A method, apparatus, electronic device, and storage medium for analyzing automotive attack chains.

Abstract

This invention relates to the field of vehicle network communication, specifically to a method, apparatus, electronic device, and storage medium for analyzing automotive attack chains. This application first acquires security events and corresponding event data, providing a foundation for subsequent analysis. Next, it extracts key security elements from the event data and constructs a knowledge graph with automotive hardware and software assets. These key security elements and automotive hardware and software assets are treated as different entity nodes, thus clarifying the relationships between different elements and solving the problem of overlooking the correlation of attack behaviors. Then, it analyzes the knowledge graph to obtain target malicious nodes and constructs an initial attack graph. Finally, it analyzes the event data to obtain the attack chain and updates the node relationships in the initial attack graph to obtain the target attack graph. This provides a unified descriptive framework for complex attacks, enabling a clear understanding of the entire attack process and the relationships between various nodes, avoiding inconsistencies in understanding and response caused by the lack of a unified descriptive framework.

Description

Technical Field

[0001] This invention relates to the field of vehicle network communication, and more specifically to a method, apparatus, electronic device, and storage medium for analyzing automotive attack chains. Background Technology

[0002] As intelligent connected vehicle network systems become increasingly complex, diverse cyberattack methods are emerging, targeting vehicle control systems, sensor networks, and communication protocols, posing a direct threat to passenger safety. While current intrusion detection systems play a crucial role, traditional detection methods struggle to cope with increasingly complex cyberattacks, especially APT threats. Furthermore, existing technologies often overlook the correlation between attack behaviors when dealing with complex attack chains, leading to false positives and false negatives. The lack of a unified descriptive framework also hinders the understanding and response to complex attacks. Against this backdrop, while the ATT&CK framework provides a systematic method for describing and classifying cyberattacks, its application in the intelligent connected vehicle field lacks specificity. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a method, apparatus, electronic device and storage medium for analyzing automotive attack chains, in order to solve the problem that although the ATT&CK framework provides a systematic method for describing and classifying network attacks, it lacks specificity in the field of intelligent connected vehicles.

[0004] In a first aspect, embodiments of the present invention provide a method for analyzing automotive attack chains, the method comprising:

[0005] Acquire security events of intelligent connected vehicles and the event data corresponding to those security events;

[0006] Extract the safety key elements from the event data, and construct a knowledge graph using the safety key elements and the corresponding automotive hardware and software assets of the safety event. The safety key elements serve as entity nodes in the knowledge graph, and the automotive hardware and software assets serve as asset nodes of the entity nodes in the knowledge graph.

[0007] The target malicious node is obtained by analyzing the asset node corresponding to each entity node in the knowledge graph, and the initial attack graph is constructed using the target malicious node;

[0008] The attack chain of the security event is obtained by analyzing the event data, and the node relationship of each malicious node in the initial attack graph is updated using the attack chain to obtain the target attack graph.

[0009] Furthermore, the step of extracting safety-critical elements from the event data and constructing a knowledge graph using the safety-critical elements and the corresponding automotive hardware and software assets of the safety event includes:

[0010] Check whether the security event is related to the vehicle's hardware and software assets;

[0011] If the security event is related to the vehicle's hardware and software assets, then extract the key security elements from the event description information of the security event.

[0012] Analyze the first association between the safety-critical elements and the automotive hardware and software assets, and the second association between the automotive hardware and software assets;

[0013] The knowledge graph is obtained by taking the security-related elements as entity nodes, the automotive hardware and software assets as asset nodes, the first association between the security-critical elements and the automotive hardware and software assets as the edge between the entity nodes and the asset nodes, and the second association between the automotive hardware and software assets as the edge between the asset nodes.

[0014] Furthermore, the step of analyzing the asset nodes corresponding to each entity node in the knowledge graph to obtain the target malicious node includes:

[0015] Within the current time window, the asset node corresponding to each entity node is placed into a predefined attack feature graph for matching, wherein the attack feature graph includes multiple malicious features;

[0016] If the asset node matches any malicious feature in the attack feature map, then the asset node is considered a candidate malicious node.

[0017] The significance level is determined based on the malicious features matched by the candidate malicious nodes;

[0018] The candidate malicious nodes are ranked according to their significance to obtain a sequence of candidate malicious nodes, and a preset number of candidate malicious nodes are selected from the sequence of candidate malicious nodes as the target malicious nodes.

[0019] Furthermore, the step of constructing an initial attack graph using the target malicious node includes:

[0020] Obtain asset nodes related to the target malicious node from the knowledge graph;

[0021] The initial attack graph is constructed using the target malicious node and the asset nodes associated with the target malicious node.

[0022] Furthermore, the analysis of the event data to obtain the attack chain of the security event includes:

[0023] Obtain a pre-constructed intelligent connected vehicle knowledge model, wherein the intelligent connected vehicle knowledge model includes multiple attack features and preset attack features corresponding to the attack categories;

[0024] Attack features are extracted from the event data of each security incident, and the attack features are matched with preset attack features in the intelligent connected vehicle knowledge model to obtain the target attack category hit by the attack features.

[0025] Analyze the attack chain of the security event based on the target attack category hit by the attack characteristics.

[0026] Furthermore, the step of updating the node relationships of each malicious node in the initial attack graph using the attack chain to obtain the target attack graph includes:

[0027] A sliding window and a preset analysis algorithm are used to perform correlation analysis on security events to obtain a correlation rule vector.

[0028] The node relationships of each malicious node in the initial attack graph are updated using the attack chain to obtain an updated initial attack graph. The association rule vector is then added to the updated initial attack graph to obtain a complex attack chain.

[0029] The target attack graph is obtained by updating the initial attack graph again using the complex attack chain.

[0030] Furthermore, the step of using a sliding window and a preset analysis algorithm to perform correlation analysis on security events to obtain a correlation rule vector includes:

[0031] Obtain an alarm transaction set and divide the alarm transaction set into multiple time segment data fragments according to a sliding window. The alarm transaction set includes multiple security events, and each data fragment includes at least one security event.

[0032] Analyze the security events in the data shards to obtain the frequency of occurrence of each security event;

[0033] The security events that occur more frequently than a preset frequency are treated as individual security events, and frequent one-itemsets are constructed using these individual security events.

[0034] Based on the frequent itemsets, a preset analysis algorithm is used to mine frequent itemsets for each data shard, and the frequent itemsets are then merged to obtain a set of frequent itemsets.

[0035] Check whether each frequent itemset in the frequent itemset set satisfies the minimum confidence condition. If the minimum confidence condition is satisfied, generate an association rule vector based on the frequent itemsets.

[0036] Furthermore, based on the frequent itemsets, a preset analysis algorithm is used to mine frequent itemsets for each data shard, resulting in frequent itemsets including:

[0037] Based on frequent 1-itemsets, candidate item sets are generated for each data shard, and after generating candidate item sets for each data shard, the support count corresponding to each candidate item set is obtained;

[0038] The candidate itemsets that meet the minimum support threshold in the data shards are taken as frequent itemsets.

[0039] Furthermore, adding the association rule vector to the updated initial attack graph to obtain a complex attack chain includes:

[0040] Based on the security events corresponding to the association rule vectors, the nodes in the updated attack graph are updated to obtain the first attack graph;

[0041] The edges between nodes in the first attack graph are updated based on the association relationships of security events corresponding to the association rule vectors to obtain the second attack graph;

[0042] By analyzing the second attack graph, a complex attack chain is obtained.

[0043] Furthermore, the step of updating the nodes in the updated attack graph based on the security events corresponding to the association rule vector to obtain the first attack graph includes:

[0044] Analyze the security events corresponding to the association rule vectors to determine the types of nodes that need to be updated in the updated attack graph;

[0045] The corresponding nodes in the updated attack graph are updated according to the node type to obtain the first attack graph.

[0046] Furthermore, updating the edges between nodes in the first attack graph based on the association relationships of security events corresponding to the association rule vectors to obtain the second attack graph includes:

[0047] Analyze the association relationships between the security events corresponding to the association rule vectors to obtain the association types between the security events corresponding to the association rule vectors;

[0048] The corresponding update method is determined based on the association type, and the edges between nodes in the first attack graph are updated using the update method to obtain the second attack graph.

[0049] Secondly, embodiments of the present invention provide an analysis device for automotive attack chains, the device comprising:

[0050] The acquisition module is used to acquire security events of intelligent connected vehicles and the event data corresponding to the security events;

[0051] An extraction module is used to extract safety-critical elements from the event data and construct a knowledge graph using the safety-critical elements and the corresponding automotive hardware and software assets of the safety event. The safety-critical elements serve as entity nodes in the knowledge graph, and the automotive hardware and software assets serve as asset nodes of the entity nodes in the knowledge graph.

[0052] The construction module is used to analyze the asset nodes corresponding to each entity node in the knowledge graph to obtain the target malicious node, and to construct an initial attack graph using the target malicious node;

[0053] The analysis module is used to analyze the event data to obtain the attack chain of the security event, and use the attack chain to update the node relationship of each malicious node in the initial attack graph to obtain the target attack graph.

[0054] Thirdly, embodiments of the present invention provide an electronic device, including: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the method described in the first aspect or any corresponding embodiment thereof.

[0055] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions that cause a computer to perform the method described in the first aspect or any of its corresponding embodiments.

[0056] The method provided in this application first acquires security events and corresponding event data, providing a foundation for subsequent analysis. Next, it extracts key security elements from the event data and constructs a knowledge graph with automotive hardware and software assets. These key security elements and automotive hardware and software assets are treated as different entity nodes, thus clarifying the relationships between different elements and solving the problem of overlooking the correlation of attack behaviors. Then, it analyzes the knowledge graph to obtain target malicious nodes and constructs an initial attack graph. Finally, it analyzes the event data to obtain the attack chain and updates the node relationships in the initial attack graph to obtain the target attack graph. This provides a unified descriptive framework for complex attacks, enabling a clear understanding of the entire attack process and the relationships between various nodes, avoiding inconsistencies in understanding and response caused by the lack of a unified descriptive framework.

[0057] The method provided in this application, by querying the correlation between security events and the automotive hardware and software assets of intelligent connected vehicles, can clarify the specific scope of the impact of security events on the vehicle system, which helps to accurately locate potential security risks. If a correlation is determined, extracting key security elements can accurately grasp the core characteristics of the security event, providing crucial information for subsequent analysis and processing. Constructing the correlation between key security elements and automotive hardware and software assets, and building a knowledge graph based on these relationships, can clearly demonstrate the close connection between security-related elements and automotive hardware and software assets, enabling security analysts to intuitively understand the relationship between security events and various parts of the vehicle system. Furthermore, the construction of this knowledge graph provides a systematic framework for handling complex security issues, facilitating a comprehensive analysis of the development trajectory and potential impact paths of security events, thereby enabling more effective formulation of targeted security protection strategies and improving the overall security of intelligent connected vehicles.

[0058] The method provided in this application retrieves the source and destination addresses of security events from a knowledge graph according to a preset time window. This helps to focus on analyzing security events within a specific time period, improving the relevance and timeliness of the analysis. Constructing asset nodes using source and destination addresses clarifies the specific assets involved in the security event, providing precise targets for subsequent risk assessment and protection. Matching asset nodes with a pre-set attack signature graph allows for rapid identification of asset nodes with malicious characteristics, improving the efficiency of detecting potential threats. Using asset nodes as candidate malicious nodes and selecting a preset number of target malicious nodes allows for the screening of the most threatening nodes for focused attention, concentrating resources for in-depth analysis and response, thereby better protecting the security of intelligent connected vehicles and reducing losses caused by security risks.

[0059] The method provided in this application provides a comprehensive and systematic reference framework for analyzing security incidents by acquiring a pre-built knowledge model of intelligent connected vehicles. This model includes multiple attack features and preset attack features corresponding to attack categories, covering various possible security threat scenarios, making the analysis of security incidents more professional and accurate. Extracting attack features from the event data of security incidents and matching them with preset attack features in the knowledge model can quickly determine the target attack category to which the security incident belongs, improving the efficiency and accuracy of the analysis. Analyzing the attack chain of a security incident based on the target attack category provides a clear understanding of the attack process and methods, providing a strong basis for developing targeted security protection measures. This technical solution helps to promptly detect and respond to security threats faced by intelligent connected vehicles, improving the safety and reliability of vehicles.

[0060] The method provided in this application utilizes a sliding window and a preset analysis algorithm to perform correlation analysis on security events to obtain correlation rule vectors. This can uncover potential frequent patterns and relationships between security events, providing richer information for subsequent analysis. This helps to discover hidden security risks and attack patterns, improving insight into complex security situations. Next, the node relationships of malicious nodes in the initial attack graph are updated using the attack chain, and correlation rule vectors are added to obtain a complex attack chain. On the one hand, this allows the attack graph to more accurately reflect the actual attack situation, considering the correlation between attack behaviors and reducing the possibility of false positives and false negatives. On the other hand, the addition of correlation rule vectors provides more clues and evidence for analyzing complex attacks, helping security analysts better understand the overall picture and development trend of the attack. Finally, the initial attack graph is updated again using the complex attack chain to obtain a target attack graph, which can provide more comprehensive and accurate guidance for the security protection of intelligent connected vehicles. The target attack graph can clearly show the path of complex attacks and the relationships between various nodes, helping security personnel to formulate more effective defense strategies and improve the network security protection level of intelligent connected vehicles. Attached Figure Description

[0061] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0062] Figure 1 This is a flowchart illustrating a method for analyzing a car attack chain according to some embodiments of the present invention;

[0063] Figure 2 This is an ATT&CK-ICVs matrix model that combines intelligent vehicle safety features according to some embodiments of the present invention;

[0064] Figure 3 This is an attack chain diagram illustrating the attack chain and attack steps according to some embodiments of the present invention;

[0065] Figure 4 This is a flowchart of an association mining algorithm according to some embodiments of the present invention;

[0066] Figure 5 This is a diagram of an automotive attack chain analysis architecture according to some embodiments of the present invention;

[0067] Figure 6 This is a structural block diagram of an analysis device for a car attack chain according to an embodiment of the present invention;

[0068] Figure 7 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0069] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0070] According to embodiments of the present invention, a method, apparatus, electronic device, and storage medium for analyzing automotive attack chains are provided. It should be noted that the steps shown in the flowcharts in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0071] This embodiment provides a method for analyzing automotive attack chains. Figure 1 This is a flowchart of an analysis method for an automotive attack chain according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps:

[0072] Step S101: Obtain the security events of intelligent connected vehicles and the event data corresponding to the security events.

[0073] In this embodiment, HIDS is deployed in the vehicle system to monitor the system logs. HIDS continuously records various log information generated during system operation, including system startup and shutdown times, user login and operation records, software installation and updates, etc. These logs can provide information about the normal operating status of the vehicle system, as well as clues in case of abnormal situations.

[0074] HIDS regularly checks critical files in the vehicle's system, such as operating system files and application files, to ensure they haven't been tampered with or corrupted. If a file's hash value changes, it indicates potential malicious modification, triggering a security incident. Additionally, HIDS monitors the vehicle's system behavior in real time, including CPU usage, memory consumption, and network connectivity. Abnormal resource consumption or suspicious network connections indicate a potential security incident.

[0075] In this embodiment, NIDS is also deployed in a vehicle-to-everything (V2X) environment, enabling it to perform in-depth analysis and evaluation of V2X traffic. NIDS monitors network data packets within the V2X network and inspects data packets from different communication protocols. For example, for protocols such as CAN bus, Bluetooth, and Wi-Fi, NIDS analyzes the format, content, and source of data packets to determine if abnormal communication behavior exists. For commonly used V2X communication protocols, such as CAN bus, NIDS can detect malicious data packet injection, denial-of-service attacks, and other security events by monitoring bus traffic and analyzing packet format and ID. For Bluetooth and Wi-Fi protocols, NIDS can detect unauthorized connections, data theft, and other security events.

[0076] HIDS and NIDS continuously capture potential security events based on their respective monitoring rules and algorithms. When HIDS detects file integrity corruption or abnormal behavior, or NIDS detects abnormal network traffic, it triggers the security event capture mechanism. Security event capture can be achieved through methods such as setting thresholds and pattern matching. For example, if HIDS detects CPU usage exceeding a certain threshold, or NIDS detects a specific packet format matching a known attack pattern, it will consider a security event to have occurred.

[0077] Once a security incident is captured, the IDS system records detailed data related to the incident. For security incidents captured by HIDS, it may record the file paths involved, modification times, user operation logs, etc. For security incidents captured by NIDS, it may record the source address, destination address, protocol type, message content, etc.

[0078] Event data can be stored in log files, databases, or other formats for subsequent analysis and processing. Furthermore, to ensure data integrity and traceability, the IDS system can encrypt and sign event data to prevent tampering or forgery.

[0079] Step S102: Extract the safety key elements from the event data, and construct a knowledge graph using the safety key elements and the corresponding automotive software and hardware assets of the safety event. The safety key elements serve as entity nodes in the knowledge graph, and the automotive software and hardware assets serve as asset nodes of the entity nodes in the knowledge graph.

[0080] In this embodiment of the application, safety-critical elements are extracted from event data, and a knowledge graph is constructed using the safety-critical elements and the corresponding automotive hardware and software assets of the safety events, including the following steps A1-A4:

[0081] Step A1: Check whether the security incident is related to the vehicle's hardware and software assets of the intelligent connected vehicle.

[0082] Specifically, determining the list of automotive hardware and software assets involves several steps. First, it's necessary to identify the specific hardware and software assets within a connected vehicle, such as onboard computers, sensors, and communication modules. This can be done by consulting the vehicle's technical documentation or conducting system analysis. For the acquired and pre-processed set of security events, analyze the attributes of each event, such as event category, involved device names, source IP, and destination IP. Determine if these attributes are associated with known automotive hardware and software assets. For example, if the source or destination IP of a security event corresponds to the IP address of a particular automotive hardware or software asset, or if the name of the device involved in the event matches the name of a particular automotive hardware or software asset, then the security event can be considered associated with that asset.

[0083] Step A2: If the security incident is related to the vehicle's hardware and software assets, extract the key security elements from the event description information of the security incident.

[0084] Specifically, for security events identified as being related to automotive hardware and software assets, their event descriptions are carefully analyzed. Event descriptions may contain various forms of text content, such as log entries and error messages. TF-IDF and KEYBERT methods are used to extract keywords from the event descriptions. First, TF-IDF is used to extract preliminary keywords from the event descriptions; these are words that appear frequently and are representative of the event. Then, KEYBERT is used to refine the semantics of these preliminary keywords, yielding more representative keywords that better describe and represent the key security elements of the security event. For example, if the event description mentions "network connection anomaly," TF-IDF might extract preliminary keywords such as "network," "connection," and "anomaly," while KEYBERT might further extract more semantically accurate keywords such as "network attack" and "connection interruption."

[0085] Step A3: Analyze the first correlation between safety-critical elements and automotive hardware and software assets, and the second correlation between automotive hardware and software assets.

[0086] Specifically, the extracted critical security elements are associated with their corresponding automotive hardware and software assets. This relationship can be recorded by establishing an association table or data structure. For example, if the critical security element is "cyberattack," and the associated automotive hardware and software asset is an in-vehicle communication module, this correspondence can be recorded in the association table. The strength of the association can be determined based on factors such as the severity of the security incident and the closeness of the association between the critical security element and the automotive hardware and software asset. For example, if a security incident has a serious impact on a certain automotive hardware and software asset, then the association strength between that critical security element and that automotive hardware and software asset can be set to a higher value.

[0087] Step A4: Treat safety-related elements as entity nodes, automotive hardware and software assets as asset nodes, the first association between safety key elements and automotive hardware and software assets as edges between entity nodes and asset nodes, and the second association between automotive hardware and software assets as edges between asset nodes to obtain the knowledge graph.

[0088] Specifically, security-related elements (such as vulnerabilities and threats) are treated as entity nodes, and can be categorized and named according to their type and importance. For example, different types of threats (such as cyberattacks and physical attacks) can be created as different entity nodes. Simultaneously, automotive hardware and software assets are treated as asset nodes, named and categorized according to their type and function. Based on the established relationships between security-critical elements and automotive hardware and software assets, edges are established between entity nodes and asset nodes in the knowledge graph. These edges can have attributes, such as association strength and association time, to better describe and analyze these relationships.

[0089] As more security incidents are analyzed and processed, new entity nodes and edges can be continuously added to improve the knowledge graph. Simultaneously, visualization tools can be used to display and analyze the knowledge graph, enabling a better understanding of the relationship between security incidents and automotive hardware and software assets.

[0090] Step S103: Analyze the asset nodes corresponding to each entity node in the knowledge graph to obtain the target malicious node, and use the target malicious node to construct the initial attack graph.

[0091] In this embodiment of the application, the target malicious node is obtained by analyzing the asset node corresponding to each entity node in the knowledge graph, including the following steps B1-B4:

[0092] Step B1: Within the current time window, the asset node corresponding to each entity node is placed into a predefined attack feature graph for matching. The attack feature graph includes multiple malicious features.

[0093] Specifically, based on the established time segmentation rules, the current time range of interest is determined. For each entity node in the knowledge graph, its corresponding list of asset nodes is obtained and processed one by one. A predefined attack feature graph is read, which contains multiple known malicious feature descriptions. Each malicious feature can be a specific behavioral pattern, data characteristic, or system state, etc. The attributes, behaviors, or other relevant features of each asset node are compared one by one with the malicious features in the attack feature graph to check for any matches.

[0094] Step B2: If an asset node matches any malicious feature in the attack feature graph, then the asset node is considered a candidate malicious node.

[0095] Specifically, during the matching process, if the characteristics of an asset node match a malicious feature in the attack feature map, the asset node is considered to have matched the malicious feature. Once an asset node matches a malicious feature, it is marked as a candidate malicious node, and the malicious feature information is recorded.

[0096] Step B3: Determine the significance level based on the malicious features matched by the candidate malicious nodes.

[0097] Specifically, a significance value is assigned to each malicious feature based on factors such as its severity and frequency of occurrence. For example, some malicious features may lead to serious security vulnerabilities, thus having a higher significance value; while some relatively minor malicious features have a lower significance value. For each candidate malicious node, the corresponding significance value is found based on the malicious features it matches. If a candidate malicious node matches multiple malicious features, the overall significance value can be calculated using a weighted method.

[0098] Step B4: Arrange the candidate malicious nodes according to their salience to obtain a sequence of candidate malicious nodes, and select a preset number of candidate malicious nodes as target malicious nodes from the sequence.

[0099] Specifically, all candidate malicious nodes are sorted in descending order based on their significance value. Candidate malicious nodes with higher significance rank higher in the sequence. The number of target malicious nodes to be selected is pre-defined based on system requirements and resource constraints. From the sorted sequence of candidate malicious nodes, the first pre-defined number of candidate malicious nodes are selected as the final target malicious nodes. These target malicious nodes will be the focus of further analysis and processing.

[0100] In this embodiment of the application, constructing an initial attack graph using a target malicious node includes the following steps: obtaining asset nodes related to the target malicious node from a knowledge graph; and constructing an initial attack graph using the target malicious node and the asset nodes related to the target malicious node.

[0101] Specifically, firstly, in order to construct an initial attack graph using the target malicious node, it is necessary to obtain the asset nodes corresponding to the target malicious node. Since the target malicious node is a node identified from security incident analysis as potentially exhibiting malicious behavior, and these nodes are typically associated with specific assets, the asset nodes corresponding to the target malicious node can be found by querying a knowledge graph or based on previously established associations between asset nodes and security incidents. These asset nodes may include hardware assets (such as onboard computers, sensors, etc.), software assets (such as operating systems, applications, etc.), and data assets in intelligent connected vehicles.

[0102] Then, an initial attack graph is constructed based on the target malicious node and its corresponding asset node. In constructing the initial attack graph, the target malicious node and its corresponding asset node are treated as nodes in the graph. If there is an attack relationship or association between the target malicious node and the asset node, they can be connected by edges in the graph. For example, if a target malicious node launches an attack on an asset node, a directed edge can be drawn from the target malicious node to the asset node in the attack graph. In this way, an initial attack graph can be gradually constructed, which illustrates the potential attack paths and relationships between the target malicious node and the asset node, providing important reference for further analysis of security incidents and the development of security protection strategies.

[0103] Step S104: Analyze the event data to obtain the attack chain of the security event, and use the attack chain to update the node relationship of each malicious node in the initial attack graph to obtain the target attack graph.

[0104] In this embodiment of the application, analyzing event data to obtain the attack chain of a security event includes the following steps C1-C3:

[0105] Step C1: Obtain a pre-built intelligent connected vehicle knowledge model, wherein the intelligent connected vehicle knowledge model includes multiple attack features and preset attack features corresponding to attack categories.

[0106] Specifically, a knowledge model for intelligent connected vehicles is pre-constructed. This model can be based on research in the field of intelligent connected vehicle security, analysis of historical security incidents, and industry standards. The model includes multiple attack characteristics and preset attack characteristics corresponding to attack categories. Attack characteristics can be specific network traffic patterns, system behaviors, software vulnerability exploitation methods, etc., while attack categories can be classified according to the attack's target, means, and impact, such as network attacks, physical attacks, and software vulnerability exploitation. The constructed knowledge model for intelligent connected vehicles is stored in a suitable database or data structure for rapid subsequent retrieval and use. Relational databases, graph databases, or other data storage technologies can be used to manage the knowledge model.

[0107] like Figure 2 As shown, the ATT&CK-ICVs model is an attack matrix model for vehicle network security in the Enterprise domain, customized based on the network security characteristics of intelligent connected vehicles and built upon the enterprise-level ATT&CK framework, specifically addressing the security needs of intelligent connected vehicles. The ATT&CK framework is a widely recognized unified attack description foundation, providing a systematic method for classifying and describing attack behaviors across various security scenarios. The ATT&CK-ICVs model, starting from the ATT&CK framework, fully leverages its mature architecture and classification methods to ensure a certain degree of universality and standardization in the description of attack behaviors. The network environment of intelligent connected vehicles is complex, involving multiple aspects such as in-vehicle systems, vehicle network communication, and external network connections. The ATT&CK-ICVs model specifically analyzes and describes possible attack paths, targets, and methods to address these network security characteristics. For example, analysis of vehicle network traffic can identify specific attack patterns, such as man-in-the-middle attacks and denial-of-service attacks, which have unique manifestations and impacts in the intelligent connected vehicle environment. Intelligent connected vehicles not only face traditional network security threats but also have special requirements related to the vehicle's own functions and security. The ATT&CK-ICVs model takes into account the safety requirements of intelligent vehicles, such as the integrity protection of in-vehicle systems and the safety of autonomous driving functions.

[0108] By combining preprocessed security incident data with the ATT&CK-ICVs model, more detailed and accurate attack descriptions can be extracted from security incidents. The model provides a standardized set of attack behavior classifications and descriptive terms, enabling security analysts to quickly understand the nature and characteristics of attacks.

[0109] Step C2: Extract attack features from the event data of each security event, and match the attack features with the preset attack features in the intelligent connected vehicle knowledge model to obtain the target attack category matched by the attack features.

[0110] Specifically, for preprocessed security event data, the event data of each security event is analyzed to extract attack characteristics. Various data analysis techniques and tools, such as data mining algorithms and machine learning algorithms, can be used to automatically extract attack characteristics. For example, specific packet formats, source addresses, and destination addresses can be extracted from network traffic data, and abnormal system calls and process behaviors can be extracted from system logs.

[0111] The extracted attack features are matched against preset attack features in the intelligent connected vehicle knowledge model. Pattern matching algorithms, similarity calculation algorithms, and other techniques can be used for this matching process. If the attack features of a security event match a preset attack feature in the knowledge model, the security event is considered to have fallen into the corresponding attack category.

[0112] Based on the matching results between attack characteristics and the knowledge model, the target attack category to which the security event belongs is determined. An attack category label can be assigned to each security event to facilitate identification and handling in subsequent analysis.

[0113] Step C3: Analyze the attack chain of the security incident based on the target attack category hit by the attack characteristics.

[0114] Specifically, for each target attack category, analyze its characteristics and common attack chains. Refer to the attack category definitions in the intelligent connected vehicle knowledge model and related security research reports to understand the typical attack methods and steps employed by different attack categories. For example, cyberattacks may include steps such as exploiting network vulnerabilities to infiltrate vehicle systems and steal vehicle data; physical attacks may include steps such as damaging vehicle hardware and tampering with sensor data.

[0115] like Figure 3 As shown, based on the target attack category of the security incident and the characteristics of the analyzed attack category, an attack chain for the security incident is constructed. The attack chain can be represented by a directed graph, where nodes represent different stages or steps of the attack, and edges represent transition relationships. For example, if a security incident belongs to the network attack category, and the attack characteristics indicate that the attacker first exploited a network vulnerability to infiltrate the vehicle's in-vehicle system and then stole vehicle data, then an attack chain can be constructed from the "network vulnerability exploitation" node to the "vehicle system intrusion" node, and then to the "vehicle data theft" node.

[0116] The constructed attack chain should be verified and improved. This can be done by comparing the attack chain with actual security incident data and referencing results from other security analysis methods to check its accuracy and completeness. If any unreasonable or incomplete aspects are found, adjustments and improvements can be made to ensure that the attack chain accurately reflects the actual attack process of the security incident.

[0117] In this embodiment of the application, the node relationships of each malicious node in the initial attack graph are updated using the attack chain to obtain the target attack graph, including the following steps D1-D3:

[0118] Step D1: Use a sliding window and a preset analysis algorithm to perform correlation analysis on security events and obtain correlation rule vectors.

[0119] Specifically, the first step is to determine parameters such as the size and time span of the sliding window. The sliding window is used to divide security events for analysis in order to discover potential relationships between events. First, an alarm event set is acquired and divided into multiple time-segment data pieces according to the sliding window. Each alarm event set includes multiple security events, and each data piece includes at least one security event. Second, the security events in the data pieces are analyzed to obtain the frequency of each security event. Next, security events with a frequency higher than a preset frequency are designated as individual security events, and frequent one-itemsets are constructed using these individual security events. Then, based on the frequent one-itemsets, a preset analysis algorithm is used to mine frequent itemsets in each data piece. The resulting frequent itemsets are then merged to obtain a frequent itemset set. Finally, it is checked whether each frequent itemset in the frequent itemset set meets the minimum confidence condition. If the minimum confidence condition is met, an association rule vector is generated based on the frequent itemsets.

[0120] Among them, based on frequent 1-itemsets, a preset analysis algorithm is used to mine frequent itemsets for each data shard. The resulting frequent itemsets include: generating candidate itemsets for each data shard based on frequent 1-itemsets, and obtaining the support count corresponding to each candidate itemset after generating candidate itemsets for each data shard; and taking the candidate itemsets in the data shards that meet the minimum support threshold as frequent itemsets.

[0121] like Figure 4 As shown, the following is a detailed explanation of the above process:

[0122] The security monitoring system for intelligent connected vehicles collects various security event data, which can come from multiple sources such as intrusion detection systems, log records, and network traffic analysis. These security events are then organized into alarm transaction sets, where each transaction can represent a specific security event or a group of related security events.

[0123] Determine the size and step size of the sliding window. The window size determines the number of security events contained in each time segment, while the step size controls the speed at which the window moves. Based on the set window parameters, divide the alarm transaction set into data shards for multiple time segments. For example, if the window size is 1 hour and the step size is 30 minutes, then the security event data for each hour will be divided into one data shard.

[0124] For each data shard, analyze the security events it contains one by one. For example, data structures such as counters or hash tables can be used to record the occurrence frequency of each security event. For each security event, divide its occurrence frequency by the total number of security events in the data shard to obtain the frequency of that security event. For example, if a data shard has a total of 100 security events, and a specific security event occurs 20 times, then the frequency of that security event is 20%. Compare the frequency of occurrence with a preset frequency. The preset frequency can be set according to actual conditions, usually a relatively high value, to ensure that the selected individual security events have a certain degree of importance. If the frequency of a security event is higher than the preset frequency, it is considered an individual security event. 1-Itemset: Collect all individual security events and form them into frequent 1-itemsets. A frequent 1-itemset refers to the set of individual security events that occur frequently in the data shard.

[0125] Choose a suitable frequent itemset mining algorithm, such as the Apriori algorithm or the FP-Growth algorithm. Based on frequent one-itemsets, perform frequent itemset mining on each data shard. Starting with frequent one-itemsets, gradually expand to larger itemsets, determining frequent itemsets by calculating support (i.e., the frequency of an itemset appearing in a data shard). After frequent itemset mining has been performed on each data shard, merge the frequent itemsets obtained from each shard. Remove duplicate frequent itemsets, and obtain a set containing frequent itemsets from all data shards. Specifically, for each data shard, candidate itemsets can be generated in various ways. This embodiment generates candidate itemsets by combining elements from frequent one-itemsets. For example, if a frequent one-itemset contains security events A, B, and C, then candidate itemsets {A,B}, {A,C}, {B,C}, {A,B,C}, etc., can be generated. For each candidate itemet, check whether it appears in each security event in the data shard. If a candidate itemset appears in a security event, its support count is incremented. The support count represents the number of times a candidate itemset appears in a data shard. A minimum support threshold is set based on actual needs and data characteristics. This threshold is usually a relatively high value, indicating that the frequency of a candidate itemset appearing in a data shard must reach a certain level to be considered a frequent itemset. For each candidate itemset, its support count is compared to the minimum support threshold. If a candidate itemset's support count is greater than or equal to the minimum support threshold, then this candidate itemset is considered a frequent itemset.

[0126] For each frequent itemset in the frequent itemset set, its confidence score is calculated. The confidence score represents the probability that one itemset will occur given the occurrence of another frequent itemset. The confidence score of each frequent itemset is compared to a minimum confidence condition. The minimum confidence score can be set according to actual needs, usually a relatively high value, to ensure the reliability of the generated association rules. If a frequent itemset satisfies the minimum confidence condition, an association rule is generated based on that frequent itemset. Association rules can be represented in the form of "premise → conclusion," such as "security events A and B occur simultaneously → security event C occurs." The generated association rules are represented as vectors, with each rule corresponding to a vector element. Vector elements can contain information such as the rule's premise events, conclusion events, and association strength.

[0127] Step D2: Update the node relationships of each malicious node in the initial attack graph using the attack chain to obtain the updated initial attack graph, and add the association rule vector to the updated initial attack graph to obtain the complex attack chain.

[0128] Specifically, the node relationships of each malicious node in the initial attack graph are updated using the attack chain. Specifically, the edges between malicious nodes in the initial attack graph are adjusted according to the connections between nodes in the attack chain. If there is a direct attack relationship between two malicious nodes in the attack chain, then the corresponding edge is added or strengthened between the two nodes in the initial attack graph. This results in an updated initial attack graph. The obtained association rule vectors are then added to the updated initial attack graph. Association rule vectors can serve as additional information to help further understand the relationships between security events. Association rule vectors can be added to the attack graph as node attributes or edge attributes for use in subsequent analysis. This results in an attack graph containing complex attack chains.

[0129] Specifically, the association rule vectors are added to the updated initial attack graph to obtain a complex attack chain, including the following steps:

[0130] Step D201: Update the nodes in the updated attack graph according to the security events corresponding to the association rule vectors to obtain the first attack graph.

[0131] Specifically, the process of updating the nodes in the updated attack graph based on the security events corresponding to the association rule vectors to obtain the first attack graph includes: analyzing the security events corresponding to the association rule vectors to determine the types of nodes that need to be updated in the updated attack graph; and updating the corresponding nodes in the updated attack graph based on the node types to obtain the first attack graph.

[0132] First, the association rule vector contains potential connections and association rule information between security events. Carefully analyze each element in the vector to understand the security event it represents and the relationships between events. For example, an association rule vector element might indicate that "after security event A occurs, security event B is very likely to occur." Second, based on the security events in the association rule vector, find the corresponding nodes in the updated attack graph. These nodes could be asset nodes, malicious nodes, or other types of nodes. For example, if the association rule relates to a specific software vulnerability security event, then find the asset nodes related to that software vulnerability in the attack graph. Then analyze the nodes related to the security events to determine their types. Node types can be determined based on the definition of the attack graph and the nature of the security events. Common node types include asset nodes (such as hardware devices, software components, etc.), malicious nodes (nodes representing attackers or malicious behavior), and intermediate nodes (nodes connecting different types of nodes). For example, if a security event involves a malware attack, then the associated nodes might be malicious nodes and attacked asset nodes.

[0133] Finally, based on the characteristics of the security incident and the impact of the association rules, determine which node types need to be updated. This might be because the security incident caused changes in the state of certain nodes, or because a new security incident revealed previously undiscovered node relationships. For example, if association rules indicate that a certain asset node is vulnerable to a specific type of attack, then the type of this asset node may need to be updated to "high-risk asset node".

[0134] Additionally, corresponding update strategies can be formulated based on the identified types of nodes that need updating. Update strategies may include adding new nodes, modifying node attributes, and adjusting the connections between nodes. For example, if an asset node needs to be marked as a high-risk node, a special attribute or label can be added to that node. Following the update strategy, the corresponding nodes in the updated attack graph are updated. If a new node needs to be added, its type and attributes are determined based on security event information, and it is added to the attack graph. If node attributes need to be modified, the corresponding node is located, and its attribute values ​​are modified. If the connections between nodes need to be adjusted, the edges between nodes are updated based on the association of security events.

[0135] Step D202: Update the edges between nodes in the first attack graph according to the association relationships of security events corresponding to the association rule vectors to obtain the second attack graph.

[0136] The process of updating the edges between nodes in the first attack graph based on the association relationships of security events corresponding to the association rule vectors to obtain the second attack graph includes: analyzing the association relationships between security events corresponding to the association rule vectors to obtain the association types between security events corresponding to the association rule vectors; determining the corresponding update method based on the association type; and using the update method to update the edges between nodes in the first attack graph to obtain the second attack graph.

[0137] First, the association rule vector contains information about the potential connections between security events. Carefully analyze each element in the vector to understand the security event it represents and the association rules between them. For example, an association rule vector element might indicate that "security event B has a high probability of occurring after security event A occurs." Based on the association rule vector, analyze the specific relationships between the corresponding security events. These relationships can include causal relationships, temporal relationships, and relationships involving shared assets. For example, if one security event always occurs after another, there may be a temporal relationship between them; if two security events jointly affect the same asset, there may be a relationship of shared assets involved.

[0138] Based on the relationships between security events, they can be categorized into different association types. Common association types include direct causal relationships, indirect causal relationships, concurrent relationships, and sequential relationships. For example, if security event A directly caused security event B, then there is a direct causal relationship between them; if security events A and B do not have a direct causal relationship but are both influenced by another factor, then there is an indirect causal relationship between them.

[0139] For different types of associations, determine the appropriate update method. Update methods may include adding new edges, adjusting edge weights, and modifying edge attributes. For example, if there is a direct causal relationship between security events, a new edge can be added between the corresponding nodes in the first attack graph to represent this causal relationship; if there is a concurrent relationship between security events, the weights of the edges between their corresponding nodes can be adjusted to reflect the possibility of them occurring simultaneously.

[0140] Based on the determined update method, update the edges between nodes in the first attack graph. If new edges need to be added, identify the connected nodes and add edges between them. If edge weights need to be adjusted, find the corresponding edges and modify their weight values. If edge attributes need to be modified, determine the attributes to be modified based on the association type and modify them accordingly.

[0141] After updating the edges, the updated attack graph is verified. This involves checking whether the edge updates correctly reflect the relationships between security events, and whether the structure and logic of the attack graph remain reasonable. If the update result meets expectations after verification, the second attack graph is obtained. The second attack graph is the result of updating the edges based on the relationships between security events corresponding to the association rule vectors, building upon the first attack graph.

[0142] Step D203: By analyzing the second attack graph, a complex attack chain is obtained.

[0143] Specifically, first, obtain the node layout in the second attack graph. Determine the location and number of different types of nodes, such as asset nodes, malicious nodes, and intermediate nodes. Examine how the edges connect the nodes. Note information such as edge direction, weight, and attributes. Edge direction can indicate the direction of attack propagation, weight can reflect the probability or strength of the attack, and attributes can provide clues about the attack type or characteristics.

[0144] Choose a node with high visibility, such as a critical asset node or a known malicious node, as a starting point. Explore outwards along the edges connected to this node, searching for possible attack path segments. Note that a node may be connected to multiple other nodes, meaning there are multiple possible attack path branches. Analyze the potential attack consequences under different connection methods and assess their risk.

[0145] Starting with an identified attack path segment, continue expanding towards surrounding nodes, attempting to connect different path segments. During this expansion, always consider the edge attributes and weights to ensure the constructed paths have a certain degree of rationality and feasibility. Verify the combined attack chain. Check for any unreasonable connections or contradictions. Based on the verification results, adjust and optimize the attack chain. Infeasible parts can be deleted, or new connections can be added to improve the attack chain.

[0146] In complex attack chains, identify key nodes and links. These nodes may be critical targets, vulnerable points, or influential intermediate nodes. Analyze the characteristics of key nodes and links to develop targeted protective measures. Consider the potential impact on the system should a complex attack chain be successfully implemented, including asset loss, data breaches, and service interruptions. Based on the impact assessment results, determine the priorities and focus of security protection.

[0147] This application's embodiment updates the nodes in the attack graph using security events corresponding to association rule vectors to obtain a first attack graph, enabling the attack graph to more accurately reflect key node information under the current security situation. Next, based on the association relationships of security events, the edges between nodes in the first attack graph are updated to obtain a second attack graph, which helps to further reveal the inherent connections between security events and potential attack paths. Finally, by analyzing the second attack graph, complex attack chains are obtained, providing clear goals and directions for the security protection of intelligent connected vehicles. Possible complex attack patterns can be identified in advance, allowing for the development of more targeted defense strategies, reducing security risks, and improving system security and stability. Simultaneously, this solution can continuously adapt to changes in new security events and association relationships, dynamically updating the attack graph and analyzing complex attack chains, providing strong support for the continuous security assurance of intelligent connected vehicles.

[0148] Step D3: Update the initial attack graph again using the complex attack chain to obtain the target attack graph.

[0149] Specifically, we analyze complex attack chains containing association rule vectors. We understand the relationships between nodes in the complex attack chain and the impact of association rule vectors on the attack graph. Based on the analysis results of the complex attack chain, we update the initial attack graph again. We can further adjust the edges between nodes, adding new nodes or edges to more accurately reflect the patterns and relationships of complex attacks.

[0150] After further updates, the target attack graph is obtained. The target attack graph provides a more comprehensive view of the relationships between malicious nodes in a security incident, as well as the entire process of a complex attack. Visualization tools can be used to display the target attack graph for better understanding and analysis of security incidents.

[0151] The method provided in this application first acquires security events and corresponding event data, providing a foundation for subsequent analysis. Next, it extracts key security elements from the event data and constructs a knowledge graph with automotive hardware and software assets. These key security elements and automotive hardware and software assets are treated as different entity nodes, thus clarifying the relationships between different elements and solving the problem of overlooking the correlation of attack behaviors. Then, it analyzes the knowledge graph to obtain target malicious nodes and constructs an initial attack graph. Finally, it analyzes the event data to obtain the attack chain and updates the node relationships in the initial attack graph to obtain the target attack graph. This provides a unified descriptive framework for complex attacks, enabling security analysts to clearly understand the entire attack process and the relationships between various nodes, avoiding inconsistencies in understanding and response caused by the lack of a unified descriptive framework.

[0152] like Figure 5As shown, (S1) a multi-layered intrusion detection system is deployed, including a host-based IDS to monitor the logs, file integrity, and abnormal behavior of the vehicle system, and a network-based IDS to conduct in-depth analysis and evaluation of vehicle network traffic, thereby effectively capturing and recording original security events. Next, (S2) the ATT&CK framework is introduced, and an ATT&CK-ICVs model suitable for vehicle network security is customized based on the security requirements of intelligent vehicles. Then, (S3) the collected security event data is preprocessed, the data format is unified, and key attributes are extracted to form a security event set, ensuring the accuracy and consistency of subsequent analysis. (S4) TF-IDF and KEYBERT methods are used to extract keywords and construct a knowledge graph linking assets and security events. (S5) A time window T is defined, duplicate security events are cleaned and filtered, and the source and destination addresses of security events are added as asset nodes to the attack graph. (S6) Combining the preprocessed security events with the ATT&CK-ICVs model, attack descriptions are extracted and the attack graph representation is improved. (S7) A sliding window and PDFP-Growth algorithm are used to perform association analysis on security events, obtaining association rule vectors. (S8) Import the association rules into the attack graph to identify complex attack patterns and obtain complex attack descriptions. (S9) Convert the extracted attack chains and patterns into an easy-to-understand format and display them graphically in a visualization interface. Finally (S10) Optimize the ATT&CK framework strategy and techniques based on the analysis results to more accurately describe attack behaviors against intelligent connected vehicles.

[0153] This embodiment also provides an analysis device for a vehicle attack chain, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0154] This embodiment provides an analysis device for automotive attack chains, such as... Figure 6 As shown, it includes:

[0155] The acquisition module 601 is used to acquire safety events of intelligent connected vehicles and the event data corresponding to the safety events.

[0156] The extraction module 602 is used to extract safety key elements from event data and construct a knowledge graph using the safety key elements and the corresponding automotive software and hardware assets of the safety event. The safety key elements are used as entity nodes in the knowledge graph, and the automotive software and hardware assets are used as asset nodes of entity nodes in the knowledge graph.

[0157] Module 603 is used to analyze the asset nodes corresponding to each entity node in the knowledge graph to obtain the target malicious nodes, and to use the target malicious nodes to construct the initial attack graph.

[0158] Analysis module 604 is used to analyze event data to obtain the attack chain of the security event, and use the attack chain to update the node relationship of each malicious node in the initial attack graph to obtain the target attack graph.

[0159] In this embodiment, the extraction module 602 is used to query whether a security event is related to the automotive hardware and software assets of an intelligent connected vehicle; if the security event is related to the automotive hardware and software assets of an intelligent connected vehicle, then the security key elements in the event description information of the security event are extracted; the first association between the security key elements and the automotive hardware and software assets, and the second association between the automotive hardware and software assets are analyzed; the security-related elements are used as entity nodes, the automotive hardware and software assets are used as asset nodes, the first association between the security key elements and the automotive hardware and software assets is used as the edge between the entity nodes and the asset nodes, and the second association between the automotive hardware and software assets is used as the edge between the asset nodes, thus obtaining a knowledge graph.

[0160] In this embodiment, the construction module 603 is used to match the asset node corresponding to each entity node in a predefined attack feature map within the current time window. The attack feature map includes multiple malicious features. If an asset node hits any malicious feature in the attack feature map, the asset node is selected as a candidate malicious node. The significance of the malicious features hit by the candidate malicious node is determined. The candidate malicious nodes are arranged according to the significance to obtain a sequence of candidate malicious nodes. A preset number of candidate malicious nodes are selected from the sequence of candidate malicious nodes as target malicious nodes.

[0161] In this embodiment, the construction module 603 is used to obtain asset nodes related to the target malicious node from the knowledge graph; and to construct an initial attack graph using the target malicious node and the asset nodes related to the target malicious node.

[0162] In this embodiment, the analysis module 604 is used to obtain a pre-built intelligent connected vehicle knowledge model, wherein the intelligent connected vehicle knowledge model includes multiple attack features and preset attack features corresponding to attack categories; extract attack features from the event data of each security event, match the attack features with the preset attack features in the intelligent connected vehicle knowledge model to obtain the target attack category hit by the attack features; and analyze the attack chain of the security event based on the target attack category hit by the attack features.

[0163] In this embodiment of the application, the analysis module 604 is used to perform correlation analysis on security events using a sliding window and a preset analysis algorithm to obtain a correlation rule vector; update the node relationship of each malicious node in the initial attack graph using the attack chain to obtain an updated initial attack graph, and add the correlation rule vector to the updated initial attack graph to obtain a complex attack chain; update the updated initial attack graph again using the complex attack chain to obtain a target attack graph.

[0164] In this embodiment, the analysis module 604 is used to acquire an alarm transaction set and divide the alarm transaction set into multiple time segment data shards according to a sliding window. The alarm transaction set includes multiple security events, and each data shard includes at least one security event. The analysis module analyzes the security events in the data shards to obtain the frequency of occurrence of each security event. Security events with a frequency higher than a preset frequency are taken as individual security events, and frequent one-itemsets are constructed using these individual security events. Based on the frequent one-itemsets, a preset analysis algorithm is used to mine frequent itemsets in each data shard. The frequent itemsets are then merged to obtain a frequent itemset set. The analysis module checks whether each frequent itemset in the frequent itemset set meets the minimum confidence condition. If the minimum confidence condition is met, an association rule vector is generated based on the frequent itemsets.

[0165] In this embodiment of the application, the analysis module 604 is used to generate candidate itemsets in each data shard based on frequent 1-itemsets, and after generating candidate itemsets in each data shard, obtain the support count corresponding to each candidate itemset; and take the candidate itemsets in the data shard that meet the minimum support threshold as frequent itemsets.

[0166] In this embodiment of the application, the analysis module 604 is used to update the nodes in the updated attack graph according to the security events corresponding to the association rule vectors to obtain a first attack graph; update the edges between the nodes in the first attack graph according to the association relationship of the security events corresponding to the association rule vectors to obtain a second attack graph; and obtain a complex attack chain by analyzing the second attack graph.

[0167] In this embodiment of the application, the analysis module 604 is used to analyze the security events corresponding to the association rule vectors, determine the node types that need to be updated in the updated attack graph, and update the corresponding nodes in the updated attack graph according to the node types to obtain the first attack graph.

[0168] In this embodiment of the application, the analysis module 604 is used to analyze the association relationship between security events corresponding to the association rule vector, obtain the association type between security events corresponding to the association rule vector; determine the corresponding update method according to the association type, and use the update method to update the edges between nodes in the first attack graph to obtain the second attack graph.

[0169] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of an electronic device provided in an optional embodiment of the present invention, such as... Figure 7 As shown, the electronic device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise as required. The processors can process instructions executed within the electronic device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple electronic devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system).

[0170] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0171] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0172] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device as displayed on a mini-program landing page. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0173] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0174] The electronic device also includes a communication interface 30 for communicating with other devices or communication networks.

[0175] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0176] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for analyzing automotive attack chains, characterized in that, The method includes: Acquire security events of intelligent connected vehicles and the event data corresponding to the security events; Extract the safety key elements from the event data, and construct a knowledge graph using the safety key elements and the corresponding automotive hardware and software assets of the safety event. The safety key elements serve as entity nodes in the knowledge graph, and the automotive hardware and software assets serve as asset nodes of the entity nodes in the knowledge graph. The target malicious node is obtained by analyzing the asset node corresponding to each entity node in the knowledge graph, and the initial attack graph is constructed using the target malicious node; The attack chain of the security event is obtained by analyzing the event data, and the node relationship of each malicious node in the initial attack graph is updated using the attack chain to obtain the target attack graph.

2. The method according to claim 1, characterized in that, The step of extracting key safety elements from the event data and constructing a knowledge graph using the key safety elements and the corresponding automotive hardware and software assets of the safety event includes: Check whether the security event is related to the vehicle's hardware and software assets; If the security event is related to the vehicle's hardware and software assets, then extract the key security elements from the event description information of the security event. Analyze the first association between the safety-critical elements and the automotive hardware and software assets, and the second association between the automotive hardware and software assets; The knowledge graph is obtained by taking the safety key elements as entity nodes, the automotive software and hardware assets as asset nodes, the first association between the safety key elements and the automotive software and hardware assets as the edge between the entity nodes and the asset nodes, and the second association between the automotive software and hardware assets as the edge between the asset nodes.

3. The method according to claim 1, characterized in that, The process of analyzing the asset nodes corresponding to each entity node in the knowledge graph to obtain the target malicious node includes: Within the current time window, the asset node corresponding to each entity node is placed into a predefined attack feature graph for matching, wherein the attack feature graph includes multiple malicious features; If the asset node matches any malicious feature in the attack feature map, then the asset node is considered a candidate malicious node. The significance level is determined based on the malicious features matched by the candidate malicious nodes; The candidate malicious nodes are ranked according to their significance to obtain a sequence of candidate malicious nodes, and a preset number of candidate malicious nodes are selected from the sequence of candidate malicious nodes as the target malicious nodes.

4. The method according to claim 3, characterized in that, The construction of the initial attack graph using the target malicious node includes: Obtain asset nodes related to the target malicious node from the knowledge graph; The initial attack graph is constructed using the target malicious node and the asset nodes associated with the target malicious node.

5. The method according to claim 1, characterized in that, The analysis of the event data to obtain the attack chain of the security event includes: Obtain a pre-constructed intelligent connected vehicle knowledge model, wherein the intelligent connected vehicle knowledge model includes multiple attack features and preset attack features corresponding to attack categories; Attack features are extracted from the event data of each security incident, and the attack features are matched with preset attack features in the intelligent connected vehicle knowledge model to obtain the target attack category hit by the attack features. Analyze the attack chain of the security event based on the target attack category hit by the attack characteristics.

6. The method according to claim 1, characterized in that, The step of updating the node relationships of each malicious node in the initial attack graph using the attack chain to obtain the target attack graph includes: A sliding window and a preset analysis algorithm are used to perform correlation analysis on security events to obtain a correlation rule vector. The node relationships of each malicious node in the initial attack graph are updated using the attack chain to obtain an updated initial attack graph. The association rule vector is then added to the updated initial attack graph to obtain a complex attack chain. The target attack graph is obtained by updating the initial attack graph again using the complex attack chain.

7. The method according to claim 6, characterized in that, The method of using a sliding window and a preset analysis algorithm to perform correlation analysis on security events to obtain a correlation rule vector includes: Obtain an alarm transaction set and divide the alarm transaction set into multiple time segment data fragments according to a sliding window. The alarm transaction set includes multiple security events, and each data fragment includes at least one security event. Analyze the security events in the data shards to obtain the frequency of occurrence of each security event; The security events that occur more frequently than a preset frequency are treated as individual security events, and frequent one-itemsets are constructed using these individual security events. Based on the frequent itemsets, a preset analysis algorithm is used to mine frequent itemsets for each data shard, and the frequent itemsets are then merged to obtain a set of frequent itemsets. Check whether each frequent itemset in the frequent itemset set satisfies the minimum confidence condition. If the minimum confidence condition is satisfied, generate an association rule vector based on the frequent itemsets.

8. The method according to claim 7, characterized in that, The frequent itemsets obtained by mining each data shard based on the frequent 1-itemsets using a preset analysis algorithm include: Based on frequent 1-itemsets, candidate item sets are generated for each data shard, and after generating candidate item sets for each data shard, the support count corresponding to each candidate item set is obtained; The candidate itemsets that meet the minimum support threshold in the data shards are taken as frequent itemsets.

9. The method according to claim 7, characterized in that, The step of adding the association rule vector to the updated initial attack graph to obtain a complex attack chain includes: Based on the security events corresponding to the association rule vectors, the nodes in the updated attack graph are updated to obtain the first attack graph; The edges between nodes in the first attack graph are updated based on the association relationships of security events corresponding to the association rule vectors to obtain the second attack graph; By analyzing the second attack graph, a complex attack chain is obtained.

10. The method according to claim 9, characterized in that, The step of updating the nodes in the updated attack graph based on the security events corresponding to the association rule vector to obtain the first attack graph includes: Analyze the security events corresponding to the association rule vectors to determine the types of nodes that need to be updated in the updated attack graph; The corresponding nodes in the updated attack graph are updated according to the node type to obtain the first attack graph.

11. The method according to claim 9, characterized in that, The step of updating the edges between nodes in the first attack graph based on the association relationships of security events corresponding to the association rule vector to obtain the second attack graph includes: Analyze the association relationships between the security events corresponding to the association rule vectors to obtain the association types between the security events corresponding to the association rule vectors; The corresponding update method is determined based on the association type, and the edges between nodes in the first attack graph are updated using the update method to obtain the second attack graph.

12. An analysis device for a car attack chain, characterized in that, The device includes: The acquisition module is used to acquire security events of intelligent connected vehicles and the event data corresponding to the security events; An extraction module is used to extract safety-critical elements from the event data and construct a knowledge graph using the safety-critical elements and the corresponding automotive hardware and software assets of the safety event. The safety-critical elements serve as entity nodes in the knowledge graph, and the automotive hardware and software assets serve as asset nodes of the entity nodes in the knowledge graph. The construction module is used to analyze the asset nodes corresponding to each entity node in the knowledge graph to obtain the target malicious node, and to construct an initial attack graph using the target malicious node; The analysis module is used to analyze the event data to obtain the attack chain of the security event, and use the attack chain to update the node relationship of each malicious node in the initial attack graph to obtain the target attack graph.

13. An electronic device, characterized in that, include: A memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, the processor executing the computer instructions to perform the method of any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the method of any one of claims 1 to 11.

Images