Data processing method and device of vehicle network security monitoring system, storage medium and vehicle

Abstract

The invention discloses a data processing method and device of a vehicle network security monitoring system, a storage medium and a vehicle wherein the vehicle network security monitoring system comprises a log acquisition unit, a log analysis unit and a log enrichment unit. The data processing method of the vehicle network security monitoring system comprises the following steps: acquiring vehicle end log data through a log acquisition unit; analyzing the vehicle end log data through a log analysis unit to obtain analyzed vehicle end log data; and performing multi-dimensional data enrichment on the analyzed data of the vehicle end log through a log enrichment unit to obtain the data of the vehicle end log after enrichment, and monitoring the vehicle network security according to the data of the vehicle end log after enrichment. Therefore, through comprehensive acquisition, deep analysis and multi-dimensional enrichment of the vehicle end log data, accurate monitoring and early warning of vehicle network security can be realized, and the overall security protection level is significantly improved.

Description

Technical Field

[0001] The present invention relates to the field of vehicle network security technology, and in particular to a data processing method for a vehicle network security monitoring system, a computer-readable storage medium, a data processing device for a vehicle network security monitoring system, and a vehicle. Background Art

[0002] At present, the methods used in the field of automotive network security incident monitoring and analysis have become increasingly limited in the face of increasingly complex and changing network threats. In terms of data collection and aggregation, existing systems mostly rely on single or limited log collection tools. Although these tools are effective in processing structured data, they are unable to cope with the widespread semi-structured and unstructured data, which seriously restricts the comprehensiveness of data collection. In addition, the inconsistency of data formats has brought huge challenges to subsequent security analysis.

[0003] In addition, in the data preprocessing and enrichment stage, the relevant systems often only stay at the basic data cleaning and conversion level, lacking in-depth data mining and enhancement processing. In particular, key information such as IP addresses are usually only processed as ordinary text, and fail to be further converted into information with higher analytical value such as geographic location; at the same time, the association mechanism between log events and key data such as asset information and real-time threat intelligence is not sound, which seriously limits the depth and breadth of security analysis. These deficiencies are particularly obvious when dealing with complex network attacks, making it difficult to quickly and accurately identify potential threats, which in turn affects the timeliness and accuracy of security incident warning and response. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems in the related art to a certain extent. To this end, the first purpose of the present invention is to propose a data processing method for a vehicle network security monitoring system, which can achieve accurate monitoring and early warning of vehicle network security through comprehensive collection, in-depth analysis and multi-dimensional enrichment of vehicle-side log data, and significantly improve the overall safety protection level.

[0005] A second object of the present invention is to provide a computer-readable storage medium.

[0006] The third object of the present invention is to provide a data processing device for a vehicle network security monitoring system.

[0007] A fourth object of the present invention is to provide a vehicle.

[0008] In order to achieve the above-mentioned purpose, an embodiment of the first aspect of the present invention proposes a data processing method for a vehicle network security monitoring system, wherein the vehicle network monitoring system includes a log collection unit, a log parsing unit and a log enrichment unit, and the method includes: obtaining vehicle-side log data through the log collection unit; parsing the vehicle-side log data through the log parsing unit to obtain vehicle-side log parsed data; performing multi-dimensional data enrichment on the vehicle-side log parsed data through the log enrichment unit to obtain vehicle-side log enriched data, and monitoring the vehicle network security based on the vehicle-side log enriched data.

[0009] According to the data processing method of the vehicle network security monitoring system of the embodiment of the present invention, the vehicle-side log data can be obtained through the log collection unit, and the vehicle-side log data can be parsed through the log parsing unit to obtain the parsed vehicle-side log data, and the parsed vehicle-side log data can be enriched with multi-dimensional data through the log enrichment unit to obtain the enriched vehicle-side log data, and then the vehicle network security can be monitored based on the enriched vehicle-side log data. Therefore, by comprehensively collecting, deeply parsing and multi-dimensionally enriching the vehicle-side log data, accurate monitoring and early warning of vehicle network security can be achieved, significantly improving the overall safety protection level.

[0010] In addition, the data processing method of the vehicle network security monitoring system according to the above embodiment of the present invention may also include the following additional technical features:

[0011] According to an embodiment of the present invention, the log data includes: a security log, a traffic log, a security threat log, an audit log, a system audit log and a system security log.

[0012] According to one embodiment of the present invention, the obtaining of vehicle-side log parsed data includes: parsing the vehicle-side log data into multiple log information fields using preset parsing rules; reading a field mapping file; converting the multiple log information fields according to the field mapping file to obtain log entries corresponding to each log information field; generating an event ID for the log entry corresponding to each log information field; obtaining asset data associated with the log entry corresponding to each log information field; and using the log event corresponding to the event ID and the asset data as the vehicle-side log parsed data.

[0013] According to one embodiment of the present invention, the multi-dimensional data enrichment includes: asset information enrichment, rule label enrichment, IP location information enrichment, threat intelligence information enrichment, vulnerability information enrichment and terminal device operation information enrichment.

[0014] According to one embodiment of the present invention, multi-dimensional data enrichment is performed on the parsed data of the vehicle-side log, including: using the asset data to enrich the asset information of the log event corresponding to the event ID; using the preset data in the rule label library to enrich the rule label of the log event corresponding to the event ID; using the preset data in the IP positioning library to enrich the IP positioning information of the log event corresponding to the event ID; using the preset data in the threat intelligence library to enrich the threat intelligence information of the log event corresponding to the event ID; using the preset data in the security vulnerability library to enrich the vulnerability information of the log event corresponding to the event ID; and using the preset data in the equipment monitoring database to enrich the terminal equipment operation information of the log event corresponding to the event ID.

[0015] According to one embodiment of the present invention, monitoring the vehicle network security based on the enriched data of the vehicle-side log includes: analyzing the enriched data of the vehicle-side log using an analysis rule engine to identify potential security threats in the vehicle network.

[0016] According to one embodiment of the present invention, the method further includes: storing the vehicle-side log parsed data and / or the vehicle-side log enriched data through a database client or an ORM tool.

[0017] In order to achieve the above-mentioned objectives, an embodiment of the second aspect of the present invention proposes a computer-readable storage medium, on which a data processing program of a vehicle network security monitoring system is stored. When the data processing program of the vehicle network security monitoring system is executed by a processor, the data processing method of the vehicle network security monitoring system of the aforementioned embodiment of the present invention is implemented.

[0018] According to the computer-readable storage medium of the embodiment of the present invention, the data processing program of the vehicle network security monitoring system is executed by the processor. Through the comprehensive collection, in-depth analysis and multi-dimensional enrichment of vehicle-side log data, accurate monitoring and early warning of vehicle network security can be achieved, which significantly improves the overall safety protection level.

[0019] In order to achieve the above-mentioned purpose, the third aspect embodiment of the present invention proposes a data processing device of a vehicle network security monitoring system, wherein the vehicle network monitoring system includes a log collection unit, a log parsing unit and a log enrichment unit, and the device includes: an acquisition module, used to obtain vehicle-side log data through the log collection unit; a parsing module, used to parse the vehicle-side log data through the log parsing unit to obtain vehicle-side log parsed data; a processing module, used to perform multi-dimensional data enrichment on the vehicle-side log parsed data through the log enrichment unit, obtain vehicle-side log enriched data, and monitor vehicle network security based on the vehicle-side log enriched data.

[0020] According to the data processing device of the vehicle network security monitoring system of the embodiment of the present invention, the acquisition module can obtain the vehicle-side log data through the log acquisition unit, and analyze the vehicle-side log data through the log analysis unit according to the analysis module to obtain the vehicle-side log analysis data, and the processing module can enrich the vehicle-side log analysis data through the log enrichment unit to obtain the vehicle-side log enriched data, and then monitor the vehicle network security according to the vehicle-side log enriched data. Therefore, through comprehensive collection, in-depth analysis and multi-dimensional enrichment of vehicle-side log data, accurate monitoring and early warning of vehicle network security can be achieved, significantly improving the overall safety protection level.

[0021] In order to achieve the above-mentioned purpose, a fourth aspect of the present invention provides a vehicle, including a data processing device of the vehicle network security monitoring system of the aforementioned embodiment of the present invention.

[0022] According to the vehicle of the embodiment of the present invention, by adopting the data processing device of the vehicle network security monitoring system and by comprehensively collecting, deeply analyzing and multi-dimensionally enriching the vehicle-side log data, accurate monitoring and early warning of vehicle network security can be achieved, thereby significantly improving the overall safety protection level.

[0023] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is a flow chart of a data processing method of a vehicle network security monitoring system according to an embodiment of the present invention;

[0025] Figure 2 is a flow chart of a data processing method of a vehicle network security monitoring system according to another embodiment of the present invention;

[0026] Figure 3 is a flow chart of a data processing method of a vehicle network security monitoring system according to a specific embodiment of the present invention;

[0027] Figure 4 is a block diagram of a data processing device of a vehicle network security monitoring system according to an embodiment of the present invention;

[0028] Figure 5 is a block diagram of a vehicle according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0030] The following describes a data processing method for a vehicle network security monitoring system, a computer-readable storage medium, a data processing device for a vehicle network security monitoring system, and a vehicle according to embodiments of the present invention with reference to the accompanying drawings.

[0031] Figure 1 It is a flow chart of a data processing method of a vehicle network security monitoring system according to an embodiment of the present invention.

[0032] Specifically, in some embodiments of the present invention, the vehicle network monitoring system includes a log collection unit, a log parsing unit and a log enrichment unit, such as Figure 1 As shown, the data processing method of the vehicle network security monitoring system includes:

[0033] S101, obtaining vehicle-side log data through a log collection unit.

[0034] Specifically, in this embodiment, the vehicle-side log data includes security logs, traffic logs, security threat logs, audit logs, system audit logs, and system security logs, etc. In addition, the present invention may not specifically limit the types contained in the vehicle-side log data. Filebeat, Fluentd, Logstash and other log collection tools are provided in the log collection unit, and then the security logs, traffic logs, security threat logs, audit logs, system audit logs, and system security logs are obtained from security modules such as IDS, firewalls, EDR, and CANIDS through log collection tools such as Filebeat, Fluentd, and Logstash. In addition, the present invention may not specifically limit the method of obtaining vehicle-side log data.

[0035] It should be noted that before obtaining the vehicle-side log data through the log collection unit, it is also possible to dynamically screen and filter out log data that complies with specific security policies or abnormal behaviors based on predefined rule sets for further security analysis and response. These rule sets usually include conditions for identifying potential security threats, malicious activities, or conditions that do not conform to normal operating modes. In addition, the captured vehicle-side log data can be converted and processed according to preset format templates, thereby converting unstructured and differently formatted log data into structured and standardized log data, thereby greatly improving the efficiency and accuracy of subsequent analysis work.

[0036] S102, parsing the vehicle-side log data through a log parsing unit to obtain the parsed vehicle-side log data.

[0037] Specifically, in this embodiment, after the vehicle-side log data is obtained, the vehicle-side log data will be sent to the log parsing unit, and then data decoupling, asynchronous processing, data buffering and peak shaving will be realized through Kafka in the log parsing unit, and Kafka Streams or Spring Kafka will be used to read the processed vehicle-side log data in Kafka, so as to use regular expressions, JSON parsers or custom parsing logic to parse the processed vehicle-side log data to obtain the parsed vehicle-side log data.

[0038] S103, performing multi-dimensional data enrichment on the vehicle-side log parsed data through a log enrichment unit, obtaining the vehicle-side log enriched data, and monitoring the vehicle network security based on the vehicle-side log enriched data.

[0039] Specifically, in this embodiment, multidimensional data enrichment includes asset information enrichment, rule label enrichment, IP location information enrichment, threat intelligence information enrichment, vulnerability and omission information enrichment, and terminal device operation information enrichment, etc. In addition, the present invention may not specifically limit the enrichment type of multidimensional data enrichment. After the vehicle-side log data is parsed by the log parsing unit to obtain the parsed vehicle-side log data, the parsed vehicle-side log data can be sent to the log enrichment unit, and then the vehicle-side log parsed data is enriched with asset information, rule label enrichment, IP location information enrichment, threat intelligence information enrichment, vulnerability and omission information enrichment, and terminal device operation information, so as to obtain the enriched vehicle-side log data, and monitor the vehicle network security based on the enriched vehicle-side log data.

[0040] Furthermore, in some embodiments of the present invention, obtaining vehicle-side log parsed data includes: parsing the vehicle-side log data into multiple log information fields using preset parsing rules; reading a field mapping file; converting multiple log information fields according to the field mapping file to obtain log entries corresponding to each log information field; generating an event ID for the log entry corresponding to each log information field; obtaining asset data associated with the log entry corresponding to each log information field; and using the log events and asset data corresponding to the event ID as vehicle-side log parsed data.

[0041] Specifically, in this embodiment, the vehicle-side log data is parsed into multiple log information fields using preset parsing rules, wherein the preset parsing rules may be regular expressions, JSON parsers or delimiters, etc. In addition, the present invention may not specifically limit the preset parsing rules, and then use the preset parsing rules to parse the collected vehicle-side log data, decomposing it into multiple log information fields containing specific information, such as timestamps, sensor readings, error codes, etc.

[0042] Read the field mapping file, where the mapping file can be loaded and parsed through a configuration file reading library (Python's configparser, json module, etc.).

[0043] Convert multiple log information fields according to the field mapping file to obtain the log entry corresponding to each log information field. The conversion operation may include field renaming, data type conversion, and data cleaning. For example, changing the source field name to the target field name, converting a string to an integer or floating point number, removing invalid or redundant data, etc. The converted field values ​​are organized into log entries in the target data structure, and each entry contains complete and standardized field information.

[0044] Generate an event ID for the log entry corresponding to each log information field, and you can generate a unique event ID for each processed log entry. Common generation methods include generating UUID (Universally Unique Identifier), timestamp + serial number, etc., to ensure that each event can be uniquely identified in massive data, and associate the generated event ID with the corresponding log entry to facilitate tracking and reference in subsequent processing.

[0045] Obtain the asset data associated with the log entry corresponding to each log information field, and retrieve the asset data associated with the log entry from the asset management system or database based on the relevant information in the log entry, such as vehicle ID, equipment ID, etc., where the asset data may include vehicle model, manufacturing date, maintenance records and other data information.

[0046] After obtaining the event ID of the log entry corresponding to each log information field and the asset data associated with the log entry corresponding to each log information field, the log event and asset data corresponding to the event ID can be used as the vehicle-side log parsed data.

[0047] Further, in some embodiments of the present invention, Figure 2 As shown in the figure, the vehicle-side log parsed data is enriched with multi-dimensional data, including:

[0048] S201, using asset data to enrich the asset information of the log event corresponding to the event ID.

[0049] Specifically, in this embodiment, after the log event and asset data corresponding to the event ID are used as the data after the vehicle-side log is parsed, the asset data can be used to enrich the log event corresponding to the event ID with asset information. For example, the system can automatically identify the key fields associated with the asset data in the log event, such as IP address, user ID, device serial number, etc. These fields serve as a bridge to closely connect the log event with the specific asset items in the asset management system. Then, the system maps the key field values ​​in the log to the corresponding asset information based on pre-defined mapping rules or real-time query of the asset management system, such as IP address mapping to server name, IP segment or geographic location, and user ID mapping to user name, department information and user permissions, etc. After the mapping is completed, the system integrates the acquired asset information with the original log event data, and ensures that the enriched log entry retains the original event ID, timestamp, log level and other basic information through the addition, update or reorganization of fields, and integrates detailed asset context. The comprehensiveness and depth of the enriched log entries generated in the end significantly improve the efficiency and intuitiveness of log event analysis, providing strong data support for various business scenarios such as troubleshooting, performance analysis, and security auditing, and helping enterprises make operational decisions more accurate and efficient. In addition, enriched log data can be securely stored in relational databases, NoSQL databases, or big data platforms to ensure data accessibility, scalability, and security.

[0050] S202: enriching the log event corresponding to the event ID with a rule tag using preset data in the rule tag library.

[0051] Specifically, in this embodiment, the rule tag library is a predefined data set that brings together multiple rules. Each rule accurately maps a specific log pattern, which covers log formats, keywords, regular expressions, etc. to one or more security event types. These rules are rooted in past security event analysis, industry best practices and the wisdom of security experts.

[0052] In the enrichment process, the system first retrieves the log event corresponding to the specific event ID from the log system. The log event records the timestamp, source, operation details, error code and other information in detail. Then, the system intelligently analyzes the log event and accurately extracts the key fields and values ​​to efficiently match the entries in the rule tag library. The matching mechanism integrates advanced technologies such as string comparison, regular expression matching and pattern recognition to ensure accuracy. Once a match is found, the system assigns appropriate security tags to the log event according to the rules, such as intrusion attempts, data leaks, configuration errors or normal operations.

[0053] Rule tag enrichment significantly enriches log events, so that log events not only retain the original information, but also add security property tags. The enriched log events then become a valuable resource for security analysis, rapid incident response, compliance auditing, and security trend insights.

[0054] S203: Enrich the IP location information of the log event corresponding to the event ID using the preset data in the IP location library.

[0055] Specifically, in this embodiment, in order to more comprehensively understand the geographical location background of the attack source or user activity during log processing and analysis, the system integrates an IP positioning library, such as a GeoIP database. It should be noted that the GeoIP database contains the correspondence between IP addresses and geographical location information in the global scope, and is constructed based on a large amount of data accumulation and geographic information technology. Among them, the geographical location information includes information such as country, city, longitude and latitude.

[0056] First, the IP address field contained in the log is identified and extracted. Second, the IP location library is used as a data source to efficiently perform the conversion query from IP address to geographic location. The query process can use the preset mapping relationship to quickly match the IP address with the corresponding geographic location. After the match is completed, the system will add the queried geographic location information as a new field or attribute to the log event to enrich the IP location information, thereby enriching the geographic context of the log data, providing security analysts and system administrators with an intuitive geographic distribution perspective, and promoting the efficiency and accuracy of attack tracing, in-depth analysis of user behavior, and risk assessment.

[0057] S204: Enrich the log event corresponding to the event ID with threat intelligence information using preset data in the threat intelligence library.

[0058] Specifically, in this embodiment, when the system processes the log event corresponding to the event ID, it will automatically trigger the matching mechanism with the threat intelligence database, and then parse the log event corresponding to the event ID through the preset data in the threat intelligence library, so that key information that may be related to the threat can be extracted, such as IP address, domain name visited, downloaded or executed file hash, etc. In addition, the system uses an efficient query algorithm to compare this information with the preset data in the threat intelligence library to identify whether the log event contains known malicious activities or threat identifiers. Once the match is successful, the system will not only add the matching result as a new field or attribute to the log event to enrich the threat intelligence information, but also automatically trigger the corresponding security alarm or take defensive measures according to the preset response strategy. Among them, the matching result includes information such as threat type, threat level, and related description, so that the log event is given a rich threat intelligence context, so that security analysts or system administrators can quickly locate and evaluate potential security risks, so as to take more timely and effective countermeasures.

[0059] It should be noted that the threat intelligence database contains a comprehensive resource library of key threat identifiers such as known malicious IP addresses, domain names, file hashes, etc. worldwide. The threat intelligence database is based on continuously updated intelligence collection and analysis to quickly identify and respond to potential security threats.

[0060] S205: Enrich the log event corresponding to the event ID with vulnerability information using preset data in the security vulnerability database.

[0061] Specifically, in this embodiment, when the system processes the log event corresponding to the event ID, it will start the interactive process with the security vulnerability library. The system first parses the content of the log event and extracts key information that may be related to the security vulnerability, such as the software version involved, the operating system type, the executed command or the file path accessed, etc., and then uses an efficient matching algorithm to compare this information with the preset data in the vulnerability library to identify whether the log event involves a known security vulnerability. Once the match is successful, the system will not only add the detailed information of the vulnerability as a new attribute or tag to the log event to enrich the vulnerability disclosure information, but also automatically adjust or trigger the corresponding security detection rules and response strategies according to the characteristics and potential risks of the vulnerability. Among them, the detailed information of the vulnerability includes the vulnerability number, the scope of impact, the severity, the repair suggestion, etc. Thus, the log event corresponding to the event ID is enriched with the vulnerability information using the preset data in the security vulnerability library, so that the security analyst or system administrator can understand the nature of the event more deeply, evaluate its potential security impact, and formulate effective defense and repair measures accordingly.

[0062] It should be noted that the security vulnerability library can realize real-time or regular updates of newly discovered vulnerability information by integrating external vulnerability disclosure platforms, security announcement release channels, and official information from software vendors, thereby ensuring the timeliness and accuracy of the security vulnerability library and providing the system with the latest security threat intelligence.

[0063] S206: Enrich the terminal device operation information for the log event corresponding to the event ID using the preset data in the device monitoring database.

[0064] Specifically, in this embodiment, when processing the log event corresponding to the event ID in the Internet of Vehicles system, the system loads the device monitoring database, deeply mines and integrates the preset data about the device in the monitoring database. It should be noted that the preset data includes but is not limited to the real-time communication status of the device, detailed communication information, and security events in the historical records, among which the real-time communication status includes information such as connection status, signal strength and data transmission rate, and the detailed communication information includes information such as IP address, port number, communication protocol type and data packet content summary, and the security events in the historical records include information such as intrusion attempts, abnormal traffic patterns, and unauthorized access records.

[0065] The system automatically identifies and extracts core information related to the operating status of terminal devices by correlating and analyzing preset data and log events, so as to enrich the terminal device operating information of log events, thereby greatly enriching the context of log events and comprehensively presenting the health status of terminal devices, communication activity trajectories and potential security risks.

[0066] It should be noted that the enriched log records in detail the communication activities in a specific time period, early warnings of potential security vulnerabilities, and comprehensive risk assessments based on historical data, providing valuable advice for security analysts and system administrators, helping them to quickly identify the threats and challenges faced by Internet of Vehicles devices and deploy targeted defense strategies accordingly, such as enhancing security monitoring, optimizing access control mechanisms, and urgently deploying security patches, to ensure the safe and stable operation of the Internet of Vehicles system.

[0067] Furthermore, in some embodiments of the present invention, vehicle network security is monitored based on vehicle-side log enriched data, including: using an analysis rule engine to analyze the vehicle-side log enriched data to identify potential security threats in the vehicle network.

[0068] Specifically, in this embodiment, after enriching the log events corresponding to the event ID with asset information, rule tags, IP location information, threat intelligence information, vulnerability information, and terminal device operation information, the analysis rule engine can be used to analyze the enriched data of the vehicle-side log to identify potential security threats in the vehicle network. The analysis rule engine has built-in rule sets and algorithm models, which can automatically identify key indicators such as abnormal patterns, unauthorized access signs, and malware activity trajectories in the enriched data of the vehicle-side log, so as to accurately identify possible security threats in the vehicle network. In addition, the analysis rule engine also has the ability to learn and adapt, and can continuously optimize its detection logic and rule sets based on the analysis results of historical security events to cope with the increasingly complex and changing security threat environment.

[0069] Furthermore, in some embodiments of the present invention, the method further includes: storing the vehicle-side log parsed data and / or the vehicle-side log enriched data through a database client or an ORM tool.

[0070] Specifically, in this embodiment, the vehicle-side log data is parsed by the log parsing unit to obtain the parsed vehicle-side log data. In addition, the parsed vehicle-side log data can also be stored in the database client or ORM tool. The parsed vehicle-side log data is enriched with multi-dimensional data by the log enrichment unit to obtain the enriched vehicle-side log data. In addition, the enriched vehicle-side log data can also be stored in the database client or ORM tool. Thus, the integrity, consistency and traceability of the data are ensured, providing a solid foundation for subsequent data query, analysis, mining and security auditing.

[0071] In summary, in a specific embodiment of the present invention, Figure 3As shown, data filtering and formatting rules can be set through the log collection agent, so that log data that complies with specific security policies or abnormal behaviors can be dynamically screened and filtered out, and unstructured log data with different formats can be converted into structured and standardized log data. Then, the log collection agent sends the processed vehicle-side log data to the first preset platform of Kafka to realize the decoupling and asynchronous processing of the vehicle-side log data, thereby entering the log reading process, using Kafka Streams or Spring Kafka to read the vehicle-side log data, and then using the preset parsing rules to parse the vehicle-side log data into multiple log information fields, and read the field mapping file, and convert the multiple log information fields according to the field mapping file to obtain the log entry corresponding to each log information field, and then generate the event ID of the log entry corresponding to each log information field, and obtain the asset data associated with the log entry corresponding to each log information field, so that the log event and asset data corresponding to the event ID are used as the vehicle-side log parsed data.

[0072] Use asset data to enrich the asset information of the log events corresponding to the event ID, use the preset data in the rule label library to enrich the rule labels of the log events corresponding to the event ID, use the preset data in the IP positioning library to enrich the IP positioning information of the log events corresponding to the event ID, use the preset data in the threat intelligence library to enrich the threat intelligence information of the log events corresponding to the event ID, use the preset data in the security vulnerability library to enrich the vulnerability information of the log events corresponding to the event ID, and use the preset data in the device monitoring database to enrich the terminal device operation information of the log events corresponding to the event ID.

[0073] After completing the asset information enrichment, rule label enrichment, IP location information enrichment, threat intelligence information enrichment, vulnerability information enrichment and terminal device operation information enrichment of the log event corresponding to the event ID, the enriched vehicle-side log data is sent to Kafka's second preset platform, where the second preset platform is different from the first preset platform, and the enriched vehicle-side log data is analyzed using an analysis rule engine to identify potential security threats in the vehicle network, and then the enriched vehicle-side log data can be stored through a database client or ORM tool.

[0074] It should be noted that an enrichment engine can also be set up to enhance the contextual relevance and richness of log events and related information in order to more accurately identify, analyze and respond to potential security threats. Through the enrichment engine, the system can automatically add additional information to the enriched data of the vehicle-side log, thereby helping security analysts or automated systems to more comprehensively understand security incidents and make more accurate judgments.

[0075] In summary, according to the data processing method of the vehicle network security monitoring system of the embodiment of the present invention, the vehicle-side log data can be obtained through the log collection unit, and the vehicle-side log data can be parsed through the log parsing unit to obtain the parsed vehicle-side log data, and the parsed vehicle-side log data can be enriched with multi-dimensional data through the log enrichment unit to obtain the enriched vehicle-side log data, and then the vehicle network security can be monitored according to the enriched vehicle-side log data. Therefore, by comprehensively collecting, deeply parsing and multi-dimensionally enriching the vehicle-side log data, accurate monitoring and early warning of vehicle network security can be achieved, significantly improving the overall safety protection level.

[0076] Based on the computer-readable storage medium proposed in the aforementioned embodiment of the present invention, a data processing program of a vehicle network security monitoring system is stored thereon. When the data processing program of the vehicle network security monitoring system is executed by a processor, the data processing method of the vehicle network security monitoring system of the aforementioned embodiment of the present invention is implemented.

[0077] According to the computer-readable storage medium of the embodiment of the present invention, the data processing program of the vehicle network security monitoring system is executed by the processor. Through the comprehensive collection, in-depth analysis and multi-dimensional enrichment of vehicle-side log data, accurate monitoring and early warning of vehicle network security can be achieved, which significantly improves the overall safety protection level.

[0078] Figure 4 4 is a block diagram of a data processing device of a vehicle network security monitoring system according to an embodiment of the present invention.

[0079] Specifically, the vehicle network monitoring system includes a log collection unit, a log parsing unit and a log enrichment unit, such as Figure 4 As shown, the data processing device 100 of the vehicle network security monitoring system includes a parsing module 20 and a processing module 30 .

[0080] Among them, the acquisition module 10 is used to obtain the vehicle-side log data through the log collection unit; the parsing module 20 is used to parse the vehicle-side log data through the log parsing unit to obtain the parsed vehicle-side log data; the processing module 30 is used to perform multi-dimensional data enrichment on the parsed vehicle-side log data through the log enrichment unit, obtain the enriched vehicle-side log data, and monitor the vehicle network security based on the enriched vehicle-side log data.

[0081] In some embodiments of the present invention, the log data includes: security log, traffic log, security threat log, audit log, system audit log and system security log.

[0082] In some embodiments of the present invention, the parsing module 20 is specifically used to parse the vehicle-side log data into multiple log information fields using preset parsing rules; read the field mapping file; convert the multiple log information fields according to the field mapping file to obtain the log entry corresponding to each log information field; generate an event ID for the log entry corresponding to each log information field; obtain the asset data associated with the log entry corresponding to each log information field; and use the log event and asset data corresponding to the event ID as the vehicle-side log parsed data.

[0083] In some embodiments of the present invention, multi-dimensional data enrichment includes: asset information enrichment, rule label enrichment, IP location information enrichment, threat intelligence information enrichment, vulnerability information enrichment and terminal device operation information enrichment.

[0084] In some embodiments of the present invention, the processing unit 30 is specifically used to enrich the log event corresponding to the event ID with asset data; to enrich the log event corresponding to the event ID with rule tags using preset data in the rule tag library; to enrich the log event corresponding to the event ID with IP positioning information using preset data in the IP positioning library; to enrich the log event corresponding to the event ID with threat intelligence information using preset data in the threat intelligence library; to enrich the log event corresponding to the event ID with vulnerability information using preset data in the security vulnerability library; and, to enrich the log event corresponding to the event ID with terminal device operation information using preset data in the device monitoring database.

[0085] In some embodiments of the present invention, the processing module 30 is specifically used to analyze the enriched data of the vehicle-side log using an analysis rule engine to identify potential security threats in the vehicle network.

[0086] In some embodiments of the present invention, the processing module 30 is further used to store the vehicle-side log parsed data and / or the vehicle-side log enriched data through a database client or an ORM tool.

[0087] It should be noted that other specific implementations of the data processing device of the vehicle network security monitoring system proposed in the embodiment of the present invention can refer to the specific implementations of the data processing method of the vehicle network security monitoring system of the aforementioned embodiment of the present invention, and will not be repeated here to reduce redundancy.

[0088] In summary, according to the data processing device of the vehicle network security monitoring system of the embodiment of the present invention, the acquisition module can obtain the vehicle-side log data through the log acquisition unit, and analyze the vehicle-side log data through the log analysis unit according to the analysis module to obtain the vehicle-side log analysis data, and the processing module can enrich the vehicle-side log analysis data through the log enrichment unit to obtain the vehicle-side log enriched data, and then monitor the vehicle network security according to the vehicle-side log enriched data. Therefore, through comprehensive collection, in-depth analysis and multi-dimensional enrichment of vehicle-side log data, accurate monitoring and early warning of vehicle network security can be achieved, significantly improving the overall safety protection level.

[0089] Figure 5 is a block diagram of a vehicle according to an embodiment of the present invention.

[0090] like Figure 5 As shown, the vehicle 1000 includes the data processing device 100 of the vehicle network security monitoring system according to the above-mentioned embodiment of the present invention.

[0091] According to the vehicle of the embodiment of the present invention, by adopting the data processing device of the vehicle network security monitoring system and by comprehensively collecting, deeply analyzing and multi-dimensionally enriching the vehicle-side log data, accurate monitoring and early warning of vehicle network security can be achieved, thereby significantly improving the overall safety protection level.

[0092] In addition, other structures and functions of the vehicle according to the embodiment of the present invention are known to those skilled in the art and will not be described in detail here to reduce redundancy.

[0093] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0094] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0095] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0096] In the description of the present invention, it is to be understood that the terms “center”, “longitudinal”, “lateral”, “length”, “width”, “thickness”, “up”, “down”, “front”, “back”, “left”, “right”, “vertical”, “horizontal”, “top”, “bottom”, “inside”, “outside”, “clockwise”, “counterclockwise”, “axial”, “radial”, “circumferential”, etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0097] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0098] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0099] In the present invention, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may mean that the first and second features are in direct contact, or the first and second features are in indirect contact through an intermediate medium. Moreover, a first feature being "above", "above" or "above" a second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being "below", "below" or "below" a second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is lower in level than the second feature.

[0100] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A data processing method for a vehicle network security monitoring system, characterized in that: The vehicle network monitoring system includes a log collection unit, a log parsing unit and a log enrichment unit, and the method includes: Acquiring vehicle-side log data through the log collection unit; Parsing the vehicle-side log data by the log parsing unit to obtain the vehicle-side log parsed data; The log enrichment unit performs multi-dimensional data enrichment on the vehicle-side log parsed data to obtain the vehicle-side log enriched data, and monitors the vehicle network security based on the vehicle-side log enriched data.

2. The data processing method of the vehicle network security monitoring system according to claim 1 is characterized in that: The log data includes: security log, traffic log, security threat log, audit log, system audit log and system security log.

3. The data processing method of the vehicle network security monitoring system according to claim 2 is characterized in that: The obtaining of the vehicle-side log parsed data includes: Parsing the vehicle-side log data into multiple log information fields using preset parsing rules; Read the field mapping file; Convert the multiple log information fields according to the field mapping file to obtain a log entry corresponding to each log information field; Generate an event ID for the log entry corresponding to each log information field; Obtaining asset data associated with the log entry corresponding to each log information field; The log event corresponding to the event ID and the asset data are used as the vehicle-side log parsed data.

4. The data processing method of the vehicle network security monitoring system according to claim 3 is characterized in that: The multi-dimensional data enrichment includes: asset information enrichment, rule label enrichment, IP location information enrichment, threat intelligence information enrichment, vulnerability information enrichment and terminal equipment operation information enrichment.

5. The data processing method of the vehicle network security monitoring system according to claim 4 is characterized in that: The vehicle-side log parsed data is enriched with multi-dimensional data, including: Enriching the log event corresponding to the event ID with the asset data; Enriching the log event corresponding to the event ID with the rule tag using the preset data in the rule tag library; Enriching the log event corresponding to the event ID with the IP location information using the preset data in the IP location library; Enriching the log event corresponding to the event ID with the threat intelligence information using preset data in the threat intelligence library; Enriching the log event corresponding to the event ID with the vulnerability information using preset data in the security vulnerability library; and The terminal device operation information is enriched for the log event corresponding to the event ID using preset data in the device monitoring database.

6. The data processing method of the vehicle network security monitoring system according to claim 1 is characterized in that: The monitoring of vehicle network security according to the enriched data of the vehicle-side log includes: The enriched vehicle-side log data is analyzed using an analysis rule engine to identify potential security threats in the vehicle network.

7. The data processing method of the vehicle network security monitoring system according to claim 1 is characterized in that: The method further comprises: The vehicle-side log parsed data and / or the vehicle-side log enriched data are stored through a database client or an ORM tool.

8. A computer-readable storage medium, characterized in that: A data processing program of a vehicle network security monitoring system is stored thereon, and when the data processing program of the vehicle network security monitoring system is executed by a processor, a data processing method of a vehicle network security monitoring system according to any one of claims 1-7 is implemented.

9. A data processing device for a vehicle network security monitoring system, characterized in that: The vehicle network monitoring system includes a log collection unit, a log parsing unit and a log enrichment unit, and the device includes: An acquisition module, used to acquire vehicle-side log data through the log collection unit; A parsing module, used to parse the vehicle-side log data through the log parsing unit to obtain the parsed vehicle-side log data; The processing module is used to perform multi-dimensional data enrichment on the vehicle-side log parsed data through the log enrichment unit, obtain the vehicle-side log enriched data, and monitor the vehicle network security based on the vehicle-side log enriched data.

10. A vehicle, characterized in that: A data processing device comprising the vehicle network security monitoring system as claimed in claim 9.

Images