Intrusion detection method and device

Abstract

The invention discloses an intrusion detection method and device, and relates to the technical field of network security. The method comprises the following steps: a first communication node obtains a first request, wherein the first request is used for requesting to establish a first process; if the first request meets a first condition, the first process is determined to be an abnormal process, and the first condition comprises at least one of the following items: the first process is associated with a second process, and the second process is used for performing data read-write access on the first communication node through network connection; the input / output of the first process is bound to a network port; and terminating the establishment of the first process. According to the method, intrusion attacks can be effectively blocked in time in a complex network structure, and the attack difficulty of attackers is increased.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an intrusion detection method and device. Background Art

[0002] With the development and progress of science and technology, network structures are becoming increasingly complex and network security threats are becoming more prominent. Some attacks are easier to detect and prohibit, but there are still some attacks that are difficult to detect.

[0003] For example, a forward bind shell is when the attacker runs a network service on the target machine, and the attacker's machine actively establishes a connection with the target machine. This attack method is relatively easy to prohibit by setting a firewall policy on the target machine.

[0004] For example, a reverse shell is a common method used by the attacker's machine to reside on the target machine. The attacker opens a port on the machine to run a network service, and then sends a command (payload) to the target machine. The execution of the payload triggers the target machine to actively establish a connection with the attacker's machine. Since a reverse shell is actively established by the target machine, the firewall policy cannot distinguish whether this is the intention of a legitimate user or an intrusion attack, so it is not easy to block the intrusion attack through the set firewall policy.

[0005] Therefore, in the increasingly complex network structure, how to design and develop intrusion detection solutions remains an important issue that needs to be solved urgently. Summary of the invention

[0006] The embodiments of the present application provide an intrusion detection method and device for timely and effectively blocking intrusion attacks in a complex network structure, thereby increasing the difficulty of intrusion for attackers.

[0007] In the first aspect, the embodiment of the present application provides an intrusion detection method, which can be executed by a first communication node, and the first communication node is a communication node in a communication system, which can be specifically implemented as a communication device, and the communication device can be an independent device, or a chip or component in a device, or software, and the communication device can be set in a terminal device. Exemplarily, the communication system to which the first communication node belongs can be a vehicle-mounted communication system, and the first communication node can be any electronic control unit (electronic control unit, ECU) in the vehicle-mounted communication system, and the ECU specifically includes but is not limited to the control domain of any of the following: vehicle network intelligent terminal T-BOX, intelligent cockpit CDC, intelligent driving domain ADAS, vehicle control VDC, central gateway VIU, motor control unit MCU, and the embodiment of the present application does not limit the product form or deployment method of the first communication node.

[0008] The method includes: obtaining a first request, the first request being used to request the establishment of a first process; if the first request satisfies a first condition, determining that the first process is an abnormal process, wherein the first condition includes at least one of the following: the first process is associated with a second process, the second process being used to read and write data to the first communication node through a network connection; the input / output of the first process is bound to a network port; and terminating the establishment of the first process.

[0009] Through the above method, the first communication node can perform feature analysis on the first request through a preset first condition to determine whether the first request is initiated by an attacker, so as to timely and effectively detect and block intrusion attacks and increase the difficulty of the attacker's attack. Among them, the first communication node can be a communication node in a simple network structure, which has the ability to communicate directly with an external network. Alternatively, the first communication node can be a communication node in a complex network structure, and the first communication node has the ability to communicate directly or indirectly with an external network.

[0010] In combination with the first aspect, in a possible implementation manner, the associating the first process with the second process includes: the process tree to which the first process belongs includes the second process; and / or the parameters of the first process are used to execute the second process.

[0011] In combination with the first aspect, in a possible implementation manner, the process tree to which the first process belongs includes a second process, specifically including: a parent process of the first process is the second process.

[0012] In combination with the first aspect, in a possible implementation manner, before the first request satisfies the first condition, the method may further include: determining that the first process is a process for a user to interact with the system.

[0013] In combination with the first aspect, in a possible implementation manner, the method may further include: performing feature analysis on the first process, and adding features characterizing the first process as an abnormal process to an abnormal feature library.

[0014] In combination with the first aspect, in a possible implementation manner, the feature characterizing the first process as an abnormal process includes: input / output of the first process is bound to a network port through a camouflage tool.

[0015] In combination with the first aspect, in a possible implementation, the method further includes: performing feature analysis on a third process, and adding features characterizing the third process as an abnormal process to an abnormal feature library, the third process including a process running on the first communication node.

[0016] In combination with the first aspect, in a possible implementation, the features characterizing the third process as an abnormal process may include: the input / output of the third process is bound to a network port through a camouflage tool; and / or the third process has abnormal network connection behavior.

[0017] In combination with the first aspect, in a possible implementation manner, the method may further include: matching the script file of the first communication node with a malicious script resource library stored in a third-party device; if the match is successful, determining that the script file is a malicious script file.

[0018] In combination with the first aspect, in a possible implementation manner, the method may further include: deleting the malicious script file.

[0019] In combination with the first aspect, in a possible implementation, the first communication node is connected to at least one second communication node, and the first communication node and the at least one second communication node belong to the same communication system; the network port includes a communication port between the first communication node and an external network, and / or an internal communication port between the first communication node and the at least one second communication node.

[0020] In combination with the first aspect, in a possible implementation method, the communication system is a vehicle-mounted communication system, and the first communication node includes the control domain of any one of the following: Internet of Vehicles intelligent terminal T-BOX, smart cockpit CDC, intelligent driving assistance system ADAS, vehicle control VDC, central gateway VIU, motor control unit MCU.

[0021] In combination with the first aspect, in a possible implementation manner, the first process is a shell process used to remotely reside in the first communication node.

[0022] In a second aspect, an embodiment of the present application provides an intrusion detection method, which is applied to a first communication node, and the method includes: performing feature analysis on a third process to obtain a first feature, wherein the third process includes a process running on the first communication node, and the first feature is a feature that characterizes the third process as an abnormal process, and the first feature includes at least one of the following: the input / output of the third process is bound to a network port through a camouflage tool; and / or the third process has abnormal network connection behavior; and the first feature is added to an abnormal feature library.

[0023] In combination with the second aspect, in a possible implementation, the method further includes: matching the script file of the first communication node with a malicious script resource library stored in a third-party device; if the match is successful, determining that the script file is a malicious script file.

[0024] In combination with the second aspect, in a possible implementation manner, the method further includes: deleting the malicious script file.

[0025] In combination with the second aspect, in a possible implementation, the first communication node is connected to at least one second communication node, and the first communication node and the at least one second communication node belong to the same communication system; the network port includes a communication port between the first communication node and an external network, and / or an internal communication port between the first communication node and the at least one second communication node.

[0026] In combination with the second aspect, in a possible implementation method, the communication system is a vehicle-mounted communication system, and the first communication node includes the control domain of any one of the following: Internet of Vehicles intelligent terminal T-BOX, smart cockpit CDC, intelligent driving assistance system ADAS, vehicle control VDC, central gateway VIU, motor control unit MCU.

[0027] In combination with the second aspect, in a possible implementation manner, the first process is a shell process used to remotely reside in the first communication node.

[0028] In a third aspect, an embodiment of the present application provides an intrusion detection device, including: an acquisition unit, used to acquire a first request, the first request being used to request the establishment of a first process; a determination unit, used to determine that the first process is an abnormal process if the first request satisfies a first condition, wherein the first condition includes at least one of the following: the first process is associated with a second process, the second process being used to read and write data to the first communication node through a network connection; the input / output of the first process is bound to a network port; and a control unit, used to terminate the establishment of the first process.

[0029] In combination with the third aspect, in a possible implementation manner, the associating the first process with the second process includes: the process tree to which the first process belongs includes the second process; and / or the parameters of the first process are used to execute the second process.

[0030] In combination with the third aspect, in a possible implementation manner, the process tree to which the first process belongs includes a second process, specifically including: a parent process of the first process is the second process.

[0031] In combination with the third aspect, in a possible implementation manner, before the first request satisfies the first condition, the method may further include: determining that the first process is a process for the user to interact with the system.

[0032] In combination with the third aspect, in a possible implementation manner, the method may further include: performing feature analysis on the first process, and adding features characterizing the first process as an abnormal process to an abnormal feature library.

[0033] In combination with the third aspect, in a possible implementation manner, the feature that characterizes the first process as an abnormal process includes: the input / output of the first process is bound to a network port through a camouflage tool.

[0034] In combination with the third aspect, in a possible implementation, the method further includes: performing feature analysis on a third process, and adding features characterizing the third process as an abnormal process to an abnormal feature library, wherein the third process includes a process running on the first communication node.

[0035] In combination with the third aspect, in a possible implementation, the features characterizing the third process as an abnormal process may include: the input / output of the third process is bound to a network port through a camouflage tool; and / or the third process has abnormal network connection behavior.

[0036] In combination with the third aspect, in a possible implementation, the method may further include: matching the script file of the first communication node with a malicious script resource library stored in a third-party device; if the match is successful, determining that the script file is a malicious script file.

[0037] In combination with the third aspect, in a possible implementation manner, the method may further include: deleting the malicious script file.

[0038] In combination with the third aspect, in a possible implementation, the first communication node is connected to at least one second communication node, and the first communication node and the at least one second communication node belong to the same communication system; the network port includes a communication port between the first communication node and an external network, and / or an internal communication port between the first communication node and the at least one second communication node.

[0039] In combination with the third aspect, in a possible implementation method, the communication system is a vehicle-mounted communication system, and the first communication node includes the control domain of any one of the following: Internet of Vehicles intelligent terminal T-BOX, smart cockpit CDC, intelligent driving assistance system ADAS, vehicle control VDC, central gateway VIU, and motor control unit MCU.

[0040] In combination with the third aspect, in a possible implementation manner, the first process is a shell process used to remotely reside in the first communication node.

[0041] In a fourth aspect, an embodiment of the present application provides an intrusion detection device, comprising: an analysis unit, configured to perform feature analysis on a third process to obtain a first feature, wherein the third process includes a process running on the first communication node, and the first feature is a feature that characterizes the third process as an abnormal process, wherein the first feature includes at least one of the following: the input / output of the third process is bound to a network port through a camouflage tool; and / or the third process has abnormal network connection behavior; and a storage unit, configured to add the first feature to an abnormal feature library.

[0042] In combination with the fourth aspect, in a possible implementation, the method further includes: matching the script file of the first communication node with a malicious script resource library stored in a third-party device; if the match is successful, determining that the script file is a malicious script file.

[0043] In combination with the fourth aspect, in a possible implementation manner, the method further includes: deleting the malicious script file.

[0044] In combination with the fourth aspect, in a possible implementation, the first communication node is connected to at least one second communication node, and the first communication node and the at least one second communication node belong to the same communication system; the network port includes a communication port between the first communication node and an external network, and / or an internal communication port between the first communication node and the at least one second communication node.

[0045] In combination with the fourth aspect, in a possible implementation method, the communication system is a vehicle-mounted communication system, and the first communication node includes the control domain of any one of the following: Internet of Vehicles intelligent terminal T-BOX, smart cockpit CDC, intelligent driving assistance system ADAS, vehicle control VDC, central gateway VIU, and motor control unit MCU.

[0046] In combination with the fourth aspect, in a possible implementation manner, the first process is a shell process for remotely residing in the first communication node.

[0047] In a fifth aspect, an embodiment of the present application provides a communication device, comprising: a communication interface for communicating with other devices; and a processor coupled to the communication interface, so that the communication device executes the method described in the first aspect and any possible implementation of the first aspect, or executes the method described in the second aspect and any possible implementation of the second aspect.

[0048] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program. When the computer program runs on a computer, the computer executes the method described in the first aspect and any possible implementation of the first aspect, or executes the method described in the second aspect and any possible implementation of the second aspect.

[0049] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program runs on a computer, it enables the computer to execute the method described in the first aspect and any possible implementation of the first aspect, or execute the method described in the second aspect and any possible implementation of the second aspect.

[0050] In an eighth aspect, an embodiment of the present application provides a chip, comprising a processor, wherein the processor is coupled to a memory and is used to execute a computer program or instructions stored in the memory. When the computer program or instructions are executed, the method described in the first aspect and any possible implementation of the first aspect is implemented, or the method described in the second aspect and any possible implementation of the second aspect is implemented.

[0051] In a ninth aspect, an embodiment of the present application provides a vehicle, including a method for implementing the method described in the first aspect and any possible implementation of the first aspect, or a method for implementing the second aspect and any possible implementation of the second aspect.

[0052] In a tenth aspect, an embodiment of the present application provides a terminal device, including a unit for implementing the method described in the first aspect and any possible design of the first aspect, or a unit for implementing the method described in the second aspect and any possible design of the second aspect. By way of example, the terminal device includes, but is not limited to: intelligent transportation equipment (such as cars, ships, drones, trains, trucks, etc.), intelligent manufacturing equipment (such as robots, industrial equipment, intelligent logistics, intelligent factories, etc.), and intelligent terminals (mobile phones, computers, tablet computers, PDAs, desktops, headphones, speakers, wearable devices, vehicle-mounted devices, etc.).

[0053] Based on the implementations provided in the above aspects, the embodiments of the present application can be further combined to provide more implementations.

[0054] The technical effects that can be achieved by any possible implementation method in any of the third to tenth aspects mentioned above can be referred to the description of the technical effects that can be achieved by any possible implementation method in any of the first to second aspects mentioned above, and the repetitions will not be discussed here. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1a A schematic diagram showing a communication system to which an embodiment of the present application is applicable;

[0056] Figure 1b A schematic diagram of a bus topology is shown;

[0057] Figure 2 A schematic diagram of a vehicle-mounted communication system according to an embodiment of the present application is shown;

[0058] Figure 3 A schematic diagram showing a flow chart of an intrusion detection method according to an embodiment of the present application is shown;

[0059] Figure 4 A schematic diagram showing a communication device according to an embodiment of the present application is shown;

[0060] Figure 5 A schematic diagram of a communication device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0061] The embodiments of the present application provide an intrusion detection method and device for timely and effectively blocking intrusion attacks in a complex network structure, thereby increasing the difficulty of intrusion for attackers. Among them, the method and the device are based on the same technical concept. Since the principles of solving problems by the method and the device are similar, the implementation of the device and the method can refer to each other, and the repetitions will not be repeated. Moreover, in each embodiment of the present application, if there is no special explanation and logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form a new embodiment according to their inherent logical relationships.

[0062] It should be noted that in the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0063] Furthermore, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the priority or importance of multiple objects. For example, the first device and the second device are only used to distinguish different electronic devices, rather than indicating the difference in priority or importance of the two devices. For example, in some embodiments, the method steps performed by the first device and the second device can be interchangeable.

[0064] Figure 1a FIG. 1 is a schematic diagram showing a communication system to which the embodiment of the present application is applicable. Figure 1a As shown, the communication system 10 may include at least one communication node, represented as communication node 10_1, communication node 10_2, communication node 10_3, ..., communication node 10_n, where n is an integer greater than or equal to 1, indicating the number of communication nodes. Different communication nodes may communicate with each other to collaboratively implement the services provided by the communication system.

[0065] In one example, the at least one communication node may have a preset communication topology. Exemplarily, the communication topology may be classified according to shape, and may include but is not limited to any of the following: star, ring, bus, tree, bus / star, and mesh topologies. Taking the bus topology as an example, see Figure 1b As shown, each communication node in the communication system 10 can be connected via a bus (eg, a coaxial cable) so that different communication nodes can communicate with each other.

[0066] Figure 1a and Figure 1b In the communication system shown, any communication node can be used as a first communication node, can communicate with an external network directly or indirectly, and can be used to implement the intrusion detection method of the embodiment of the present application. For ease of distinction, in the following description, the communication nodes other than the first communication node in the at least one communication node can be represented as second communication nodes, and the first communication node can communicate with at least one second communication node to implement corresponding services. During operation, the first communication node can implement the intrusion detection method of the embodiment of the present application.

[0067] In one example, Figure 1a or Figure 1b The communication system in can be realized as Figure 2The vehicle communication system 20 shown may include a plurality of different components / execution domains deployed according to a preset topology, including but not limited to a telematics BOX (T-BOX) 20_1, a cockpit domain controller (CDC) 20_2, an automated driving assistant system (ADAS) 20_3, a vehicle domain control (VDC) 20_4, a vehicle interconnect unit (VIU) 20_5, a motor control unit (MCU) 20_6, etc. Any component / execution domain may be used as a first communication node to implement the intrusion detection method of the embodiment of the present application in the vehicle communication system.

[0068] The vehicle communication system is usually configured as follows: the services with external network connection are concentrated on a certain component A, and the other components use the component A as a bridge to obtain external network resources. In specific implementation, the component A can be Figure 2 The shown vehicle networking intelligent terminal 20_1 may also be an intelligent cockpit 20_2, or other components, which is not limited in the embodiments of the present application. When component A is used as the first communication node, the intrusion detection method of the embodiment of the present application can be implemented to timely and effectively detect whether the attacker obtains the rebound shell process on component A to reside. When other components except component A are used as the first communication node, these components can each implement the intrusion detection method of the embodiment of the present application to timely and effectively detect whether the attacker uses component A as a node to conduct penetration intrusion attacks on itself, thereby comprehensively protecting the vehicle communication system from intrusion attacks.

[0069] For ease of understanding, the following Figure 1a , Figure 1b and Figure 2 The intrusion detection method implemented by the communication node in the system shown as the first communication node is introduced in detail.

[0070] Figure 3 A schematic diagram of the process flow of the intrusion detection method of an embodiment of the present application is shown. Figure 3 As shown, the intrusion detection method may include the following steps:

[0071] S310: The first communication node obtains a first request.

[0072] In an embodiment of the present application, the designer may, according to experience and based on known attack methods, pre-set a corresponding detection strategy in the first communication node so that the first communication node may adaptively detect and intercept intrusion attacks based on the detection strategy.

[0073] The first request may come from an external network or from a second communication node, and the second communication node and the first communication node belong to the same communication system.

[0074] Taking the rebound shell attack as an example, the corresponding detection strategy can be expressed as a first condition. If the first request is triggered by the attacker's machine, a first process is requested to be established on the first communication node. In one possible implementation, the first process is a shell process remotely residing on the first communication node, that is, an abnormal process.

[0075] When the first communication node detects and analyzes the first process, it can first determine whether the first process is a process for the user to interact with the system, such as a shell process. In specific implementation, the first communication node can determine whether the first process is a shell process based on the name of the first process to be established or other attribute information. Exemplarily, in a Linux system, shell processes may include but are not limited to bash, ksh, zsh, csh, tcsh, dash, fish, cmd.exe, and Powershell. If the first process is a shell process, there is a possibility that the first process is a resident shell process that the attacker expects to obtain.

[0076] Furthermore, the first communication node may detect and analyze the information carried in the first request based on the first condition, and determine whether the first process to be established is an abnormal process by analyzing whether the first request satisfies the first condition, so as to timely discover and intercept intrusion attacks. Exemplarily, the first condition may include at least one of the following: the first process is associated with a second process, and the second process is used to read and write data to the first communication node through a network connection; the input / output of the first process is bound to a network port (e.g., a socket).

[0077] Among them, the first process associating the second process may include: the process tree to which the first process belongs includes the second process. And / or, the first process associating the second process may include: the parameters of the first process are used to execute the second process, and the specific implementation method of this association relationship is not limited in the embodiment of the present application. The process tree to which the first process belongs may include at least two processes, and the process tree to which the first process belongs includes the second process, which may specifically include: the parent process of the first process is the second process, or the process other than the parent process of the first process is the second process, and the embodiment of the present application does not limit this. According to the communication topology corresponding to the first communication node, the network port may include a communication port between the first communication node and the external network, and / or, an internal communication port (such as an intranet IP) between the first communication node and at least one second communication node, and the embodiment of the present application does not limit this.

[0078] The second process may be, for example, any of the following: a netcat process (referred to as nc process), a socat process, an ncat process, etc., which is often used by the attacker machine to input instructions to the rebound shell process residing in the first communication node, and to receive the execution result from the rebound shell process, so that the attacker machine attacks the first communication node. The input of the first process may include, but is not limited to, standard input (Standard input, STDIN), and the output of the first process may include, but is not limited to, standard output (Standard output, STDOUT) and standard error (Standard error, STDERR) output.

[0079] S320: If the first request satisfies a first condition, determine that the first process is an abnormal process.

[0080] S330: Terminate the establishment of the first process. At the same time, the first communication node may also record the abnormal situation of the request in a local abnormality log.

[0081] Therefore, through the above method, taking the in-vehicle communication system as an example, a detection strategy deployed in the first communication node is designed and developed, and an intrusion detection function is added, so that the first communication node can detect and analyze specific shell processes in the early stage of establishing the resident shell process, and detect intrusion attacks as early as possible. At the same time, the first communication node adds a blocking function to intercept and screen and block abnormal processes in the establishment stage, timely and effectively blocking intrusion attacks, and increasing the difficulty of intrusion of the attacker's machine.

[0082] In another example, the attacker's machine may also disguise the rebound shell process triggered by itself through some means, such as modifying the process name, suffix, etc., causing the first communication node to be unable to detect the intrusion attack in time when implementing the above S310-S330. In response to this situation, the first communication node can also be configured to perform feature analysis on the third process to determine whether the third process is abnormal, obtain the first feature, and add the first feature to the abnormal feature library. At the same time, the first communication node can also record the abnormal situation in the abnormal log. Among them, the third process includes a process running on the first communication node, and the third process can be a shell process or a non-shell process. The first feature is a feature that characterizes the third process as an abnormal process.

[0083] Exemplarily, the first feature may include at least one of the following: the input / output of the third process is bound to the network port through a camouflage tool; and / or the third process has abnormal network connection behavior. The camouflage tool may be, for example, but not limited to, any one of a pipe or a pseudo terminal. The abnormal network connection behavior of the third process may be, for example, that the third process itself is a process that does not require networking, but the third process actually establishes a network connection. Alternatively, the abnormal network connection behavior of the third process may be, for example, that the third process itself is a networked process, but the third process executes some non-networked behaviors, such as executing some commands related to the file configuration (profile) system.

[0084] In an optional implementation, in order to enrich the abnormal feature library, the first communication node may also adopt a method similar to the method of performing feature analysis on the third process to perform feature analysis on the first process, and add features characterizing the first process as an abnormal process to the abnormal database. The features characterizing the first process as an abnormal process include: the input / output of the first process is bound to a network port through a camouflage tool.

[0085] Thus, the first communication node can perform in-depth exploration of high-level intrusion attacks that have not been detected in time by traversing and analyzing the third process running on it, so as to detect and intercept intrusion attacks as comprehensively as possible. At the same time, the first communication node can also add the features that characterize the third process as an abnormal process and the features that characterize the first process as an abnormal process to the abnormal feature library, and improve the abnormal feature library as much as possible, so as to use the abnormal feature library to efficiently detect new intrusion attacks in the future.

[0086] In another example, the attacker's machine may also use a malicious script file to launch an intrusion attack. In an optional implementation, the first communication node may also periodically match the script file of the first communication node with the malicious script resource library stored by the third-party device. If the match is successful, it indicates that there is a malicious script file on the first communication node. To ensure the network security of the first communication node, the first communication node may also delete the malicious script file. At the same time, the first communication node may also record the malicious script detected in the exception log.

[0087] If in the above embodiments, the process of detecting and blocking abnormal processes, or the process of traversing and analyzing to discover abnormal processes, still cannot prevent intrusion by terminating the establishment of the corresponding process, or deleting related files, in an optional implementation, the first communication node can also ensure that the attacker's machine cannot attack the first communication node by making it impossible for the attacker's machine to run the resident shell process on the first communication node through a safe restart or other means.

[0088] It should be understood that in the embodiment of the present application, the third-party device can be a device that the first communication node can directly access, or it can be a device (such as a server) that the first communication node can remotely access, and the embodiment of the present application does not limit this.

[0089] Therefore, through the above method, a detection strategy deployed in the first communication node is designed and developed, and an intrusion detection function is added, so that the first communication node can detect and analyze a specific shell process at the initial stage of establishing the resident shell process, and detect intrusion attacks early. At the same time, the first communication node adds a blocking function to intercept and screen and block abnormal processes at the establishment stage, timely and effectively blocking intrusion attacks and increasing the difficulty of intrusion of the attacker's machine.

[0090] An embodiment of the present application also provides a communication device for executing the method executed by the first communication node in the above method embodiment. The relevant features can be found in the above method embodiment and will not be repeated here.

[0091] like Figure 4 As shown, the communication device 400 may include: an acquisition unit 401, a determination unit 402, and a control unit 403. The acquisition unit 401 is used to acquire a first request, the first request is used to request the establishment of a first process; the determination unit 402 is used to determine that the first process is an abnormal process if the first request satisfies a first condition, wherein the first condition includes at least one of the following: the first process is associated with a second process, the second process is used to read and write data to the first communication node through a network connection; the input / output of the first process is bound to a network port; the control unit 403 is used to terminate the establishment of the first process.

[0092] In another example, the communication device 400 may further include a storage unit 404. The acquisition unit 401 is used to perform feature analysis on the third process to acquire a first feature, wherein the third process includes a process running on the first communication node, and the first feature is a feature that characterizes the third process as an abnormal process, wherein the first feature includes at least one of the following: the input / output of the third process is bound to a network port through a camouflage tool; and / or, the third process has abnormal network connection behavior; the storage unit 404 is used to add the first feature to the abnormal feature library.

[0093] For the specific implementation method, please refer to the method steps implemented by the first communication node in the above method embodiment, which will not be repeated here.

[0094] It should be understood that the division of the units in the above device is only a division of logical functions, and in actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. In addition, the units in the device can be implemented in the form of a processor calling software; for example, the device includes a processor, the processor is connected to a memory, and instructions are stored in the memory. The processor calls the instructions stored in the memory to implement any of the above methods or realize the functions of the units of the device, wherein the processor is, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory is a memory inside the device or a memory outside the device. Alternatively, the units in the device can be implemented in the form of hardware circuits, and the functions of some or all of the units can be realized by designing the hardware circuits, and the hardware circuits can be understood as one or more processors; for example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC), and the functions of some or all of the above units are realized by designing the logical relationship of the components in the circuit; for another example, in another implementation, the hardware circuit can be realized by a programmable logic device (PLD), taking a field programmable gate array (FPGA) as an example, which can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by a configuration file, so as to realize the functions of some or all of the above units. All units of the above devices can be realized in the form of a processor calling software, or in the form of a hardware circuit, or in part by a processor calling software, and the rest by a hardware circuit.

[0095] In the embodiment of the present application, the processor is a circuit with signal processing capability. In one implementation, the processor can be a circuit with instruction reading and running capability, such as a CPU, a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP), etc.; in another implementation, the processor can realize certain functions through the logical relationship of the hardware circuit, and the logical relationship of the hardware circuit is fixed or reconfigurable, such as a hardware circuit implemented by an ASIC or PLD, such as an FPGA. In a reconfigurable hardware circuit, the processor loads a configuration document to implement the process of hardware circuit configuration, which can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (Neural Network Processing Unit, NPU) tensor processing unit (Tensor Processing Unit, TPU), deep learning processing unit (Deep learning Processing Unit, DPU), etc.

[0096] It can be seen that each unit in the above device can be one or more processors (or processing circuits) configured to implement the above method, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0097] In addition, all or part of the units in the above device can be integrated together, or can be implemented independently. In one implementation, these units are integrated together and implemented in the form of a system-on-a-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or implementing the functions of each unit of the device. The type of the at least one processor may be different, for example, including a CPU and an FPGA, a CPU and an artificial intelligence processor, a CPU and a GPU, etc.

[0098] In a simple embodiment, those skilled in the art can imagine that the communication devices in the above embodiments can all be used. Figure 5 The form shown.

[0099] like Figure 5 The device 500 shown includes at least one processor 510 and a communication interface 530. In an optional design, a memory 520 may also be included.

[0100] The specific connection medium between the processor 510 and the memory 520 is not limited in the embodiment of the present application.

[0101] In such Figure 5 In the device, the processor 510 can transmit data through the communication interface 530 when communicating with other devices.

[0102] When the communication device uses Figure 5 When the form shown is Figure 5 The processor 510 in the apparatus 500 can call the computer-executable instructions stored in the memory 520 so that the apparatus 500 can execute any of the above method embodiments.

[0103] An embodiment of the present application also relates to a chip system, which includes a processor for calling a computer program or computer instructions stored in a memory so that the processor executes the method of any of the above embodiments.

[0104] In a possible implementation manner, the processor may be coupled to the memory through an interface.

[0105] In a possible implementation, the chip system may also directly include a memory, in which a computer program or computer instructions are stored.

[0106] For example, the memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DRRAM).

[0107] An embodiment of the present application also relates to a processor, which is used to call a computer program or computer instruction stored in a memory so that the processor executes the method described in any of the above embodiments.

[0108] For example, in the embodiment of the present application, the processor is an integrated circuit chip with signal processing capabilities. For example, the processor can be an FPGA, a general-purpose processor, a DSP, an ASIC or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, a system chip (system on chip, SoC), a CPU, a network processor (network processor, NP), a microcontroller (microcontroller unit, MCU), a PLD or other integrated chip, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and performed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0109] It should be understood that the embodiments of the present application may be provided as a method, a system, or a computer program product.

[0110] In a possible implementation, an embodiment of the present application provides a computer-readable storage medium, which stores a program code. When the program code runs on the computer, the computer executes the above method embodiment.

[0111] In a possible implementation, an embodiment of the present application provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the above method embodiment.

[0112] Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0113] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0114] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0115] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these changes and variations. In the various embodiments of the present application, if there is no special explanation and logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

Claims

1. An intrusion detection method, characterized in that: Applied to a first communication node, the method comprises: Obtaining a first request, where the first request is used to request to establish a first process; If the first request satisfies a first condition, the first process is determined to be an abnormal process, wherein the first condition includes at least one of the following: The first process is associated with a second process, and the second process is used to read and write data to the first communication node through a network connection; The input / output of the first process is bound to a network port; Terminate establishing the first process.

2. The method according to claim 1, characterized in that The first process associating with the second process comprises: The process tree to which the first process belongs includes the second process; and / or, The parameters of the first process are used to execute the second process.

3. The method according to claim 2, characterized in that The process tree to which the first process belongs includes a second process, which specifically includes: the parent process of the first process is the second process.

4. The method according to any one of claims 1 to 3, characterized in that Before the first request satisfies the first condition, the method further includes: The first process is determined to be a process for a user to interact with the system.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: A feature analysis is performed on the first process, and features characterizing the first process as an abnormal process are added to an abnormal feature library.

6. The method according to claim 5, characterized in that The feature indicating that the first process is an abnormal process includes: The input / output of the first process is bound to the network port through a camouflage tool.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: A feature analysis is performed on a third process, and a feature characterizing the third process as an abnormal process is added to an abnormal feature library, wherein the third process includes a process running on the first communication node.

8. The method according to claim 7, characterized in that The feature indicating that the third process is an abnormal process includes: The input / output of the third process is bound to the network port through a camouflage tool; and / or, The third process has abnormal network connection behavior.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: Matching the script file of the first communication node with a malicious script resource library stored in a third-party device; If the match is successful, it is determined that the script file is a malicious script file.

10. The method according to claim 9, characterized in that The method further comprises: Delete the malicious script file.

11. The method according to any one of claims 1 to 10, characterized in that The first communication node is connected to at least one second communication node, and the first communication node and the at least one second communication node belong to the same communication system; The network port includes a communication port between the first communication node and an external network, and / or an internal communication port between the first communication node and the at least one second communication node.

12. The method according to claim 11, characterized in that The communication system is an in-vehicle communication system, and the first communication node includes the control domain of any one of the following: Internet of Vehicles intelligent terminal T-BOX, intelligent cockpit CDC, intelligent driving assistance system ADAS, vehicle control VDC, central gateway VIU, and motor control unit MCU.

13. The method according to any one of claims 1 to 12, characterized in that The first process is a shell process used to remotely reside in the first communication node.

14. An intrusion detection method, characterized in that: Applied to a first communication node, the method comprises: Perform feature analysis on the third process to obtain a first feature, wherein the third process includes a process running on the first communication node, the first feature is a feature that characterizes that the third process is an abnormal process, and the first feature includes at least one of the following: The input / output of the third process is bound to the network port through a camouflage tool; and / or, The third process has abnormal network connection behavior; The first feature is added to the abnormal feature library.

15. The method according to claim 14, characterized in that The method further comprises: Matching the script file of the first communication node with a malicious script resource library stored in a third-party device; If the match is successful, it is determined that the script file is a malicious script file.

16. The method according to claim 15, characterized in that The method further comprises: Delete the malicious script file.

17. The method according to any one of claims 14 to 16, characterized in that: The first communication node is connected to at least one second communication node, and the first communication node and the at least one second communication node belong to the same communication system; The network port includes a communication port between the first communication node and an external network, and / or an internal communication port between the first communication node and the at least one second communication node.

18. The method according to claim 17, characterized in that The communication system is an in-vehicle communication system, and the first communication node includes the control domain of any one of the following: Internet of Vehicles intelligent terminal T-BOX, intelligent cockpit CDC, intelligent driving assistance system ADAS, vehicle control VDC, central gateway VIU, and motor control unit MCU.

19. The method according to any one of claims 14 to 18, characterized in that The first process is a shell process used to remotely reside in the first communication node.

20. An intrusion detection device, characterized in that: include: An acquiring unit, configured to acquire a first request, wherein the first request is used to request to establish a first process; a determining unit, configured to determine that the first process is an abnormal process if the first request satisfies a first condition, wherein the first condition includes at least one of the following: The first process is associated with a second process, and the second process is used to read and write data to the first communication node through a network connection; The input / output of the first process is bound to a network port; A control unit is used to terminate the establishment of the first process.

21. An intrusion detection device, characterized in that: include: an acquiring unit, configured to perform feature analysis on a third process to acquire a first feature, wherein the third process includes a process running on the first communication node, and the first feature is a feature characterizing that the third process is an abnormal process, wherein the first feature includes at least one of the following: The input / output of the third process is bound to the network port through a camouflage tool; and / or, The third process has abnormal network connection behavior; A storage unit is used to add the first feature to an abnormal feature library.

22. A communication device, characterized in that: The communication device comprises: A communication interface for communicating with other devices; A processor is coupled to the communication interface, so that the communication device executes the method according to any one of claims 1 to 13, or executes the method according to any one of claims 14 to 19.

23. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed on a computer, the computer is enabled to execute the method according to any one of claims 1 to 13, or to execute the method according to any one of claims 14 to 19.

24. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 13, or execute the method according to any one of claims 14 to 19.

25. A chip, characterized in that: The invention comprises a processor, wherein the processor is coupled to a memory and is used to execute a computer program or instruction stored in the memory. When the computer program or instruction is executed, the method according to any one of claims 1 to 13 is implemented, or the method according to any one of claims 14 to 19 is implemented.

26. A vehicle, characterized in that: The method comprises a unit for implementing the method according to any one of claims 1 to 13, or comprises a unit for implementing the method according to any one of claims 14 to 19.

Images