feature model and the second platform-side feature model are used to analyze and calculate the abnormal transmission of data packets, thereby improving the accuracy of judging the data packet transmission behavior.

[0020] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for monitoring automobile data transmission, characterized in that: The method comprises the following steps: S1. The vehicle-side data transmission monitoring system scans the data packets transmitted by the vehicle to the outside in real time; S2. The vehicle-side data transmission monitoring system parses each data packet scanned in real time to form a first parsed data packet for each data packet; S3. The vehicle-side data transmission monitoring system extracts the first analytical data from the vehicle data transmission behavior characteristics; S4. The vehicle-side data transmission monitoring system determines the type of data packet corresponding to the first parsed data based on the vehicle data transmission behavior characteristics.

2. The method according to claim 1, characterized in that: The method further comprises the steps of: When the type of the data packet is a first type data packet, discarding the data packet; When the type of the data packet is a second type data packet, executing step S5; When the type of the data packet is a third type data packet, the first classification result of the data packet is set as an abnormal transmission data packet, and the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet are sent to the platform-side data transmission monitoring system, and step S6 is executed; S5. Inputting the vehicle data transmission behavior characteristics corresponding to the data packet into the vehicle-side feature model to obtain the first classification result of the data packet; Among them, the vehicle-side feature model is a neural network model; The first classification result includes: suspected abnormal transmission data packets, abnormal transmission data packets; Sending the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the first classification result corresponding to the data packet to the platform-side data transmission monitoring system; Execute step S6; S6. The platform-side data transmission monitoring system inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the first classification result corresponding to the data packet into the platform-side feature model to obtain the second classification result of the data packet, and the platform-side data transmission monitoring system sends the second classification result of the data packet to the vehicle-side data transmission monitoring system; Among them, the platform-side feature model is a neural network model; The second classification result includes: a non-abnormal transmission data packet and an abnormal transmission data packet; When the second classification result of the data packet is a non-abnormal transmission data packet, executing step S7; When the second classification result of the data packet is an abnormal transmission data packet, executing step S8; S7. When the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the vehicle data transmission behavior feature corresponding to the data packet as a negative sample, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the vehicle data transmission behavior feature corresponding to the data packet as a negative sample. Both the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system store the data packet, the vehicle data transmission behavior feature corresponding to the data packet, and the mark corresponding to the data packet; When the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples; the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; The platform-side data transmission monitoring system shows no abnormal results for the data packet in the display interface; S8. When the first classification result of the data packet is a suspected abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior characteristics corresponding to the data packet as escape samples; the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system both store the data packet, the automobile data transmission behavior characteristics corresponding to the data packet, and the mark corresponding to the data packet; When the first classification result of the data packet is an abnormal transmission data packet, the platform-side data transmission monitoring system marks the data packet and the automobile data transmission behavior feature corresponding to the data packet as a positive sample, and notifies the vehicle-side data transmission monitoring system to mark the data packet and the automobile data transmission behavior feature corresponding to the data packet as a positive sample, and both the platform-side data transmission monitoring system and the vehicle-side data transmission monitoring system store the data packet, the automobile data transmission behavior feature corresponding to the data packet, and the mark corresponding to the data packet; The platform-side data transmission monitoring system displays the data packet information of the abnormal transmission data packets in the second classification result in the form of a list in the interface.

3. The method according to claim 2, characterized in that The first parsed data in step S2 includes: {{data type ,Data volume ,Data Source }, {Data type ,Data volume ,Data Source } …{data type ,Data volume ,Data Source }, data transmission destination M, data transmission protocol C, current time T, total data volume Z, vehicle model}; Among them, {data type ,Data volume ,Data Source } is the nth data type in the first parsed data corresponding to all data information; n is the total number of data types contained in the first parsed data; when the first parsed data corresponding to the data packet does not contain the data type, the data type, data volume, and data source are set to empty; data type is the name of the data; the amount of data The data type in the data packet Amount of data; Data source The data type in the data packet The source component or collection terminal name; the data transmission destination M is the destination to which the data packet is transmitted; the data transmission protocol C is the name of the protocol used to transmit the data packet; the current time T is the time when the vehicle transmits the data packet to the outside, and the total data volume is the data volume of the data packet corresponding to the first parsed data; Among them, the data type can be divided into: a first data type and a second data type.

4. The method according to claim 3, characterized in that The step S3 specifically includes the following steps: S31. The vehicle-side data transmission monitoring system determines the category of each data type in the first parsed data, and calculates the proportion r of the first data type in the first parsed data; The categories of the data types include: first data type and second data type; r= ； S33. The vehicle-side data transmission monitoring system counts the sum of the data volume of the first data type , and calculate the sum of the data volume The proportion f of the total data volume Z in the first parsed data; f= ； S34. The vehicle-side data transmission monitoring system determines whether the data transmission protocol C in the first parsed data exists in the first transmission protocol list. If so, the data transmission protocol flag b is set to a non-abnormal transmission protocol; if not, the data transmission protocol flag is set to an abnormal transmission protocol; The data transmission protocol flag b includes: abnormal transmission protocol and non-abnormal transmission protocol; the first transmission protocol list is stored in the vehicle-side data transmission monitoring system; the first transmission protocol list stores all non-abnormal transmission protocol names; S35. The vehicle-side data transmission monitoring system obtains the first N packets of the data packet corresponding to the first parsed data, and obtains the current time sequence corresponding to the first N packets { …, }, and the sum g of the data volume of the first data type corresponding to each data packet in the first N data packets, to obtain the data volume sequence of the first data type { …, }; in, The current time corresponding to the previous data packet corresponding to the first parsed data; The current time corresponding to the first N data packets of the data packet corresponding to the first parsed data; The sum of the data amounts of the first data type corresponding to the previous data packet corresponding to the first parsed data; The sum of the data amounts of the first data type corresponding to the first N data packets of the data packet corresponding to the first parsed data; S36. Calculate the average time difference in the current time sequence ; ； S37. The sum of the proportion r of the first data type in the first parsed data and the amount of data of the first data type , percentage f, data transmission protocol flag b, current time sequence { …, }、Data quantity sequence of the first data type { …, }、Time difference average , the data transmission destination M is used as the automobile data transmission behavior feature in the first parsed data.

5. The method according to claim 4, characterized in that The step S4 specifically includes the following steps: S41. When the data transmission destination M does not exist in the first data transmission destination list, and the proportion r of the first data type is greater than a preset threshold When the data packet is set to be a third type of data packet; Alternatively, when the data transmission destination M does not exist in the first data transmission destination list, and the category is the sum of the data amounts of the first data type Greater than the preset threshold When the data packet is set to be a third type of data packet; Alternatively, when the data transmission destination M does not exist in the first data transmission destination list, and the proportion f is greater than a preset threshold When the data packet is set to be a third type of data packet; Wherein, the first data transmission destination list is stored in the vehicle-side data transmission monitoring system, and the first data transmission destination list stores a plurality of non-abnormal data transmission destinations; S42. When the data transmission destination M exists in the first data transmission destination list, and the data transmission protocol flag b is an abnormal transmission protocol, the type of the data packet is set to the second type of data packet; Alternatively, when the data transmission destination M exists in the first data transmission destination list and the average time difference Less than the preset threshold When the data packet is set to be a second type data packet; Or, with the current time sequence { …, } are the horizontal coordinates, with the data amount sequence of the first data type { …, } are the vertical coordinates, with {( , ),( , )…,( , )} is a coordinate point in a two-dimensional coordinate system, and a coordinate point {( , ),( , )…,( , )}, and taking the curve S as the curve corresponding to the data packet; Get the curves corresponding to all positive samples in the vehicle-side data transmission monitoring system ( … ), Pearson correlation coefficient algorithm was used to calculate S and ( …, ) similarity, and obtain K similarity values ​​( … ); When the data transmission destination M exists in the first data transmission destination list, and the K similarity values ​​( … ) has any similarity value greater than the preset threshold When the data packet is set to be a second type data packet; S43. When the data packet is not set as a third type data packet or a second type data packet, set the data packet as a first type data packet.

6. The method according to claim 5, characterized in that In step S6, before the platform-side data transmission monitoring system inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the classification result corresponding to the data packet into the platform-side feature model, the platform-side data transmission monitoring system further performs the following steps: S601. The platform-side data transmission monitoring system selects all positive samples with the same vehicle model from the positive samples stored in the platform-side data transmission monitoring system according to the vehicle model in the data packet; S602. Obtain the data transmission destination M in the vehicle data transmission behavior characteristics corresponding to the data packet, the proportion r of the first data type in the first parsed data, and the average time difference ; S603. Filter out all positive samples with the same data transmission destination M in step S602 from all positive samples with the same vehicle model obtained in step S601; S604. Obtain the automobile data transmission behavior feature corresponding to each positive sample in all positive samples with the same data transmission destination M as the step S602 in step S603, and extract the proportion of the first data type and the average time difference in the automobile data transmission behavior feature; S605. Calculate the similarity between the data packet and the positive sample ; in, ;in, and are respectively the proportion of the first data type in the first parsed data in the automobile data transmission behavior characteristics corresponding to the positive samples and the average time difference; , are the first weight value and the second weight value respectively; S606. For all positive samples in step S603, step S605 is executed to obtain the similarity between the data packet and each positive sample, and the maximum value of the similarity is obtained; When the maximum value of the similarity is greater than the preset threshold When the platform-side data transmission monitoring system inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the first classification result corresponding to the data packet into the first platform-side feature model; When the maximum value of the similarity is less than or equal to the preset threshold When the data transmission monitoring system on the platform side inputs the automobile data transmission behavior characteristics corresponding to the received data packet and the first classification result corresponding to the data packet into the second platform side feature model; The first platform-side feature model is a neural network model corresponding to the vehicle model in the data packet; The second platform-side feature model is a neural network model corresponding to all vehicle models; Among them, the platform-side feature model in the platform-side data transmission monitoring system includes V first platform-side feature models and 1 second platform-side feature model; V is the total number of vehicle models included in the platform-side data transmission monitoring system.

7. The method according to claim 6, characterized in that The vehicle-side feature model is composed of a data packet collected at the vehicle-side and a vehicle data transmission behavior feature corresponding to the data packet, forming a training sample, wherein the training sample is divided into a positive sample and a negative sample, and the vehicle-side feature model is obtained by training the multiple positive samples and the multiple negative samples; The first platform-side feature model is obtained by training a plurality of positive samples and negative samples corresponding to a vehicle model on the platform side; the positive samples and negative samples both contain a data packet corresponding to the vehicle model and a vehicle data transmission behavior feature corresponding to the data packet; The second platform-side feature model is obtained by training multiple positive samples and negative samples of all vehicle models on the platform side; the positive samples and negative samples both contain data packets corresponding to the vehicle model and automobile data transmission behavior characteristics corresponding to the data packets.

8. The method according to claim 6, characterized in that The step S8 further comprises: The vehicle-side data transmission monitoring system updates the vehicle-side feature model using the escape sample at fixed intervals; The platform-side data transmission monitoring system uses the escape sample to update the first platform-side feature model and the second platform-side feature model at fixed intervals.

9. An automobile data transmission monitoring system, characterized in that: The system includes a vehicle-side data transmission monitoring system and a platform-side data transmission monitoring system; The vehicle-side data transmission monitoring system scans the data packets transmitted by the vehicle to the outside in real time; The vehicle-side data transmission monitoring system analyzes each data packet scanned in real time to form first analysis data for each data packet; The vehicle-side data transmission monitoring system extracts the vehicle data transmission behavior characteristics in the first parsed data; The vehicle-side data transmission monitoring system determines the type of data packet corresponding to the first parsed data based on the vehicle data transmission behavior characteristics.

Images