Computer monitoring system controller domain network bus traceability intrusion detection method and related device

Abstract

The invention provides a computer monitoring system controller area network bus traceability intrusion detection method and related device, and the method comprises the steps: determining a voltage signal of a controller area network bus, carrying out the coding conversion of the voltage signal, and obtaining a data frame image; reconstructing the data frame image to obtain data frame reconstruction vector information; judging the reconstruction vector information of the data frame based on a preset threshold value to obtain an abnormal data frame; determining a voltage feature map of the abnormal data frame, inputting the voltage feature map into a pre-trained traceability model, and outputting an abnormal prediction index by the traceability model; and tracing based on the abnormal prediction index, and identifying the invaded electronic control unit. The current common attack method and unknown attack can be effectively detected and traced back, and the detection precision is not influenced by the bus state, the attack content, the sending frequency and the camouflage data.

Description

Technical Field

[0001] The present disclosure relates to the technical field of power systems, and in particular to a computer monitoring system controller area network bus tracing intrusion detection method and related devices. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the disclosure that are recited in the claims. No description herein is admitted to be prior art by inclusion in this section.

[0003] As an important peak-shaving power source and emergency backup facility, the computer monitoring system of the pumped-storage power station is the core guarantee for its stable operation and is crucial to maintaining the stability of the power grid. The controller area network bus in the pumped-storage computer monitoring system faces multiple attack threats, including deception attacks, DoS attacks, camouflage attacks and homologous attacks. Existing intrusion detection methods are mainly based on rules, traffic, voltage, clock skew and other characteristics, which can detect some attack types and trace the attacker.

[0004] However, in the related technologies, the existing CAN bus intrusion detection technology is difficult to effectively deal with new attacks and lacks comprehensive detection and tracing capabilities. Summary of the invention

[0005] In view of this, the purpose of the present disclosure is to propose a computer monitoring system controller area network bus tracing intrusion detection method and related devices, at least to a certain extent to solve one of the technical problems in the related technology.

[0006] Based on the above purpose, the first aspect of the exemplary embodiment of the present disclosure provides a computer monitoring system controller area network bus tracing intrusion detection method, which is applied to a server, and the method includes:

[0007] Determine a voltage signal of a controller area network bus, and perform encoding conversion on the voltage signal to obtain a data frame image;

[0008] Reconstructing the data frame image to obtain data frame reconstruction vector information;

[0009] The vector information reconstructed from the data frame is judged based on a preset threshold value to obtain an abnormal data frame;

[0010] Determine a voltage characteristic graph of the abnormal data frame, input the voltage characteristic graph into a pre-trained traceability model, and the traceability model outputs an abnormality prediction index;

[0011] Based on the abnormal prediction indicators, the source is traced to identify the hacked electronic control unit.

[0012] Based on the same inventive concept, the second aspect of the exemplary embodiment of the present disclosure provides a computer monitoring system controller area network bus tracing intrusion detection device, comprising:

[0013] A data frame image determination module is configured to determine a voltage signal of a controller area network bus, and perform encoding conversion on the voltage signal to obtain a data frame image;

[0014] A vector information determination module is configured to reconstruct the data frame image to obtain data frame reconstruction vector information;

[0015] an abnormal data frame determination module, configured to determine the data frame reconstruction vector information based on a preset threshold value to obtain an abnormal data frame;

[0016] A prediction index determination module is configured to determine a voltage characteristic diagram of the abnormal data frame, input the voltage characteristic diagram into a pre-trained traceability model, and the traceability model outputs an abnormal prediction index;

[0017] The intrusion tracing module is configured to perform tracing based on the abnormal prediction indicators to identify the invaded electronic control unit.

[0018] Based on the same inventive concept, a third aspect of the exemplary embodiment of the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in the first aspect is implemented.

[0019] Based on the same inventive concept, a fourth aspect of the exemplary embodiments of the present disclosure provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method described in the first aspect.

[0020] Based on the same inventive concept, a fifth aspect of the exemplary embodiments of the present disclosure provides a computer program product, including computer program instructions. When the computer program instructions are executed on a computer, the computer executes the method described in the first aspect.

[0021] From the above, it can be seen that the embodiments of the present disclosure provide: determining the voltage signal of the controller area network bus, encoding and converting the voltage signal to obtain a data frame image; reconstructing the data frame image to obtain data frame reconstruction vector information; judging the data frame reconstruction vector information based on a preset threshold to obtain an abnormal data frame; determining the voltage characteristic graph of the abnormal data frame, inputting the voltage characteristic graph into a pre-trained tracing model, and the tracing model outputs an abnormal prediction index; tracing based on the abnormal prediction index to identify the invaded electronic control unit. The present disclosure can effectively detect and trace the current common attack methods and unknown attacks, and the detection accuracy is not affected by the bus status, attack content, transmission frequency and disguised data. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 A schematic diagram of an application scenario of a method for tracing intrusion detection of a controller area network bus of a computer monitoring system provided by an exemplary embodiment of the present disclosure;

[0024] Figure 2 A flowchart of a method for tracing intrusion detection of a controller area network bus of a computer monitoring system provided by an exemplary embodiment of the present disclosure;

[0025] Figure 3 A schematic diagram of voltage signal acquisition for a computer monitoring system controller area network bus source tracing intrusion detection method provided by an exemplary embodiment of the present disclosure;

[0026] Figure 4 A schematic diagram of data frame encoding conversion of a computer monitoring system controller area network bus tracing intrusion detection method provided by an exemplary embodiment of the present disclosure;

[0027] Figure 5 A schematic diagram of data frame image conversion of a computer monitoring system controller area network bus tracing intrusion detection method provided by an exemplary embodiment of the present disclosure;

[0028] Figure 6 A schematic diagram of differential voltage signals of a computer monitoring system controller area network bus tracing intrusion detection method provided by an exemplary embodiment of the present disclosure;

[0029] Figure 7A schematic diagram of the convolutional neural network structure of a computer monitoring system controller area network bus source tracing intrusion detection method provided by an exemplary embodiment of the present disclosure;

[0030] Figure 8 A schematic diagram of a structure of a controller area network bus source tracing intrusion detection device for a computer monitoring system provided by an exemplary embodiment of the present disclosure;

[0031] Fig. 9 A schematic diagram of the hardware structure of an electronic device provided for an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] It is understandable that before using the technical solutions disclosed in the embodiments of this application, the type, scope of use, usage scenarios, etc. of the personal information involved in this application should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0033] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present application according to the prompt message.

[0034] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0035] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation method of the present application. Other methods that meet relevant laws and regulations may also be applied to the implementation method of the present application.

[0036] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0037] In order to make the purpose, technical solutions and advantages of the present disclosure more clear, the principles and spirit of the present disclosure will be described with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present disclosure, and are not intended to limit the scope of the present disclosure in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0038] It should be understood herein that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction rather than having any limiting meaning.

[0039] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connecting" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly. The article "one" or "a" before an element does not exclude the existence of multiple such elements.

[0040] The principle and spirit of the present disclosure are explained in detail below with reference to several representative embodiments of the present disclosure.

[0041] As described in the background technology, in the related art, the existing controller area network bus intrusion detection technology is difficult to effectively respond to new attacks and lacks comprehensive detection and traceability capabilities. Specifically, with the continuous progress of modernization and intelligence of power systems, pumped storage power stations are key peak-shaving and emergency backup resources in power grids, and their safe and stable operation plays a vital role in the reliability of the entire power grid. Computer monitoring systems, especially systems implemented through monitoring control and data acquisition systems (SCADA), are the core of pumped storage power stations and are responsible for real-time monitoring and management of all equipment in power stations. In these monitoring systems, the controller area network (CAN) bus, as an efficient serial communication protocol, is widely used in industrial control systems, including monitoring systems of pumped storage power stations. The CAN bus consists of two twisted pairs (CAN-H and CAN-L) and multiple electronic control units (ECUs), which are connected in parallel and send data messages in broadcast form for communication.

[0042] However, the CAN bus is vulnerable to hacker attacks due to the lack of security measures such as authentication and encryption, which may lead to malicious operation of the control system ECU, causing equipment damage, data leakage, and even safety accidents. Therefore, ensuring the security of the CAN bus is crucial to ensure the stable operation of the power station.

[0043] Traditional CAN bus security measures, such as encrypted communication, identity authentication, and access control, can provide a certain degree of security, but they are usually complex to configure, may affect system performance, and are difficult to deal with new or unknown attack methods. In recent years, deep learning technology has made significant progress in many fields due to its ability to process large amounts of data and learn complex features. Applying deep learning technology to intrusion detection and attack tracing of CAN buses can improve the accuracy and efficiency of detection and can adapt to new attack modes.

[0044] Although some studies have attempted to use machine learning methods to enhance the security of industrial control systems, the research on deep learning intrusion detection and tracing methods for CAN buses in computer monitoring systems of pumped storage power plants is still insufficient.

[0045] At present, the common attack methods are: deception attack, injecting attack messages with control functions into the CAN bus at a higher frequency to deceive the ECU to execute the commands carried by the attack message instead of the normal message, Denial of Service attack (DoS), by continuously injecting high-priority messages into the CAN bus for a short period of time to achieve the effect of always occupying the bus or until the ECU stops working, disguised attack, first use the controlled ECU to launch a DoS attack to stop sending specific messages to other ECUs, and then use the controlled ECU to send this message at the same frequency and homology attack, the attacker controls an ECU on the CAN bus, and then sends the message originally sent by this ECU at the original frequency, only modifying the content carried by the message.

[0046] Existing intrusion detection methods include: rule-based methods, which usually use the arrival time of the message on the bus to calculate the message cycle and determine whether the cycle is consistent with the setting; can detect deception attacks, DoS attacks, and flow-based methods, which usually use Hamming distance, information entropy and other methods to calculate the size of the flow in the CAN bus, and then determine whether the bus is attacked; can detect deception attacks, DoS attacks, and voltage-based methods, by collecting the voltage characteristics of each message in the bus, and combining machine learning to achieve signal tracing and intrusion detection; can detect deception attacks, DoS attacks, and camouflage attacks, and can trace the ECU controlled by the attacker on the CAN bus and the clock skew-based method, using the characteristics of different clock skews of different electronic components on the CAN bus, to estimate the clock skew of each message from the arrival time of the message, and compare it with the electronic components to determine whether the CAN bus is attacked; can detect deception attacks, DoS attacks, and camouflage attacks, and can trace the ECU controlled by the attacker on the CAN bus.

[0047] However, in the related technologies, the existing intrusion detection methods based on rules and traffic are usually only applicable to spoofing attacks, DoS attacks and other attacks with obvious traffic changes; they are difficult to work for novel attacks such as disguise attacks and homology attacks, and it is difficult to trace the attack source. Although the voltage and clock-based methods can detect spoofing attacks, DoS attacks, disguise attacks, and can trace the ECU controlled by the attacker on the CAN bus, they cannot detect homology attacks.

[0048] In summary, there is no method in the existing related technologies that can simultaneously achieve intrusion detection and attack tracing for the above four attack methods.

[0049] In order to solve the above problems, the present disclosure provides a computer monitoring system controller area network bus tracing intrusion detection method and related device solutions, specifically including:

[0050] Determine the voltage signal of the controller area network bus, encode and convert the voltage signal to obtain a data frame image; reconstruct the data frame image to obtain data frame reconstruction vector information; judge the data frame reconstruction vector information based on a preset threshold to obtain an abnormal data frame; determine the voltage characteristic diagram of the abnormal data frame, input the voltage characteristic diagram into a pre-trained tracing model, and the tracing model outputs an abnormal prediction index; trace the source based on the abnormal prediction index to identify the invaded electronic control unit. The present disclosure can effectively identify and trace the current common attack types, such as deception attacks, DoS attacks, disguise attacks and homologous attacks, and has the ability to detect unknown attacks; at the same time, the present disclosure can accurately track the ECU controlled by the attacker, and its detection accuracy is not affected by the working state of the CAN bus, the content of the attack message, the sending frequency, and any disguised data, thereby significantly improving the safety and reliability of the monitoring system of the pumped storage power station.

[0051] After introducing the basic principles of the present disclosure, various non-limiting embodiments of the present disclosure are described in detail below.

[0052] refer to Figure 1 , which is a schematic diagram of an application scenario of the computer monitoring system controller area network bus tracing intrusion detection method provided by the exemplary embodiment of the present disclosure.

[0053] This application scenario includes a terminal device 101 and a server 102. The terminal device 101 and the server 102 may be connected via a wired or wireless communication network to achieve data interaction.

[0054] The terminal device 101 may be an electronic device with data transmission and multimedia input / output functions close to the user side, including but not limited to a desktop computer, a mobile phone, a mobile computer, a tablet computer, a media player, a smart wearable device, a personal digital assistant (PDA) or other electronic devices capable of realizing the above functions. The electronic device may include a processor and a display screen with a touch input function, the display screen is used to present a graphical user interface, the graphical user interface can display an application interface, and the processor is used to process application data, generate a graphical user interface, and control the display of the graphical user interface on the display screen.

[0055] Server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0056] In some exemplary embodiments, the computer monitoring system controller area network bus tracing intrusion detection method may be run on the terminal device 101 or the server 102 .

[0057] When the computer monitoring system controller area network bus source tracing intrusion detection method is run on the server 102 , the server 102 is used to provide a computer monitoring system controller area network bus source tracing intrusion detection service to the user of the terminal device 101 .

[0058] The server 102 determines a voltage signal of a controller area network bus, and the server 102 performs encoding conversion on the voltage signal to obtain a data frame image;

[0059] The server 102 reconstructs the data frame image to obtain data frame reconstruction vector information;

[0060] The server 102 determines the reconstructed vector information of the data frame based on a preset threshold value to obtain an abnormal data frame;

[0061] The server 102 determines a voltage characteristic diagram of the abnormal data frame, and the server 102 inputs the voltage characteristic diagram into a pre-trained traceability model, and the traceability model outputs an abnormality prediction indicator;

[0062] The server 102 performs source tracing based on the abnormal prediction indicators to identify the hacked electronic control unit.

[0063] It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present disclosure, and the embodiments of the present disclosure are not limited in this respect. On the contrary, the embodiments of the present disclosure can be applied to any applicable scenario.

[0064] refer to Figure 2 , a computer monitoring system controller area network bus tracing intrusion detection method, applied to a server, the method comprises the following steps:

[0065] Step S210: determine the voltage signal of the controller area network bus, and perform encoding conversion on the voltage signal to obtain a data frame image.

[0066] In specific implementation, the controller area network bus refers to:

[0067] The Controller Area Network (CAN) bus is an efficient serial communication protocol that is widely used in industrial control systems, including monitoring systems for pumped storage power stations. The CAN bus consists of two twisted pairs (CAN-H and CAN-L) and multiple electronic control units (ECUs), and each ECU is connected in parallel. When the CAN bus is working, each ECU communicates by sending messages in the form of broadcasting.

[0068] In specific implementation, the voltage signal of the controller area network bus is determined as follows:

[0069] As a specific example, refer to Figure 3 The device in the figure includes: two twisted pairs of CAN bus (CAN-H and CAN-L), an oscilloscope and a terminal device; during the acquisition process, the probe end of the oscilloscope can be directly connected to the bus, or it can be acquired by inserting the relevant interface; when connecting, connect the probe A of the oscilloscope to CAN-H, and the probe B to CAN-L; connect the other end of the oscilloscope to the terminal device, and store the acquired voltages VCAN-H and VCAN-L on the CAN bus in real time.

[0070] In the above exemplary embodiment, a method of obtaining a voltage signal of a controller area network bus is introduced. Next, a method of obtaining a data frame image is introduced:

[0071] In this exemplary embodiment, the voltage signal is coded and converted to obtain a data frame image, including:

[0072] The voltage signal is converted into an analog-to-digital signal to obtain an original data frame; and the characteristic information of the data frame is converted into an encoding signal to obtain the data frame image.

[0073] In a specific implementation, performing analog-to-digital conversion on the voltage signal to obtain an original data frame means:

[0074] Following the above exemplary embodiment, according to the provisions of the CAN bus, when converting the voltage signal into a digital signal, the differential voltage V d =V CAN-H -V CAN-L When V d <0.5V, is a recessive level, recorded as logic "1"; when V d >0.9V is a dominant level, recorded as logic "0". When the collected voltage is sufficient to be converted into a complete signal, a complete data frame is output.

[0075] In a specific implementation, encoding and converting the data frame characteristic information to obtain the data frame graph means:

[0076] Following the above exemplary embodiments, refer to Figure 4 , the left side of the figure is the data frame flow record, the right side is the corresponding data frame image, and there is a black arrow in the middle, which indicates the pre-processing process of the data, namely One-hot encoding; in the data frame flow record, each row contains information such as time stamp, ID and data length. Among them, the time stamp is a decimal between 2857.938 and 2859.096, the ID is 00000D39H or 00004BFH, etc., and the data length includes 8 bytes of data value (expressed in HEX format); when the data part of the data frame is converted into a picture using one-hot encoding, the size of each picture is 64×64, and each data frame occupies 2×64. That is, each picture can accommodate 32 data frames; the first data frame ID stored in each picture x To mark the data frame, it represents the ID contained in the latest data frame arriving on the bus; the order of other ID messages is fixed and is not affected by the order of message arrival. Figure 4 In the scheme or system under discussion, there is a specific identifier "ID2", which is used to mark or identify specific message content; in different images or charts, whenever the identifier "ID2" appears, the content it refers to is consistent, that is, it refers to that specific message content.

[0077] Step S220: reconstruct the data frame image to obtain data frame reconstruction vector information.

[0078] In this exemplary embodiment, the data frame image is reconstructed to obtain data frame reconstruction vector information, including:

[0079] The data frame image is encoded based on the first encoder to obtain data frame vector information; the data frame vector information is decoded based on the decoder to obtain a reconstructed data frame graphic; the reconstructed data frame graphic is encoded based on the second encoder to obtain the data frame reconstructed vector information.

[0080] In a specific implementation, encoding the data frame image based on a first encoder to obtain data frame vector information; decoding the data frame vector information based on a decoder to obtain a reconstructed data frame graphic; encoding the reconstructed data frame graphic based on a second encoder to obtain the data frame reconstructed vector information means:

[0081] Following the above exemplary embodiments, refer to Figure 5 , the figure includes a data input module, a generator module and a discriminator module; the data input module contains m image sample data of size 64×64; the generator module contains two encoders and a decoder; the discriminator contains an encoder. Before reconstructing the data frame image to obtain the data frame reconstruction vector information, the m image sample data of size 64×64 are used as sample data x, and the sample data x is input to the generator. x is first encoded by the encoder of the generator module and output as z; z is decoded by the decoder and output Then input it to the encoder in the generator module, and the output is where x and will be input to the encoder in the discriminator to provide feedback to the generator and guide its generation ability; in addition, It will also be input into the decoder in the generator module together with z, which can also optimize the generator's generation ability. This process trains the generator and discriminator through a large number of samples, and finally achieves a higher generation ability of the generator, that is, z and With very small error; where z is regarded as the encoder of the generator, encoding the original input sample data x into a low-dimensional intermediate representation, which captures the key features of the input data; The decoder, viewed as a generator, decodes the encoded representation z back into the image space, trying to reconstruct an image similar to the original input x; Considered as a reconstruction sample for comparison The difference between the original sample x helps the generator to optimize through feedback.

[0082] The data frame image x required to be reconstructed in this exemplary embodiment i , which is input into the generator module through the data input module to obtain the final output

[0083] Step S230: Based on a preset threshold, judge the vector information reconstructed from the data frame to obtain an abnormal data frame.

[0084] In this exemplary embodiment, based on a preset threshold, judging the vector information reconstructed from the data frame to obtain an abnormal data frame includes:

[0085] Based on the difference between the data frame vector information and the vector information reconstructed from the data frame, obtain an error score; judge whether the error score is less than the preset threshold, and in response to the error score being less than the preset threshold, use the original data frame as the abnormal data frame.

[0086] Specifically, when implemented, based on the difference between the data frame vector information and the vector information reconstructed from the data frame, obtain an error score; judge whether the error score is less than the preset threshold, and in response to the error score being less than the preset threshold, using the original data frame as the abnormal data frame means:

[0087] Continuing from the above exemplary embodiment, calculate the error score If score < threshold, then ID x The data frame is a normal data frame, and continue to execute the original data frame i, where threshold is the preset threshold; if score > threshold, then it is an abnormal ID x Data frame.

[0088] Step S240: Determine the voltage feature map of the abnormal data frame, and input the voltage feature map into a pre-trained traceability model, and the traceability model outputs an abnormal prediction index.

[0089] Specifically, when implemented, determine the voltage feature map of the abnormal data frame:

[0090] Continuing from the above exemplary embodiment, refer to Figure 6 , each dominant level consists of a rising edge, a stable edge, and a falling edge; where the rising edge corresponds to a voltage signal where the recessive level is converted to the dominant level; the stable edge corresponds to a voltage signal that remains at the dominant level; the falling edge corresponds to a voltage signal where the dominant level is converted to the recessive level; in addition, each dominant signal is not constant, but fluctuates stably within a range. Since each dominant level has 3 stages (rising edge, stable edge, and falling edge), and 9 features (maximum value, minimum value, average value, variance, overshoot, undershoot, mean square error, peak factor, pulse coefficient, dispersion coefficient) are extracted for each stage, a total of 27 features are extracted for each dominant level.

[0091] The features of the rising edge, steady edge and falling edge of the differential voltage in the middle part of each data frame that is greater than 1.5V dominant level are collected respectively; the features collected in each section are maximum value, minimum value, average value, variance, overshoot, undershoot, mean square error, peak factor, pulse coefficient and dispersion coefficient:

[0092] Maximum value Vmax=Max{v i |i=1,2,3…,n},v i The value of the voltage at the sampling point;

[0093] Minimum value Vmin = Min{v i |i=1,2,3…,n};

[0094] average value

[0095] variance

[0096] Overshoot

[0097] Undershoot v base is the voltage value with the highest frequency of occurrence below the middle value, v top is the voltage value with the highest frequency of occurrence above the middle value, v A =v top -v base ;

[0098] Crest Factor

[0099] Pulse coefficient

[0100] Coefficient of dispersion

[0101] Extract this ID x The 27 voltage features of the data frame are converted into image data of size 6×6.

[0102] In the above exemplary embodiment, a method of obtaining the voltage characteristic diagram of the abnormal data frame is introduced. Next, a method of obtaining the abnormal prediction index is introduced.

[0103] In this exemplary embodiment, the voltage characteristic diagram is input into a pre-trained traceability model, and the traceability model outputs an abnormality prediction indicator.

[0104] In a specific implementation, the voltage characteristic diagram is input into a pre-trained traceability model, and the traceability model outputs an abnormal prediction indicator, which refers to:

[0105] Following the above exemplary embodiment, the voltage characteristic diagram is sequentially input into the traceability model Model of each IDi In the output, the abnormal prediction index y i .

[0106] In the above exemplary embodiment, a method of obtaining anomaly prediction indicators is introduced. Below, a method of training a traceability model is further introduced:

[0107] In this exemplary embodiment, the traceability model is trained by the following method:

[0108] Construct a sample set including several samples; wherein the samples include: sample data and label data; the sample data includes a voltage characteristic diagram of a training abnormal data frame; the label data includes a training abnormality recognition index corresponding to the voltage characteristic diagram of the training abnormal data frame; input the sample data into the traceability model to obtain prediction data output by the model, wherein the prediction data includes the abnormal prediction index output by the model; determine the difference between the prediction data and the label data; based on the difference, update the model parameters through a loss function until the difference between the prediction data and the label data is minimized, thereby obtaining the pre-trained traceability model.

[0109] In a specific implementation, a sample set including several samples is constructed; wherein the sample includes: sample data and label data; the sample data includes a voltage characteristic diagram of a training abnormal data frame; the label data includes a training abnormality recognition index corresponding to the voltage characteristic diagram of the training abnormal data frame:

[0110] Following the above exemplary embodiment, the input of the training sample data is a voltage feature sample set of size n×27. During training, the 27 feature values ​​of each voltage will be converted into a 6×6 image, and a label will be assigned to each sample data to indicate whether it is normal or abnormal.

[0111] In a specific implementation, the sample data is input into the traceability model to obtain the prediction data output by the model, wherein the prediction data includes the abnormal prediction index output by the model, which refers to:

[0112] Following the above exemplary embodiment, the sample data X is input into the neural network, and the prediction y is output; wherein, reference Figure 7 , which includes the convolutional layer part and upsampling layer of the ResNet-18 network in the full convolutional layer. The convolutional layer of the ResNet-18 network converts the sample data X into a feature map A based on the feature extraction function φ, and upsamples the feature map A to the same size as the original input image based on the upsampling layer to obtain A'; the upsampled feature map is compared with the original input data X to calculate the reconstruction error, and then output the abnormal prediction index.

[0113] In a specific implementation, determining the difference between the predicted data and the label data; and updating the model parameters based on the difference through a loss function until the difference between the predicted data and the label data is minimized, and obtaining the pre-trained traceability model means:

[0114] During training, the weight w of the neural network is continuously optimized so that normal samples are mapped into the hypersphere and abnormal samples are mapped outside the hypersphere. Specifically, the loss function is expressed as:

[0115]

[0116] Where w is the weight, u·v is the size of the feature map, and the loss function is: A(X)=φ(X;w) 2 +1-1, characteristic function φ: R c×h×w →R u×v ; The number of channels of the input image of the function is c, the height is h, the width is w, and the output feature map is u in height and v in width; that is, this function realizes the extraction of u×v feature map from the voltage image of size c×h×w.

[0117] ||A(X i )||1 is the sum of all A(X), and also serves as the anomaly score. Through training with a large number of samples, an appropriate threshold is selected to maximize the classification effect. This threshold is the boundary of the entire hypersphere, denoted as r. Through iterative training, the network weights are continuously optimized; finally, a traceability model that can identify ECU signals is obtained, and the threshold is manually set, that is, the boundary r of the hypersphere.

[0118] Based on the above exemplary embodiment, each ECU on the CAN bus trains a model Model x , and a parameter table is obtained, including the r of each ECU corresponding to the model x .

[0119] Step S250: tracing the source based on the abnormal prediction indicator to identify the invaded electronic control unit.

[0120] In this exemplary embodiment, tracing the source based on the abnormal prediction index to identify the invaded electronic control unit includes:

[0121] An abnormality distance table is constructed based on the abnormality prediction index, a minimum abnormality distance of the abnormality distance table is determined, and the invaded electronic control unit is identified based on the minimum abnormality distance.

[0122] In a specific implementation, constructing an abnormal distance table based on the abnormal prediction index, determining the minimum abnormal distance of the abnormal distance table, and identifying the invaded electronic control unit based on the minimum abnormal distance means:

[0123] Following the above exemplary embodiment, the abnormal distance of the abnormal data frame is calculated i =|y i 2 -r i 2 |, and get a distance table. Among them, according to the distance with the smallest value in the table min Find the corresponding model Model k , Model k The corresponding ECU is the ECU controlled by the attacker.

[0124] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0125] It should be noted that some embodiments of the present disclosure are described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0126] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides a computer monitoring system controller area network bus tracing intrusion detection device.

[0127] refer to Figure 8 The computer monitoring system controller area network bus tracing intrusion detection device comprises:

[0128] The data frame image determination module 810 is configured to determine the voltage signal of the controller area network bus, and perform encoding conversion on the voltage signal to obtain a data frame image;

[0129] The vector information determination module 820 is configured to reconstruct the data frame image to obtain data frame reconstructed vector information;

[0130] The abnormal data frame determination module 830 is configured to determine the data frame reconstruction vector information based on a preset threshold value to obtain an abnormal data frame;

[0131] A prediction index determination module 840 is configured to determine a voltage characteristic diagram of the abnormal data frame, input the voltage characteristic diagram into a pre-trained tracing model, and the tracing model outputs an abnormal prediction index;

[0132] The intrusion tracing module 850 is configured to perform tracing based on the abnormality prediction indicators to identify the invaded electronic control unit.

[0133] In this exemplary embodiment, the data frame graphic determination module 810 is specifically configured as follows:

[0134] The voltage signal of the controller area network bus is determined, and the voltage signal is converted into analog to digital to obtain an original data frame; and the original data frame is converted into code to obtain the data frame image.

[0135] In this exemplary embodiment, the vector information determination module 820 is specifically configured as follows:

[0136] The data frame image is encoded based on the first encoder to obtain data frame vector information; the data frame vector information is decoded based on the decoder to obtain a reconstructed data frame graphic; the reconstructed data frame graphic is encoded based on the second encoder to obtain the data frame reconstructed vector information.

[0137] In this exemplary embodiment, the abnormal data frame determination module 830 is specifically configured as follows:

[0138] Based on the difference between the data frame vector information and the reconstructed vector information of the data frame, an error score is obtained; whether the error score is less than the preset threshold is determined, and in response to the error score being less than the preset threshold, the original data frame is used as the abnormal data frame.

[0139] In this exemplary embodiment, the prediction index determination module 840 is specifically configured as follows:

[0140] Determine the voltage characteristic graph of the abnormal data frame, input the voltage characteristic graph into a pre-trained traceability model, and the traceability model outputs an abnormal prediction index; train the traceability model by the following method: construct a sample set including a plurality of samples; wherein the sample includes: sample data and label data; the sample data includes the voltage characteristic graph of the training abnormal data frame; the label data includes the training abnormal recognition index corresponding to the voltage characteristic graph of the training abnormal data frame; input the sample data into the traceability model to obtain the predicted data output by the model, wherein the predicted data includes the abnormal prediction index output by the model; determine the difference between the predicted data and the label data; based on the difference, update the model parameters through the loss function until the difference between the predicted data and the label data is minimized, thereby obtaining the pre-trained traceability model.

[0141] In this example embodiment, the intrusion tracing module 850 is specifically configured as follows:

[0142] An abnormality distance table is constructed based on the abnormality prediction index, a minimum abnormality distance of the abnormality distance table is determined, and the invaded electronic control unit is identified based on the minimum abnormality distance.

[0143] For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing the present disclosure, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0144] The device of the above embodiment is used to implement the corresponding computer monitoring system controller area network bus tracing intrusion detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0145] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the computer monitoring system controller area network bus tracing intrusion detection method described in any of the above embodiments is implemented.

[0146] Fig. 9 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0147] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0148] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0149] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0150] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0151] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0152] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0153] The electronic device of the above embodiment is used to implement the corresponding computer monitoring system controller area network bus tracing intrusion detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0154] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the computer monitoring system controller area network bus tracing intrusion detection method as described in any of the above embodiments.

[0155] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0156] The above-mentioned non-transitory computer-readable storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0157] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the computer monitoring system controller area network bus tracing intrusion detection method as described in any embodiment in the above exemplary method part, and have the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0158] Based on the same inventive concept, corresponding to the computer monitoring system controller area network bus tracing intrusion detection method described in any of the above embodiments, the present disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor executes the computer monitoring system controller area network bus tracing intrusion detection method. Corresponding to the execution subject corresponding to each step in each embodiment of the computer monitoring system controller area network bus tracing intrusion detection method, the processor that executes the corresponding step may belong to the corresponding execution subject.

[0159] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute the computer monitoring system controller area network bus tracing intrusion detection method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0160] Those skilled in the art will appreciate that the embodiments of the present disclosure may be implemented as a system, method, or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." In addition, in some embodiments, the present disclosure may also be implemented in the form of a computer program product in one or more computer-readable media, which contains computer-readable program code.

[0161] Any combination of one or more computer-readable media may be used. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive examples) of computer-readable storage media may include, for example: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device.

[0162] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0163] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0164] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0165] It should be understood that each box in the flowchart and / or block diagram and the combination of boxes in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine, and these computer program instructions are executed by a computer or other programmable data processing device to produce a device that implements the functions / operations specified in the boxes in the flowchart and / or block diagram.

[0166] These computer program instructions may also be stored in a computer-readable medium that enables a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable medium produce a product that includes an instruction device that implements the functions / operations specified in the blocks in the flowchart and / or block diagram.

[0167] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby enabling the instructions executed on the computer or other programmable device to provide a process for implementing the functions / operations specified in the blocks in the flowchart and / or block diagram.

[0168] In addition, although the operations of the disclosed method are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in this particular order, or that all the operations shown must be performed to achieve the desired results. On the contrary, the steps depicted in the flow chart can be performed in a different order. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps.

[0169] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0170] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0171] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0172] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0173] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0174] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

[0175] Although the spirit and principle of the present disclosure have been described with reference to several specific embodiments, it should be understood that the present disclosure is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present disclosure is intended to cover various modifications and equivalent arrangements included in the spirit and scope of the attached claims. The scope of the attached claims conforms to the broadest interpretation, thereby including all such modifications and equivalent structures and functions.

Claims

1. A computer monitoring system controller area network bus tracing intrusion detection method, characterized in that: include: Determine a voltage signal of a controller area network bus, and perform encoding conversion on the voltage signal to obtain a data frame image; Reconstructing the data frame image to obtain data frame reconstruction vector information; The vector information reconstructed from the data frame is judged based on a preset threshold value to obtain an abnormal data frame; Determine a voltage characteristic graph of the abnormal data frame, input the voltage characteristic graph into a pre-trained traceability model, and the traceability model outputs an abnormality prediction index; Based on the abnormal prediction indicators, the source is traced to identify the hacked electronic control unit.

2. The method according to claim 1, characterized in that: The step of encoding and converting the voltage signal to obtain a data frame image includes: Performing analog-to-digital conversion on the voltage signal to obtain an original data frame; The original data frame is converted by coding to obtain the data frame image.

3. The method according to claim 2, characterized in that The step of reconstructing the data frame image to obtain data frame reconstruction vector information includes: Encoding the data frame image based on a first encoder to obtain data frame vector information; Decoding the data frame vector information based on a decoder to obtain a reconstructed data frame graph; The reconstructed data frame is graphically encoded based on a second encoder to obtain reconstructed vector information of the data frame.

4. The method according to claim 3, characterized in that The reconstructing the vector information of the data frame based on the preset threshold is judged to obtain the abnormal data frame, including: Obtaining an error score based on a difference between the data frame vector information and the data frame reconstructed vector information; It is determined whether the error score is less than the preset threshold value, and in response to the error score being less than the preset threshold value, the original data frame is used as the abnormal data frame.

5. The method according to claim 1, characterized in that The traceability model also includes training the traceability model by the following method: Constructing a sample set including several samples; wherein the samples include: sample data and label data; the sample data includes a voltage characteristic diagram of a training abnormal data frame; the label data includes a training abnormality recognition index corresponding to the voltage characteristic diagram of the training abnormal data frame; Inputting the sample data into the traceability model to obtain prediction data output by the model, wherein the prediction data includes an abnormal prediction index output by the model; Determining a difference between the predicted data and the label data; Based on the difference, the model parameters are updated through a loss function until the difference between the predicted data and the label data is minimized, thereby obtaining the pre-trained tracing model.

6. The method according to claim 1, characterized in that The tracing back the source based on the abnormal prediction indicator to identify the invaded electronic control unit includes: An abnormality distance table is constructed based on the abnormality prediction index, a minimum abnormality distance of the abnormality distance table is determined, and the invaded electronic control unit is identified based on the minimum abnormality distance.

7. A computer monitoring system controller area network bus tracing intrusion detection device, characterized in that: include: A data frame image determination module is configured to determine a voltage signal of a controller area network bus, and perform encoding conversion on the voltage signal to obtain a data frame image; A vector information determination module is configured to reconstruct the data frame image to obtain data frame reconstruction vector information; an abnormal data frame determination module, configured to determine the data frame reconstruction vector information based on a preset threshold value to obtain an abnormal data frame; A prediction index determination module is configured to determine a voltage characteristic diagram of the abnormal data frame, input the voltage characteristic diagram into a pre-trained traceability model, and the traceability model outputs an abnormal prediction index; The intrusion tracing module is configured to perform tracing based on the abnormal prediction indicators to identify the invaded electronic control unit.

8. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer program instructions, which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 6.

Images