Automobile attack chain analysis method and device, electronic equipment and storage medium

Abstract

The invention relates to the field of vehicle network communication, in particular to an automobile attack chain analysis method and device, electronic equipment and a storage medium. According to the method, the security event and the corresponding event data are firstly obtained to provide a basis for subsequent analysis; then, safety key elements in the event data are extracted, a knowledge graph is constructed with the safety key elements and the automobile software and hardware assets, the safety key elements and the automobile software and hardware assets serve as different entity nodes respectively, the association between the different elements is determined in this way, and the problem that the association of attack behaviors is neglected is solved. Then, analyzing the knowledge graph to obtain target malicious nodes to construct an initial attack graph, and analyzing event data to obtain an attack link to update a node relationship of the initial attack graph to obtain a target attack graph, so that a unified description framework is provided for complex attacks; the whole attack process and the relation between the nodes can be clearly known, and the inconsistency of understanding and reaction caused by lack of a unified description framework is avoided.

Description

Technical Field

[0001] The present invention relates to the field of vehicle network communication, and in particular to an analysis method, device, electronic equipment and storage medium for an automobile attack chain. Background Art

[0002] As the network systems of intelligent connected vehicles become increasingly complex, a variety of network attack methods continue to emerge against vehicle control systems, sensor networks, communication protocols, and other levels, posing a direct threat to passenger safety. Although the current intrusion detection system plays an important role, traditional detection methods are difficult to cope with the increasingly complex network attacks, especially APT threats. In addition, existing technologies ignore the correlation of attack behaviors when dealing with complex attack chains, which can easily lead to missed reports and false alarms. At the same time, the lack of a unified description framework affects the understanding and response to complex attacks. In this context, although the ATT&CK framework provides a systematic method to describe and classify network attacks, its application in the field of intelligent connected vehicles lacks pertinence. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides an analysis method, device, electronic device and storage medium for an automobile attack chain to solve the problem that although the ATT&CK framework provides a systematic method to describe and classify network attacks, it lacks targeted application in the field of intelligent connected vehicles.

[0004] In a first aspect, an embodiment of the present invention provides a method for analyzing an automobile attack chain, the method comprising:

[0005] Obtain security events of intelligent connected vehicles and event data corresponding to the security events;

[0006] Extracting the critical safety factors in the event data, and constructing a knowledge graph using the critical safety factors and the automotive software and hardware assets corresponding to the security event, wherein the critical safety factors serve as entity nodes in the knowledge graph, and the automotive software and hardware assets serve as asset nodes of the entity nodes in the knowledge graph;

[0007] Analyze the asset nodes corresponding to each entity node in the knowledge graph to obtain target malicious nodes, and use the target malicious nodes to construct an initial attack graph;

[0008] The event data is analyzed to obtain an attack link of the security event, and the attack link is used to update the node relationship of each malicious node in the initial attack graph to obtain a target attack graph.

[0009] Furthermore, extracting the key safety elements from the event data and constructing a knowledge graph using the key safety elements and the automotive hardware and software assets corresponding to the security event includes:

[0010] Query whether the security incident is associated with the vehicle software and hardware assets of the intelligent connected vehicle;

[0011] If the security event is associated with the vehicle software and hardware assets of the intelligent connected vehicle, extracting the key security elements in the event description information of the security event;

[0012] Analyzing a first association relationship between the critical safety factor and the automotive software and hardware assets, and a second association relationship between the automotive software and hardware assets;

[0013] The knowledge graph is obtained by taking the security-related elements as entity nodes, taking the automobile software and hardware assets as asset nodes, taking the first association relationship between the security-critical elements and the automobile software and hardware assets as the edge between the entity node and the asset node, and taking the second association relationship between the automobile software and hardware assets as the edge between the asset nodes.

[0014] Furthermore, the analyzing the asset node corresponding to each entity node in the knowledge graph to obtain the target malicious node includes:

[0015] In the current time window, the asset node corresponding to each entity node is placed into a predefined attack feature graph for matching, wherein the attack feature graph includes multiple malicious features;

[0016] If the asset node hits any malicious feature in the attack feature graph, the asset node is used as a candidate malicious node;

[0017] Determining the corresponding significance level according to the malicious features hit by the candidate malicious node;

[0018] The candidate malicious nodes are arranged according to the significance to obtain a candidate malicious node sequence, and a preset number of candidate malicious nodes are selected in sequence from the candidate malicious node sequence as the target malicious nodes.

[0019] Furthermore, the using the target malicious node to construct an initial attack graph includes:

[0020] Acquire asset nodes related to the target malicious node from the knowledge graph;

[0021] The initial attack graph is constructed using the target malicious node and asset nodes related to the target malicious node.

[0022] Further, the analyzing the event data to obtain the attack chain of the security event includes:

[0023] Acquire a pre-built intelligent networked vehicle knowledge model, wherein the intelligent networked vehicle knowledge model includes a plurality of attack features and preset attack features corresponding to the attack category;

[0024] Extracting attack features from event data of each security event, and matching the attack features with preset attack features in the intelligent connected vehicle knowledge model to obtain a target attack category hit by the attack features;

[0025] The attack chain of the security event is analyzed according to the target attack category hit by the attack feature.

[0026] Further, the node relationship of each malicious node in the initial attack graph is updated by using the attack link to obtain a target attack graph, including:

[0027] Use sliding windows and preset analysis algorithms to perform association analysis on security events and obtain association rule vectors;

[0028] Using the attack link to update the node relationship of each malicious node in the initial attack graph to obtain an updated initial attack graph, and adding the association rule vector to the updated initial attack graph to obtain a complex attack link;

[0029] The updated initial attack graph is updated again using the complex attack link to obtain the target attack graph.

[0030] Furthermore, the use of the sliding window and the preset analysis algorithm to perform association analysis on the security events to obtain the association rule vector includes:

[0031] Acquire an alarm transaction set, and divide the alarm transaction set into data slices of multiple time segments according to a sliding window, wherein the alarm transaction set includes multiple security events, and each data slice includes at least one security event;

[0032] Analyze the security events in the data shards to obtain the occurrence frequency of each security event;

[0033] The security events with a frequency higher than a preset frequency are regarded as single security events, and a frequent 1-item set is constructed using the single security events;

[0034] Based on the frequent 1-item set, a preset analysis algorithm is used to mine frequent itemsets for each data shard to obtain frequent itemsets, and the frequent itemsets are merged to obtain a frequent itemset set;

[0035] Check whether each frequent item set in the frequent item set set satisfies a minimum confidence condition, and if the minimum confidence condition is satisfied, generate an association rule vector according to the frequent item set.

[0036] Furthermore, based on the frequent 1-item set, a preset analysis algorithm is used to mine frequent itemsets for each data shard, and the obtained frequent itemsets include:

[0037] Generate candidate item sets in each data shard based on frequent 1-item sets, and after generating candidate item sets in each data shard, obtain the support count corresponding to each candidate item set;

[0038] The candidate item sets in the data slice that meet the minimum support threshold are taken as frequent item sets.

[0039] Furthermore, the association rule vector is added to the updated initial attack graph to obtain a complex attack link, including:

[0040] According to the security events corresponding to the association rule vector, updating the nodes in the updated attack graph to obtain a first attack graph;

[0041] Update the edges between the nodes in the first attack graph according to the association relationship of the security events corresponding to the association rule vector to obtain a second attack graph;

[0042] By analyzing the second attack graph, a complex attack link is obtained.

[0043] Further, the updating of the nodes in the updated attack graph according to the security events corresponding to the association rule vector to obtain the first attack graph includes:

[0044] Analyze the security events corresponding to the association rule vector to determine the node types that need to be updated in the updated attack graph;

[0045] The corresponding nodes in the updated attack graph are updated according to the node types to obtain a first attack graph.

[0046] Further, the updating of the edges between the nodes in the first attack graph according to the association relationship of the security events corresponding to the association rule vector to obtain the second attack graph includes:

[0047] Analyze the association relationship between the security events corresponding to the association rule vectors to obtain the association type between the security events corresponding to the association rule vectors;

[0048] A corresponding update method is determined according to the association type, and the edges between nodes in the first attack graph are updated using the update method to obtain a second attack graph.

[0049] In a second aspect, an embodiment of the present invention provides an analysis device for an automobile attack chain, the device comprising:

[0050] An acquisition module, used to acquire security events of intelligent network-connected vehicles and event data corresponding to the security events;

[0051] An extraction module, used to extract the key safety elements in the event data, and construct a knowledge graph using the key safety elements and the automobile hardware and software assets corresponding to the security event, wherein the key safety elements serve as entity nodes in the knowledge graph, and the automobile hardware and software assets serve as asset nodes of the entity nodes in the knowledge graph;

[0052] A construction module, used for analyzing the asset node corresponding to each entity node in the knowledge graph to obtain a target malicious node, and using the target malicious node to construct an initial attack graph;

[0053] The analysis module is used to analyze the event data to obtain the attack chain of the security event, and use the attack chain to update the node relationship of each malicious node in the initial attack graph to obtain a target attack graph.

[0054] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, computer instructions being stored in the memory, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0055] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method of the first aspect or any corresponding embodiment thereof.

[0056] The method provided in the embodiment of the present application first obtains security events and corresponding event data to provide a basis for subsequent analysis. Then, the critical security elements in the event data are extracted and a knowledge graph is constructed with the automotive hardware and software assets. The critical security elements and automotive hardware and software assets are respectively used as different entity nodes. In this way, the relationship between different elements is clarified, and the problem of the neglect of the correlation of attack behaviors is solved. Then, the knowledge graph is analyzed to obtain the target malicious nodes to construct the initial attack graph, and then the attack links are obtained by analyzing the event data to update the node relationship of the initial attack graph to obtain the target attack graph, thereby providing a unified description framework for complex attacks, which can clearly understand the entire process of the attack and the relationship between each node, avoiding the inconsistency of understanding and response caused by the lack of a unified description framework.

[0057] The method provided in the embodiment of the present application can clarify the specific impact scope of security incidents in the automotive system by querying the association between security incidents and the automotive software and hardware assets of intelligent connected vehicles, which helps to accurately locate potential security risk points. If the key security elements are extracted after determining the existence of an association, the core characteristics of the security incident can be accurately grasped, providing key information for subsequent analysis and processing. Constructing the association between key security elements and automotive software and hardware assets, and constructing a knowledge graph with them as edges, on the one hand, can clearly show the close connection between security-related elements and automotive software and hardware assets, so that security analysts can intuitively understand the relationship between security incidents and various parts of the automotive system; on the other hand, the construction of this knowledge graph provides a systematic framework for dealing with complex security issues, which helps to comprehensively analyze the development context and possible impact paths of security incidents, so as to more effectively formulate targeted security protection strategies and improve the overall safety of intelligent connected vehicles.

[0058] The method provided in the embodiment of the present application obtains the source address and destination address of the security incident from the knowledge graph according to the preset time window, which helps to focus on analyzing security incidents within a specific time period and improve the pertinence and timeliness of the analysis. By constructing asset nodes using the source address and destination address, it is possible to clarify the specific assets involved in the security incident and provide precise targets for subsequent risk assessment and protection. By matching the asset nodes with the pre-set attack feature graph, asset nodes with malicious features can be quickly identified, improving the efficiency of detecting potential threats. Using asset nodes as candidate malicious nodes and selecting a preset number of target malicious nodes from them can screen out the most threatening nodes for key attention, concentrate resources for in-depth analysis and response, thereby better ensuring the safety of intelligent connected vehicles and reducing the losses caused by security risks.

[0059] The method provided in the embodiment of the present application provides a comprehensive and systematic reference framework for analyzing security incidents by obtaining a pre-built knowledge model of intelligent connected vehicles. The multiple attack features contained in this model and the preset attack features corresponding to the attack categories cover various possible security threat situations, making the analysis of security incidents more professional and accurate. Extracting attack features from the event data of security incidents and matching them with the preset attack features in the knowledge model can quickly determine the target attack category to which the security incident belongs, thereby improving the efficiency and accuracy of the analysis. By analyzing the attack chain of security incidents according to the target attack category, the process and method of the attack can be clearly understood, providing a strong basis for formulating targeted security protection measures. This technical solution helps to timely discover and respond to security threats faced by intelligent connected vehicles, and improve the safety and reliability of vehicles.

[0060] The method provided in the embodiment of the present application uses a sliding window and a preset analysis algorithm to perform association analysis on security events to obtain an association rule vector, which can dig out potential frequent patterns and association relationships between security events, and provide richer information for subsequent analysis. This helps to discover hidden security risks and attack patterns and improve insight into complex security situations. Next, the node relationship of the malicious nodes in the initial attack graph is updated using the attack link, and the association rule vector is added to obtain a complex attack link. On the one hand, the attack graph can more accurately reflect the actual attack situation, taking into account the correlation between attack behaviors, and reducing the possibility of missed reports and false reports; on the other hand, the addition of the association rule vector provides more clues and basis for analyzing complex attacks, which helps security analysts better understand the overall picture and development trend of the attack. Finally, the initial attack graph is updated again using the complex attack link to obtain the target attack graph, which can provide more comprehensive and accurate guidance for the security protection of intelligent connected vehicles. The target attack graph can clearly show the path of complex attacks and the relationship between each node, helping security personnel to formulate more effective defense strategies and improve the network security protection level of intelligent connected vehicles. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0062] Figure 1 is a flowchart of a method for analyzing an automobile attack chain according to some embodiments of the present invention;

[0063] Figure 2 It is an ATT&CK-ICVs matrix model in combination with the safety features of smart cars according to some embodiments of the present invention;

[0064] Figure 3 is an attack link diagram showing attack links and attack steps according to some embodiments of the present invention;

[0065] Figure 4 is a flowchart of an association mining algorithm according to some embodiments of the present invention;

[0066] Figure 5 is a diagram of an automotive attack chain analysis architecture according to some embodiments of the present invention;

[0067] Figure 6 is a structural block diagram of an analysis device for an automobile attack chain according to an embodiment of the present invention;

[0068] Figure 7 It is a schematic diagram of the hardware structure of the electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0070] According to an embodiment of the present invention, a method, device, electronic device and storage medium for analyzing an automobile attack chain are provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0071] In this embodiment, a method for analyzing an automobile attack chain is provided. Figure 1 FIG. 1 is a flow chart of a method for analyzing an automobile attack chain according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0072] Step S101, obtaining security events of the intelligent connected vehicle and event data corresponding to the security events.

[0073] In the embodiment of the present application, HIDS is deployed in the vehicle system to enable it to monitor the vehicle system logs. HIDS will continuously record various log information generated during the operation of the system, including system startup and shutdown time, user login and operation records, software installation and update, etc. These logs can provide information about the normal operation status of the vehicle system, as well as clues when abnormal situations occur.

[0074] HIDS will regularly check key files in the vehicle system, such as operating system files, application files, etc., to ensure that they have not been tampered with or damaged. If the hash value of the file is found to have changed, it can be determined that the file may have been maliciously modified, thereby triggering a security incident. In addition, HIDS will monitor the behavior of the vehicle system in real time, such as CPU usage, memory usage, network connection, etc. If abnormal resource consumption or suspicious network connection is found, it can be considered that there may be a security incident.

[0075] In the embodiment of the present application, NIDS is also deployed in the Internet of Vehicles environment, so that it can conduct in-depth analysis and evaluation of Internet of Vehicles traffic. NIDS will monitor network data packets in the Internet of Vehicles and detect data packets of different communication protocols. For example, for CAN bus protocol, Bluetooth protocol, Wi-Fi protocol, etc., NIDS will analyze the format, content and source of the data packet to determine whether there is abnormal communication behavior. For commonly used communication protocols in the Internet of Vehicles, such as CAN bus protocol, NIDS can detect whether there are malicious data packet injections, denial of service attacks and other security incidents by monitoring bus traffic, analyzing message formats and IDs, etc. For Bluetooth and Wi-Fi protocols, NIDS can detect whether there are illegal connections, data theft and other security incidents.

[0076] HIDS and NIDS will continuously capture possible security events based on their respective monitoring rules and algorithms. When HIDS detects that file integrity is compromised, abnormal behavior occurs, or NIDS detects abnormal network traffic, it will trigger the capture mechanism of security events. Security events can be captured by setting thresholds, pattern matching, etc. For example, if HIDS detects that the CPU usage exceeds a certain threshold, or NIDS detects that a specific data packet format matches a known attack pattern, it will be considered that a security event has occurred.

[0077] Once a security incident is captured, the IDS system will record detailed data related to the incident. For security incidents captured by HIDS, the file path, modification time, user operation records, etc. may be recorded. For security incidents captured by NIDS, the source address, destination address, protocol type, message content, etc. of the data packet may be recorded.

[0078] Event data can be recorded and stored in log files, databases, etc. for subsequent analysis and processing. At the same time, in order to ensure the integrity and traceability of the data, the IDS system can also encrypt and sign the event data to prevent the data from being tampered with or forged.

[0079] Step S102, extract the critical safety factors in the event data, and use the critical safety factors and the automobile software and hardware assets corresponding to the security events to build a knowledge graph, wherein the critical safety factors serve as entity nodes in the knowledge graph, and the automobile software and hardware assets serve as asset nodes of the entity nodes in the knowledge graph.

[0080] In the embodiment of the present application, the key safety factors in the event data are extracted, and a knowledge graph is constructed using the key safety factors and the automotive software and hardware assets corresponding to the security events, including the following steps A1-A4:

[0081] Step A1, query whether the security incident is associated with the vehicle software and hardware assets of the intelligent connected vehicle.

[0082] Specifically, determine the list of automotive software and hardware assets: First, it is necessary to clarify what automotive software and hardware assets are in the intelligent connected car, such as on-board computers, sensors, communication modules, etc. The list of hardware assets can be determined by consulting the technical documentation of the car or performing system analysis. For the set of security events obtained and pre-processed, analyze the attributes of each security event, such as event category, device name involved, source IP and destination IP, etc. Determine whether these attributes are associated with known automotive software and hardware assets. For example, if the source IP or destination IP of the security event corresponds to the IP address of a certain automotive software and hardware asset, or the name of the device involved in the event is consistent with the name of a certain automotive software and hardware asset, it can be considered that the security event is associated with the automotive software and hardware asset.

[0083] Step A2: If the security event is associated with the vehicle software and hardware assets of the intelligent connected vehicle, the key security elements in the event description information of the security event are extracted.

[0084] Specifically, for security events that are determined to be associated with automotive hardware and software assets, carefully analyze their event description information. Event description information may contain various forms of text content, such as log records, error messages, etc. Use TF-IDF and KEYBERT methods to extract keywords from event description information. First, use TF-IDF to extract preliminary keywords from event descriptions. These keywords are words that appear frequently and are representative in event descriptions. Then, use KEYBERT to perform semantic refinement on the preliminary keywords to obtain more representative keywords that can better describe and represent the key security elements in security events. For example, if the event description mentions "network connection abnormality", TF-IDF may extract preliminary keywords such as "network", "connection", and "abnormality", while KEYBERT may further extract more semantically accurate keywords such as "network attack" and "connection interruption".

[0085] Step A3, analyzing the first association relationship between the safety critical elements and the automotive software and hardware assets, and the second association relationship between the automotive software and hardware assets.

[0086] Specifically, the extracted critical security elements are associated with the corresponding automotive hardware and software assets. This relationship can be recorded by establishing an association table or data structure. For example, if the critical security element is "cyber attack" and the automotive hardware and software asset associated with it is the vehicle communication module, this corresponding relationship can be recorded in the association table. The strength of the association relationship can be determined based on factors such as the severity of the security incident and the closeness of the critical security element to the automotive hardware and software assets. For example, if a security incident has a serious impact on a certain automotive hardware and software asset, the strength of the association between the critical security element and the automotive hardware and software asset can be set to a higher value.

[0087] Step A4, taking the security-related elements as entity nodes, taking the automobile software and hardware assets as asset nodes, taking the first association relationship between the security-critical elements and the automobile software and hardware assets as the edge between the entity node and the asset node, taking the second association relationship between the automobile software and hardware assets as the edge between the asset nodes, and obtaining a knowledge graph.

[0088] Specifically, security-related elements (such as vulnerabilities, threats, etc.) are used as entity nodes, and they can be classified and named according to the type and importance of security-critical elements. For example, different types of threats (such as cyber attack threats, physical attack threats, etc.) are created as different entity nodes. At the same time, automotive software and hardware assets are used as asset nodes, and they are named and classified according to the type and function of the assets. Based on the association between the constructed security-critical elements and automotive software and hardware assets, edges are established between entity nodes and asset nodes in the knowledge graph. Edges can have attributes, such as association strength, association time, etc., to better describe and analyze this relationship.

[0089] As more security incidents are analyzed and processed, new entity nodes and edges can be continuously added to improve the knowledge graph. At the same time, visualization tools can be used to display and analyze the knowledge graph to better understand the relationship between security incidents and automotive hardware and software assets.

[0090] Step S103, analyzing the asset nodes corresponding to each entity node in the knowledge graph to obtain the target malicious nodes, and using the target malicious nodes to construct an initial attack graph.

[0091] In the embodiment of the present application, analyzing the asset node corresponding to each entity node in the knowledge graph to obtain the target malicious node includes the following steps B1-B4:

[0092] Step B1: within the current time window, the asset node corresponding to each entity node is put into a predefined attack feature graph for matching, wherein the attack feature graph includes multiple malicious features.

[0093] Specifically, according to the set time division rules, determine the time range of current concern. For each entity node in the knowledge graph, obtain its corresponding asset node list and process them one by one. Read the pre-defined attack feature graph, which contains multiple known malicious feature descriptions. Each malicious feature can be a specific behavior pattern, data feature, or system status. Compare the attributes, behaviors, or other related features of each asset node with the malicious features in the attack feature graph one by one to check whether there is a match.

[0094] Step B2: If the asset node hits any malicious feature in the attack feature graph, the asset node is taken as a candidate malicious node.

[0095] Specifically, during the matching process, if the feature of the asset node is found to match a malicious feature in the attack feature graph, the asset node is considered to have hit the malicious feature. Once the asset node hits the malicious feature, it is marked as a candidate malicious node and the hit malicious feature information is recorded.

[0096] Step B3, determining the corresponding significance level according to the malicious features hit by the candidate malicious node.

[0097] Specifically, a significance value is set for each malicious feature based on factors such as the degree of harm and frequency of occurrence of the malicious feature. For example, some malicious features may cause serious security vulnerabilities, and their significance is higher; while some relatively minor malicious features have a lower significance. For each candidate malicious node, the corresponding significance value is found according to the malicious features it hits. If a candidate malicious node hits multiple malicious features, the comprehensive significance can be calculated by some weighting method.

[0098] Step B4: Arrange the candidate malicious nodes according to their significance to obtain a candidate malicious node sequence, and select a preset number of candidate malicious nodes from the candidate malicious node sequence in turn as target malicious nodes.

[0099] Specifically, all candidate malicious nodes are sorted in descending order according to their significance values. The candidate malicious nodes with higher significance are positioned higher in the sequence. The number of target malicious nodes to be selected is pre-set according to factors such as system requirements and resource limitations. From the sorted candidate malicious node sequence, the preset number of candidate malicious nodes are selected in turn as the final target malicious nodes. These target malicious nodes will be the focus of further analysis and processing.

[0100] In an embodiment of the present application, an initial attack graph is constructed using a target malicious node, including the following steps: obtaining asset nodes related to the target malicious node from a knowledge graph; and constructing an initial attack graph using the target malicious node and asset nodes related to the target malicious node.

[0101] Specifically, first, in order to use the target malicious node to build the initial attack graph, it is necessary to obtain the asset node corresponding to the target malicious node. Since the target malicious node is a node that may have malicious behavior determined from the security event analysis, and these nodes are usually associated with specific assets. The asset node corresponding to the target malicious node can be found by querying the knowledge graph or based on the previously established association between the asset node and the security event. These asset nodes may include hardware assets (such as on-board computers, sensors, etc.), software assets (such as operating systems, applications, etc.), and data assets in smart connected vehicles.

[0102] Then, an initial attack graph is constructed based on the target malicious node and the asset node corresponding to the target malicious node. When constructing the initial attack graph, the target malicious node and the corresponding asset node are used as nodes in the graph. If there is an attack relationship or association relationship between the target malicious node and the asset node, they can be connected with edges in the graph. For example, if a target malicious node launches an attack on an asset node, a directed edge can be used in the attack graph to point from the target malicious node to the asset node. In this way, an initial attack graph can be gradually constructed, which shows the potential attack paths and relationships between the target malicious node and the asset node, providing an important reference for further analyzing security incidents and formulating security protection strategies.

[0103] Step S104: Analyze the event data to obtain the attack link of the security event, and use the attack link to update the node relationship of each malicious node in the initial attack graph to obtain the target attack graph.

[0104] In the embodiment of the present application, analyzing the event data to obtain the attack chain of the security event includes the following steps C1-C3:

[0105] Step C1, obtaining a pre-built intelligent networked vehicle knowledge model, wherein the intelligent networked vehicle knowledge model includes multiple attack features and preset attack features corresponding to attack categories.

[0106] Specifically, a knowledge model of intelligent connected vehicles is pre-built. This model can be built based on research in the field of intelligent connected vehicle security, historical security incident analysis, and industry standards. The model includes multiple attack features and preset attack features corresponding to attack categories. Attack features can be specific network traffic patterns, system behaviors, software vulnerability exploitation methods, etc., while attack categories can be classified according to the targets, means, and impacts of the attacks, such as network attacks, physical attacks, software vulnerability exploitation, etc. The constructed knowledge model of intelligent connected vehicles is stored in a suitable database or data structure so that it can be quickly queried and used later. Relational databases, graph databases, or other data storage technologies can be used to manage knowledge models.

[0107] like Figure 2 As shown in the figure, the ATT&CK-ICVs model is an attack matrix model for IoV security in the Enterprise domain, which is customized based on the enterprise-level ATT&CK framework and the network security characteristics of IoVs to meet the security needs of IoVs. The ATT&CK framework is a widely recognized unified attack description foundation that provides a systematic attack behavior classification and description method for various security scenarios. The ATT&CK-ICVs model takes the ATT&CK framework as a starting point and fully draws on its mature architecture and classification method to ensure that the description of attack behavior has a certain degree of universality and standardization. The network environment of IoVs is complex, involving multiple aspects such as vehicle-mounted systems, IoV communications, and external network connections. The ATT&CK-ICVs model specifically analyzes and describes possible attack paths, attack targets, and attack methods based on these network security characteristics. For example, for the analysis of IoV traffic, specific attack patterns can be identified, such as man-in-the-middle attacks and denial of service attacks, which have unique manifestations and impacts in the environment of IoVs. IoVs not only face traditional network security threats, but also have special needs related to the vehicle's own functions and safety. The ATT&CK-ICVs model takes into account the security needs of smart cars, such as the integrity protection of the on-board system and the security of autonomous driving functions.

[0108] By combining the pre-processed security event data with the ATT&CK-ICVs model, more detailed and accurate attack descriptions can be extracted from security events. The model provides a set of standardized attack behavior classifications and description vocabulary, allowing security analysts to quickly understand the nature and characteristics of attacks.

[0109] Step C2, extracting attack features from the event data of each security event, matching the attack features with preset attack features in the intelligent connected vehicle knowledge model, and obtaining the target attack category hit by the attack features.

[0110] Specifically, for the pre-processed security event data, the event data of each security event is analyzed to extract attack features. Various data analysis techniques and tools, such as data mining algorithms, machine learning algorithms, etc., can be used to automatically extract attack features. For example, specific features such as packet format, source address, and destination address can be extracted from network traffic data, and features such as abnormal system calls and process behaviors can be extracted from system logs.

[0111] The extracted attack features are matched with the preset attack features in the intelligent connected vehicle knowledge model. Pattern matching algorithms, similarity calculation algorithms and other technologies can be used for matching operations. If the attack features of a security event match a preset attack feature in the knowledge model, the security event is considered to have hit the corresponding attack category.

[0112] According to the matching results of attack features and knowledge models, the target attack category to which the security event belongs is determined. An attack category label can be set for each security event so that it can be easily identified and processed in subsequent analysis.

[0113] Step C3, analyzing the attack chain of the security incident according to the target attack category hit by the attack signature.

[0114] Specifically, for each target attack category, analyze its characteristics and common attack links. You can refer to the attack category definitions in the intelligent connected vehicle knowledge model and related security research reports to understand the attack methods and attack steps commonly used by different attack categories. For example, network attacks may include steps such as invading the vehicle system through network vulnerabilities and stealing vehicle data; physical attacks may include steps such as destroying vehicle hardware equipment and tampering with sensor data.

[0115] like Figure 3 As shown in Figure 1, based on the target attack category to which the security event belongs and the characteristics of the attack category obtained through analysis, the attack chain of the security event is constructed. The attack chain can be represented by a directed graph, in which the nodes represent the various stages or steps of the attack and the edges represent the transfer relationship of the attack. For example, if a security event belongs to the network attack category, and the attack characteristics show that the attacker first invaded the vehicle system through a network vulnerability and then stole the vehicle data, then an attack chain can be constructed from the "network vulnerability exploitation" node to the "vehicle system intrusion" node and then to the "vehicle data theft" node.

[0116] Verify and improve the constructed attack chain. You can check the accuracy and completeness of the attack chain by comparing it with the actual security incident data and referring to the results of other security analysis methods. If you find that the attack chain is unreasonable or incomplete, you can adjust and improve it to ensure that the attack chain can accurately reflect the actual attack process of the security incident.

[0117] In the embodiment of the present application, the node relationship of each malicious node in the initial attack graph is updated by using the attack link to obtain the target attack graph, including the following steps D1-D3:

[0118] Step D1, using a sliding window and a preset analysis algorithm to perform association analysis on security events to obtain an association rule vector.

[0119] Specifically, first determine the size of the sliding window, time span and other parameters. The sliding window is used to divide security events for analysis in order to discover potential connections between events. First, obtain the alarm transaction set, and divide the alarm transaction set into data slices of multiple time segments according to the sliding window, wherein the alarm transaction set includes multiple security events, and each data slice includes at least one security event; secondly, analyze the security events in the data slices to obtain the frequency of occurrence of each security event; then, treat the security events with a frequency higher than the preset frequency as single security events, and use the single security events to construct a frequent 1-item set; then, based on the frequent 1-item set, use the preset analysis algorithm to mine the frequent item sets for each data slice, obtain the frequent item sets, and merge the frequent item sets to obtain the frequent item set set; finally, check whether each frequent item set in the frequent item set set meets the minimum confidence condition. If the minimum confidence condition is met, generate an association rule vector based on the frequent item set.

[0120] Among them, based on the frequent 1-item set, a preset analysis algorithm is used to mine frequent itemsets for each data shard, and the obtained frequent itemsets include: generating candidate itemsets in each data shard based on the frequent 1-item set, and after generating the candidate itemsets in each data shard, obtaining the support count corresponding to each candidate itemset; taking the candidate itemsets in the data shard that meet the minimum support threshold as frequent itemsets.

[0121] like Figure 4 As shown, the following is a detailed description of the above process:

[0122] Collect various security event data from the security monitoring system of intelligent connected vehicles. These data can come from multiple sources such as intrusion detection systems, log records, network traffic analysis, etc. Organize these security events into alarm transaction sets, each of which can represent a specific security event or a group of related security events.

[0123] Determine the size of the sliding window and the sliding step. The window size determines the number of security events contained in each time segment, and the sliding step controls the speed of the window movement. According to the set window parameters, the alarm transaction set is divided into data slices of multiple time segments. For example, if the window size is 1 hour and the sliding step is 30 minutes, then every 1 hour of security event data will be divided into one data slice.

[0124] For each data shard, analyze the security events contained therein one by one. For example, a data structure such as a counter or a hash table can be used to record the number of occurrences of each security event. For each security event, divide its number of occurrences by the total number of security events in the data shard to obtain the frequency of occurrence of the security event. For example, if there are a total of 100 security events in a data shard, and a specific security event occurs 20 times, then the frequency of occurrence of the security event is 20%. Compare the frequency of occurrence with the preset frequency. The preset frequency can be set according to actual conditions, and is usually a relatively high value to ensure that the single security events screened out have a certain importance. If the frequency of occurrence of a security event is higher than the preset frequency, it is treated as a single security event. 1-item set: Collect all single security events and form them into a frequent 1-item set. A frequent 1-item set refers to a collection of single security events that appear frequently in a data shard.

[0125] Select a suitable frequent item set mining algorithm, such as Apriori algorithm, FP-Growth algorithm, etc. Based on the frequent 1-item set, perform frequent item set mining on each data shard. Start with the frequent 1-item set and gradually expand to larger item sets, and determine the frequent item sets by calculating the support (i.e., the frequency of the item set appearing in the data shard). After the frequent item set mining is performed on each data shard, the frequent item sets obtained from each shard are merged. Remove duplicate frequent item sets and sort out a set containing frequent item sets of all data shards. Specifically, for each data shard, a candidate item set can be generated in a variety of ways. The embodiment of the present application generates a candidate item set by combining elements in a frequent 1-item set. For example, if a frequent 1-item set contains security events A, B, and C, then candidate item sets {A, B}, {A, C}, {B, C}, {A, B, C}, etc. can be generated. For each candidate item set, check whether it appears in each security event in the data shard. If a candidate item set appears in a security incident, the support count of the candidate item set is increased. The support count indicates the number of times the candidate item set appears in the data shard. A minimum support threshold is set based on actual needs and data characteristics. This threshold is usually a relatively high value, indicating that the frequency of the candidate item set in the data shard must reach a certain level to be considered a frequent item set. For each candidate item set, its support count is compared with the minimum support threshold. If the support count of a candidate item set is greater than or equal to the minimum support threshold, then the candidate item set is considered a frequent item set.

[0126] For each frequent item set in the frequent item set set, calculate its confidence. Confidence indicates the probability of another item set appearing when a frequent item set appears. Compare the confidence of each frequent item set with the minimum confidence condition. The minimum confidence can be set according to actual needs, usually a relatively high value to ensure that the generated association rules have a certain reliability. If a frequent item set meets the minimum confidence condition, an association rule is generated based on the frequent item set. Association rules can be expressed in the form of "precondition → conclusion", for example, "security event A and security event B occur at the same time → security event C occurs". The generated association rules are expressed in vector form, and each association rule corresponds to a vector element. The vector element can contain information such as the premise event, conclusion event, and association strength of the rule.

[0127] Step D2, using the attack link to update the node relationship of each malicious node in the initial attack graph, to obtain an updated initial attack graph, and adding the association rule vector to the updated initial attack graph to obtain a complex attack link.

[0128] Specifically, the node relationship of each malicious node in the initial attack graph is updated using the attack link. Specifically, the edges between the malicious nodes in the initial attack graph are adjusted according to the connection relationship between the nodes in the attack link. If there is a direct attack relationship between two malicious nodes in the attack link, then the corresponding edge is also added or strengthened between the corresponding two nodes in the initial attack graph. In this way, an updated initial attack graph is obtained. The obtained association rule vector is added to the updated initial attack graph. The association rule vector can be used as additional information to help further understand the relationship between security events. The association rule vector can be added to the attack graph in the form of node attributes or edge attributes for use in subsequent analysis. In this way, an attack graph containing complex attack links is obtained.

[0129] Specifically, the association rule vector is added to the updated initial attack graph to obtain a complex attack link, including the following steps:

[0130] Step D201, updating the nodes in the updated attack graph according to the security events corresponding to the association rule vector to obtain a first attack graph.

[0131] Among them, according to the security events corresponding to the association rule vector, the nodes in the updated attack graph are updated to obtain the first attack graph, including: analyzing the security events corresponding to the association rule vector to determine the node types that need to be updated in the updated attack graph; updating the corresponding nodes in the updated attack graph according to the node types to obtain the first attack graph.

[0132] First, the association rule vector contains the potential connections and association rule information between security events. Carefully analyze each element in the vector to understand the security events it represents and the relationship between the events. For example, an association rule vector element may mean "after security event A occurs, security event B is likely to occur." Second, find the corresponding nodes in the updated attack graph based on the security events in the association rule vector. These nodes may be asset nodes, malicious nodes, or other types of nodes. For example, if the association rule involves a specific software vulnerability security event, then find the asset nodes related to the software vulnerability in the attack graph. Then analyze the nodes related to the security event to determine their types. The node type can be determined based on the definition of the attack graph and the nature of the security event. Common node types include asset nodes (such as hardware devices, software components, etc.), malicious nodes (nodes representing attackers or malicious behaviors), intermediate nodes (nodes connecting different types of nodes), etc. For example, if the security event involves a malware attack, then the nodes related to it may be malicious nodes and attacked asset nodes.

[0133] Finally, based on the characteristics of the security incident and the impact of the association rules, determine which node types need to be updated. This may be because the occurrence of a security incident has caused the status of certain nodes to change, or a new security incident has revealed previously undiscovered node relationships. For example, if the association rule indicates that an asset node is vulnerable to a specific type of attack, then the type of this asset node may need to be updated to a "high-risk asset node."

[0134] In addition, a corresponding update strategy can be formulated based on the node types that need to be updated. The update strategy can include adding new nodes, modifying node attributes, adjusting the connection relationship between nodes, etc. For example, if an asset node needs to be marked as a high-risk node, a special attribute or label can be added to the node. According to the update strategy, the corresponding nodes in the updated attack graph are updated. If a new node needs to be added, the type and attributes of the new node are determined based on the information of the security event, and it is added to the attack graph. If the node attributes need to be modified, the corresponding node is found and its attribute value is modified. If the connection relationship between nodes needs to be adjusted, the edges between the nodes are updated according to the association of the security event.

[0135] Step D202, updating the edges between the nodes in the first attack graph according to the association relationship of the security events corresponding to the association rule vector to obtain a second attack graph.

[0136] Among them, the edges between the nodes in the first attack graph are updated according to the association relationship of the security events corresponding to the association rule vector to obtain the second attack graph, including: analyzing the association relationship between the security events corresponding to the association rule vector to obtain the association type between the security events corresponding to the association rule vector; determining the corresponding update method according to the association type, and using the update method to update the edges between the nodes in the first attack graph to obtain the second attack graph.

[0137] First, the association rule vector contains the potential connection information between security events. Carefully analyze each element in the vector to understand the security events it represents and the association rules between events. For example, an association rule vector element may mean "after security event A occurs, security event B has a higher probability of occurring." According to the association rule vector, analyze the specific relationship between the corresponding security events. These relationships can include causal relationships, temporal relationships, and relationships involving common assets. For example, if a security event always occurs after another security event, then there may be a temporal relationship between them; if two security events jointly affect the same asset, then there may be a relationship between them involving common assets.

[0138] According to the relationship between security incidents, they are classified into different types of association. Common types of association include direct causal relationship, indirect causal relationship, concurrent relationship, sequential relationship, etc. For example, if security incident A directly leads to the occurrence of security incident B, then there is a direct causal relationship between them; if security incident A and security incident B have no direct causal relationship, but are both affected by another factor, then there is an indirect causal relationship between them.

[0139] For different association types, determine the corresponding update method. The update method may include adding new edges, adjusting edge weights, modifying edge attributes, etc. For example, if there is a direct causal relationship between security events, a new edge can be added between the corresponding nodes in the first attack graph to represent this causal relationship; if there is a concurrent relationship between security events, the weights of the edges between their corresponding nodes can be adjusted to reflect the possibility of their simultaneous occurrence.

[0140] According to the determined update method, update the edges between nodes in the first attack graph. If a new edge needs to be added, determine the connected nodes and add edges between them. If the weight of the edge needs to be adjusted, find the corresponding edge and modify its weight value. If the attribute of the edge needs to be modified, determine the attribute to be modified according to the association type and modify it.

[0141] After completing the edge update, the updated attack graph is verified. Check whether the edge update correctly reflects the correlation between security events, and whether the structure and logic of the attack graph are still reasonable. After verification, if the update result is as expected, then the second attack graph is obtained. The second attack graph is the result of updating the edges based on the first attack graph according to the correlation between security events corresponding to the association rule vector.

[0142] Step D203, obtaining a complex attack link by analyzing the second attack graph.

[0143] Specifically, first, obtain the node layout in the second attack graph. Determine the location and number of different types of nodes, such as asset nodes, malicious nodes, intermediate nodes, etc. See how the edges connect the nodes. Pay attention to information such as the direction, weight, and attributes of the edges. The direction of the edge can indicate the direction of attack propagation, the weight can reflect the possibility or strength of the attack, and the attributes can provide clues about the type or characteristics of the attack.

[0144] Select a node with high attention, such as a key asset node or a known malicious node, as the starting point. Explore outward along the edges connected to the node to find possible attack path fragments. Note that a node may be connected to multiple other nodes, which means there are multiple possible attack path branches. Analyze the potential attack consequences under different connection methods and evaluate their dangers.

[0145] Starting from the identified attack path fragment, continue to expand to the surrounding nodes and try to connect different path fragments. During the expansion process, always consider the attributes and weights of the edges to ensure that the constructed path has a certain degree of rationality and possibility. Verify the attack link formed by the combination. Check whether there are unreasonable connections or contradictions. Adjust and optimize the attack link based on the verification results. You can delete the infeasible parts or add new connections to improve the attack link.

[0146] Identify key nodes and links in a complex attack chain. These nodes may be key targets of attack, vulnerable points, or intermediate nodes with significant influence. Analyze the characteristics of key nodes and links in order to formulate targeted protection measures. Consider the impact that a complex attack chain may have on the system once it is successfully implemented. This includes impacts in terms of asset loss, data leakage, service interruption, etc. Determine the priority and focus of security protection based on the impact assessment results.

[0147] The embodiment of the present application updates the nodes in the attack graph by the security events corresponding to the association rule vector to obtain the first attack graph, which can make the attack graph more accurately reflect the key node information under the current security situation. Then, the edges between the nodes in the first attack graph are updated according to the association relationship of the security events to obtain the second attack graph, which helps to further reveal the intrinsic connection and potential attack path between security events. Finally, the complex attack link is obtained by analyzing the second attack graph, which provides a clear goal and direction for the security protection of intelligent connected vehicles. Possible complex attack patterns can be identified in advance, more targeted defense strategies can be formulated, security risks can be reduced, and the security and stability of the system can be improved. At the same time, the solution can continuously adapt to new security events and changes in association relationships, dynamically update the attack graph and analyze complex attack links, and provide strong support for the continuous security protection of intelligent connected vehicles.

[0148] Step D3, using the complex attack link to update the updated initial attack graph again to obtain the target attack graph.

[0149] Specifically, the complex attack chain containing the association rule vector is analyzed. The relationship between the nodes in the complex attack chain and the impact of the association rule vector on the attack graph are understood. According to the analysis results of the complex attack chain, the updated initial attack graph is updated again. The edges between nodes can be further adjusted, and new nodes or edges can be added to more accurately reflect the patterns and relationships of complex attacks.

[0150] After another update, the target attack graph is obtained. The target attack graph can more comprehensively display the relationship between malicious nodes in security incidents and the entire process of complex attacks. Visualization tools can be used to display the target attack graph to better understand and analyze security incidents.

[0151] The method provided in the embodiment of the present application first obtains security events and corresponding event data to provide a basis for subsequent analysis. Then, the critical security elements in the event data are extracted and a knowledge graph is constructed with the automotive hardware and software assets. The critical security elements and automotive hardware and software assets are respectively used as different entity nodes. In this way, the relationship between different elements is clarified, and the problem of the neglect of the correlation of attack behaviors is solved. Then, the knowledge graph is analyzed to obtain the target malicious nodes to construct the initial attack graph, and then the attack links are obtained by analyzing the event data to update the node relationship of the initial attack graph to obtain the target attack graph, thereby providing a unified description framework for complex attacks, so that security analysts can clearly understand the entire process of the attack and the relationship between each node, avoiding the inconsistency of understanding and response caused by the lack of a unified description framework.

[0152] like Figure 5As shown in the figure, (S1) deploy a multi-level intrusion detection system, including a host-based IDS to monitor the logs, file integrity and abnormal behavior of the vehicle system, and a network-based IDS to conduct in-depth analysis and evaluation of the vehicle network traffic, so as to effectively capture and record the original security events. Then (S2) introduce the ATT&CK framework, and customize the ATT&CK-ICVs model suitable for vehicle network security in combination with the security requirements of smart cars. Then (S3) preprocess the collected security event data, unify the data format and extract key attributes to form a security event set to ensure the accuracy and consistency of subsequent analysis. (S4) Use TF-IDF and KEYBERT methods to extract keywords and construct a knowledge graph associated with assets and security events. (S5) Define the time window T, clean and filter duplicate security events, and add the source address and destination address of the security event as asset nodes to the attack graph. (S6) Combine the preprocessed security events with the ATT&CK-ICVs model to extract the attack description and improve the attack graph expression. (S7) Use the sliding window and PDFP-Growth algorithm to perform association analysis on security events and obtain the association rule vector. (S8) Import association rules into the attack graph to identify complex attack patterns and obtain complex attack descriptions. (S9) Convert the extracted attack chains and patterns into an easy-to-understand format and display them graphically in a visual interface. Finally (S10) Optimize the ATT&CK framework strategies and technologies based on the analysis results to more accurately describe attack behaviors against intelligent connected vehicles.

[0153] In this embodiment, a device for analyzing an automobile attack chain is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0154] This embodiment provides an analysis device for an automobile attack chain, such as Figure 6 As shown, including:

[0155] An acquisition module 601 is used to acquire security events of intelligent connected vehicles and event data corresponding to the security events;

[0156] Extraction module 602, used to extract the safety key elements in the event data, and construct a knowledge graph using the safety key elements and the automobile software and hardware assets corresponding to the safety events, wherein the safety key elements are used as entity nodes in the knowledge graph, and the automobile software and hardware assets are used as asset nodes of the entity nodes in the knowledge graph;

[0157] Construction module 603, used to analyze the asset node corresponding to each entity node in the knowledge graph to obtain the target malicious node, and use the target malicious node to construct an initial attack graph;

[0158] The analysis module 604 is used to analyze the event data to obtain the attack link of the security event, and use the attack link to update the node relationship of each malicious node in the initial attack graph to obtain the target attack graph.

[0159] In an embodiment of the present application, the extraction module 602 is used to query whether the security event is associated with the automotive software and hardware assets of the intelligent connected vehicle; if the security event is associated with the automotive software and hardware assets of the intelligent connected vehicle, the security key elements in the event description information of the security event are extracted; the first association relationship between the security key elements and the automotive software and hardware assets, and the second association relationship between the automotive software and hardware assets are analyzed; the security-related elements are taken as entity nodes, the automotive software and hardware assets are taken as asset nodes, the first association relationship between the security key elements and the automotive software and hardware assets is taken as the edge between the entity node and the asset node, and the second association relationship between the automotive software and hardware assets is taken as the edge between the asset nodes, to obtain a knowledge graph.

[0160] In an embodiment of the present application, construction module 603 is used to put the asset node corresponding to each entity node into a predefined attack feature map for matching within the current time window, wherein the attack feature map includes multiple malicious features; if the asset node hits any malicious feature in the attack feature map, the asset node is used as a candidate malicious node; the corresponding significance level is determined according to the malicious feature hit by the candidate malicious node; the candidate malicious nodes are arranged according to the significance level to obtain a candidate malicious node sequence, and a preset number of candidate malicious nodes are selected from the candidate malicious node sequence in turn as target malicious nodes.

[0161] In an embodiment of the present application, construction module 603 is used to obtain asset nodes related to the target malicious node from the knowledge graph; and construct an initial attack graph using the target malicious node and asset nodes related to the target malicious node.

[0162] In an embodiment of the present application, the analysis module 604 is used to obtain a pre-built intelligent connected vehicle knowledge model, wherein the intelligent connected vehicle knowledge model includes multiple attack features and preset attack features corresponding to attack categories; extract attack features from event data of each security event, and use the attack features to match the preset attack features in the intelligent connected vehicle knowledge model to obtain the target attack category hit by the attack features; analyze the attack link of the security event according to the target attack category hit by the attack features.

[0163] In an embodiment of the present application, the analysis module 604 is used to perform association analysis on security events using a sliding window and a preset analysis algorithm to obtain an association rule vector; use an attack link to update the node relationship of each malicious node in the initial attack graph to obtain an updated initial attack graph, and add the association rule vector to the updated initial attack graph to obtain a complex attack link; use the complex attack link to update the updated initial attack graph again to obtain a target attack graph.

[0164] In an embodiment of the present application, the analysis module 604 is used to obtain an alarm transaction set, and divide the alarm transaction set into data slices of multiple time segments according to a sliding window, wherein the alarm transaction set includes multiple security events, and each data slice includes at least one security event; analyze the security events in the data slices to obtain the frequency of occurrence of each security event; regard security events with an occurrence frequency higher than a preset frequency as single security events, and use single security events to construct a frequent 1-item set; based on the frequent 1-item set, use a preset analysis algorithm to mine frequent item sets for each data slice to obtain frequent item sets, and merge the frequent item sets to obtain a frequent item set set; check whether each frequent item set in the frequent item set set meets the minimum confidence condition, and if the minimum confidence condition is met, generate an association rule vector based on the frequent item set.

[0165] In the embodiment of the present application, the analysis module 604 is used to generate a candidate item set in each data slice based on the frequent 1-item set, and after the candidate item set is generated in each data slice, obtain the support count corresponding to each candidate item set; and take the candidate item set in the data slice that meets the minimum support threshold as a frequent item set.

[0166] In an embodiment of the present application, the analysis module 604 is used to update the nodes in the updated attack graph according to the security events corresponding to the association rule vector to obtain a first attack graph; update the edges between the nodes in the first attack graph according to the association relationship of the security events corresponding to the association rule vector to obtain a second attack graph; and obtain a complex attack link by analyzing the second attack graph.

[0167] In an embodiment of the present application, the analysis module 604 is used to analyze the security events corresponding to the association rule vector, determine the node types that need to be updated in the updated attack graph, and update the corresponding nodes in the updated attack graph according to the node types to obtain the first attack graph.

[0168] In an embodiment of the present application, the analysis module 604 is used to analyze the association relationship between the security events corresponding to the association rule vectors, and obtain the association type between the security events corresponding to the association rule vectors; determine the corresponding update method according to the association type, and use the update method to update the edges between the nodes in the first attack graph to obtain the second attack graph.

[0169] See also Figure 7 , Figure 7 is a schematic diagram of the structure of an electronic device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the electronic device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system).

[0170] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0171] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0172] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the use of an electronic device based on the presentation of a small program landing page, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0173] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0174] The electronic device further comprises a communication interface 30 for the electronic device to communicate with other devices or a communication network.

[0175] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0176] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for analyzing an automobile attack chain, characterized in that: The method comprises: Obtain security events of intelligent connected vehicles and event data corresponding to the security events; Extracting the critical safety factors in the event data, and constructing a knowledge graph using the critical safety factors and the automotive software and hardware assets corresponding to the security event, wherein the critical safety factors serve as entity nodes in the knowledge graph, and the automotive software and hardware assets serve as asset nodes of the entity nodes in the knowledge graph; Analyze the asset nodes corresponding to each entity node in the knowledge graph to obtain target malicious nodes, and use the target malicious nodes to construct an initial attack graph; The event data is analyzed to obtain an attack link of the security event, and the attack link is used to update the node relationship of each malicious node in the initial attack graph to obtain a target attack graph.

2. The method according to claim 1, characterized in that The extracting of the key safety elements in the event data and constructing a knowledge graph using the key safety elements and the automotive software and hardware assets corresponding to the security event includes: Query whether the security incident is associated with the vehicle software and hardware assets of the intelligent connected vehicle; If the security event is associated with the vehicle software and hardware assets of the intelligent connected vehicle, extracting the key security elements in the event description information of the security event; Analyzing a first association relationship between the critical safety factor and the automotive software and hardware assets, and a second association relationship between the automotive software and hardware assets; The knowledge graph is obtained by taking the security-related elements as entity nodes, taking the automobile software and hardware assets as asset nodes, taking the first association relationship between the security-critical elements and the automobile software and hardware assets as the edge between the entity node and the asset node, and taking the second association relationship between the automobile software and hardware assets as the edge between the asset nodes.

3. The method according to claim 1, characterized in that The analyzing the asset node corresponding to each entity node in the knowledge graph to obtain the target malicious node includes: In the current time window, the asset node corresponding to each entity node is placed into a predefined attack feature graph for matching, wherein the attack feature graph includes multiple malicious features; If the asset node hits any malicious feature in the attack feature graph, the asset node is used as a candidate malicious node; Determining the corresponding significance level according to the malicious features hit by the candidate malicious node; The candidate malicious nodes are arranged according to the significance to obtain a candidate malicious node sequence, and a preset number of candidate malicious nodes are selected in sequence from the candidate malicious node sequence as the target malicious nodes.

4. The method according to claim 3, characterized in that The using the target malicious node to construct an initial attack graph includes: Acquire asset nodes related to the target malicious node from the knowledge graph; The initial attack graph is constructed using the target malicious node and asset nodes related to the target malicious node.

5. The method according to claim 1, characterized in that: The analyzing the event data to obtain the attack chain of the security event includes: Acquire a pre-built intelligent networked vehicle knowledge model, wherein the intelligent networked vehicle knowledge model includes a plurality of attack features and preset attack features corresponding to attack categories; Extracting attack features from event data of each security event, and matching the attack features with preset attack features in the intelligent connected vehicle knowledge model to obtain a target attack category hit by the attack features; The attack chain of the security event is analyzed according to the target attack category hit by the attack feature.

6. The method according to claim 1, characterized in that The step of using the attack link to update the node relationship of each malicious node in the initial attack graph to obtain a target attack graph includes: Use sliding windows and preset analysis algorithms to perform association analysis on security events and obtain association rule vectors; Using the attack link to update the node relationship of each malicious node in the initial attack graph to obtain an updated initial attack graph, and adding the association rule vector to the updated initial attack graph to obtain a complex attack link; The updated initial attack graph is updated again using the complex attack link to obtain the target attack graph.

7. The method according to claim 6, characterized in that The method of using the sliding window and the preset analysis algorithm to perform association analysis on the security events to obtain the association rule vector includes: Acquire an alarm transaction set, and divide the alarm transaction set into data slices of multiple time segments according to a sliding window, wherein the alarm transaction set includes multiple security events, and each data slice includes at least one security event; Analyze the security events in the data shards to obtain the occurrence frequency of each security event; The security events with a frequency higher than a preset frequency are regarded as single security events, and a frequent 1-item set is constructed using the single security events; Based on the frequent 1-item set, a preset analysis algorithm is used to mine frequent itemsets for each data shard to obtain frequent itemsets, and the frequent itemsets are merged to obtain a frequent itemset set; Check whether each frequent item set in the frequent item set set satisfies a minimum confidence condition, and if the minimum confidence condition is satisfied, generate an association rule vector according to the frequent item set.

8. The method according to claim 7, characterized in that Based on the frequent 1-item set, a preset analysis algorithm is used to mine frequent item sets for each data slice, and the obtained frequent item sets include: Generate candidate item sets in each data shard based on frequent 1-item sets, and after generating candidate item sets in each data shard, obtain the support count corresponding to each candidate item set; The candidate item sets in the data slice that meet the minimum support threshold are taken as frequent item sets.

9. The method according to claim 7, characterized in that: The step of adding the association rule vector to the updated initial attack graph to obtain a complex attack link includes: According to the security events corresponding to the association rule vector, updating the nodes in the updated attack graph to obtain a first attack graph; Update the edges between the nodes in the first attack graph according to the association relationship of the security events corresponding to the association rule vector to obtain a second attack graph; By analyzing the second attack graph, a complex attack link is obtained.

10. The method according to claim 9, characterized in that The updating of nodes in the updated attack graph according to the security events corresponding to the association rule vector to obtain a first attack graph includes: Analyze the security events corresponding to the association rule vector to determine the node types that need to be updated in the updated attack graph; The corresponding nodes in the updated attack graph are updated according to the node types to obtain a first attack graph.

11. The method according to claim 9, characterized in that The updating of the edges between the nodes in the first attack graph according to the association relationship of the security events corresponding to the association rule vector to obtain the second attack graph includes: Analyze the association relationship between the security events corresponding to the association rule vectors to obtain the association type between the security events corresponding to the association rule vectors; A corresponding update method is determined according to the association type, and the edges between nodes in the first attack graph are updated using the update method to obtain a second attack graph.

12. An analysis device for an automobile attack chain, characterized in that: The device comprises: An acquisition module, used to acquire security events of intelligent network-connected vehicles and event data corresponding to the security events; An extraction module, used to extract the key safety elements in the event data, and construct a knowledge graph using the key safety elements and the automobile hardware and software assets corresponding to the security event, wherein the key safety elements serve as entity nodes in the knowledge graph, and the automobile hardware and software assets serve as asset nodes of the entity nodes in the knowledge graph; A construction module, used for analyzing the asset node corresponding to each entity node in the knowledge graph to obtain a target malicious node, and using the target malicious node to construct an initial attack graph; The analysis module is used to analyze the event data to obtain the attack chain of the security event, and use the attack chain to update the node relationship of each malicious node in the initial attack graph to obtain a target attack graph.

13. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 11 by executing the computer instructions.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 11.

Images