Vehicle intrusion detection method and system, electronic equipment and storage medium

Abstract

The invention discloses a vehicle intrusion detection method and system, electronic equipment and a storage medium, and the method comprises the steps: integrating an intrusion detection system in a vehicle controller to monitor network communication, and collecting safety events; a communication link between the vehicle data center and the vehicle controller is established through the TCP Socket, and data interaction is managed in a unified mode; the cloud situation awareness platform receives and analyzes the security event and generates a security policy; acquiring a registration key for subsequent encryption; the negotiation session key encrypts HTTPS session content; periodically pulling and updating the configuration information; and uploading the network attack alarm to a cloud platform. According to the invention, the technical problem that the security and integrity of vehicle network communication cannot be ensured in the prior art is solved.

Description

Technical Field

[0001] The present invention belongs to the field of vehicle safety technology, and in particular, relates to a vehicle intrusion detection method, system, electronic equipment and storage medium. Background Art

[0002] With the development of self-driving cars, the number of electronic systems in vehicles has increased dramatically. Electronic systems in vehicles are spread across various systems of the vehicle, such as the power system, suspension system, chassis system, power system, safety system, etc., as well as peripheral systems of the vehicle such as in-vehicle entertainment, infotainment, etc. In addition, as cars develop towards intelligence, more and more vehicles communicate with surrounding smart devices through the network, such as network-connected navigation systems, intelligent safety systems, and intelligently connected vehicles. When a car is connected to the network, it means that it can communicate with other devices, and these communications are all achieved through the vehicle's network system. With the development of autonomous driving technology, the number of electronic systems in the vehicle itself has increased dramatically, the number of electronic systems has increased rapidly, and the scale of the network has continued to expand. Therefore, the network security issues of vehicles are receiving more and more attention.

[0003] In order to ensure the security of vehicle network, the following measures are usually taken: 1) Deploy a firewall system in the vehicle's network system to prevent illegal access to the vehicle network; 2) Use secure communication protocols, such as HTTPS, to ensure the security and integrity of communication data transmission; 3) Deploy an intrusion detection system in the vehicle's network system to monitor vehicle network communications, discover and detect network attacks; 4) Regularly update the vehicle's software to ensure the security of the vehicle software.

[0004] However, while the above measures ensure the security of vehicle networks, they also have the following defects: 1) Vehicle software updates and security patch updates need to be carried out through the Internet. Network attackers may intercept the transmission data of the software update package when the vehicle is updated, thereby obtaining new vulnerability information in the software update package and attacking the software in the vehicle; 2) Peripheral devices connected to the vehicle's network system, such as the in-vehicle entertainment system, intelligent safety system, and smart connected cars, have security vulnerabilities, such as the failure to install security patches or the existence of security vulnerabilities. If the security patch is not installed, there is a security vulnerability in the connection between the vehicle and the peripheral devices, which may be exploited by hackers; if there is a security vulnerability, there is a risk of being attacked by hackers when the vehicle network system communicates with the peripheral devices.

[0005] In summary, the existing technology cannot ensure the security and integrity of vehicle network communications. Summary of the invention

[0006] The embodiments of the present invention provide a vehicle intrusion detection method, system, electronic device and storage medium to at least solve the technical problem in the related art that the security and integrity of vehicle network communications cannot be ensured in the prior art.

[0007] According to the first aspect of an embodiment of the present invention, a vehicle intrusion detection method is provided, including: integrating an intrusion detection system IDS component on a vehicle controller, monitoring and analyzing the network communication of the vehicle controller, and collecting security events; establishing a communication link between a vehicle data center VDC and the vehicle controller through a TCP Socket, for unified management of data interaction between the vehicle controller and a cloud situation awareness platform; the cloud situation awareness platform receives security events uploaded by the VDC, analyzes the security events and generates security policies; obtains and stores a registration key RK for subsequent communication encryption; negotiates a session key SK between the vehicle controller and the cloud situation awareness platform, encrypts the HTTPS session content, and ensures the integrity of data transmission; regularly pulls the latest configuration information from the cloud situation awareness platform to adapt to the update of security policies; and uploads the network attack alarms and basic information collected by the IDS component on the vehicle controller to the cloud situation awareness platform through the VDC.

[0008] Optionally, the vehicle data center VDC further includes a network intrusion detection system NIDS and a host intrusion detection system HIDS, which are used to monitor security events at the network layer and the host layer respectively.

[0009] Optionally, the registration key RK is obtained by storing the key based on hardware encryption technology.

[0010] Optionally, the session key SK adopts the Diffie-Hellman algorithm during the negotiation process.

[0011] Optionally, the security events collected by the IDS component on the vehicle controller include abnormal network traffic and irregular data packet structure.

[0012] Optionally, the identification of network traffic anomalies is based on statistical analysis of historical traffic, and an alarm is triggered by setting a threshold.

[0013] Optionally, the identification of irregular data packet structure is performed through deep packet inspection technology.

[0014] According to a second aspect of an embodiment of the present invention, a vehicle intrusion detection system is further provided, comprising:

[0015] The vehicle controller is used to integrate the intrusion detection system IDS component, monitor and analyze the network communication of the vehicle controller, and collect security events; the vehicle data center VDC is used to establish a communication link with the vehicle controller and uniformly manage the data interaction between the vehicle controller and the cloud situation awareness platform; the cloud situation awareness platform is used to receive security events, analyze and generate security policies; the registration key RK acquisition module is used to obtain and store the registration key RK used for subsequent communication encryption; the session key SK negotiation module is used to negotiate the encryption of HTTPS session content between the vehicle controller and the cloud situation awareness platform; the configuration information pull update module is used to regularly update the configuration information related to the security policy; the security event upload module is used to upload network attack alarms and basic information to the cloud situation awareness platform.

[0016] According to a third aspect of an embodiment of the present invention, there is also provided an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the vehicle intrusion detection method described in any embodiment of the first aspect above.

[0017] According to a fourth aspect of an embodiment of the present invention, a non-volatile storage medium is also provided, in which a computer program is stored, wherein the computer program is configured to execute the vehicle intrusion detection method described in any embodiment of the first aspect when running on a computer or a processor.

[0018] According to a fifth aspect of an embodiment of the present invention, a computer program product is also provided, including a computer program, which implements any of the above vehicle intrusion detection methods when executed by a processor.

[0019] In an embodiment of the present invention, an intrusion detection system IDS component is integrated on the vehicle controller to monitor and analyze the network communication of the vehicle controller and collect security events; a communication link is established between the vehicle data center VDC and the vehicle controller through TCP Socket to uniformly manage the data interaction between the vehicle controller and the cloud situation awareness platform; the cloud situation awareness platform receives the security events uploaded by VDC, analyzes the security events and generates security policies; obtains and stores the registration key RK for subsequent communication encryption; negotiates the session key SK between the vehicle controller and the cloud situation awareness platform, encrypts the HTTPS session content, and ensures the integrity of data transmission; regularly pulls the latest configuration information from the cloud situation awareness platform to adapt to the update of security policies; uploads the network attack alarms and basic information collected by the IDS component on the vehicle controller to the cloud situation awareness platform through VDC. This application significantly improves the security protection capability of the vehicle network by integrating the IDS component on the vehicle controller and utilizing the synergy between VDC and the cloud situation awareness platform. The encryption mechanism of the registration key RK and the session key SK enhances the security of data transmission, while the regular update of configuration information and the generation of security policies based on machine learning ensure that the system can adapt to the latest network threats. In addition, through deep packet inspection and abnormal traffic monitoring, this solution can more accurately identify potential network attacks, thereby providing more comprehensive protection for vehicles, and further solving the technical problem in related technologies that the existing technologies cannot ensure the security and integrity of vehicle network communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0021] Figure 1 is a flow chart of a vehicle intrusion detection method according to one embodiment of the present invention;

[0022] Figure 2 is a diagram of an execution system architecture of a vehicle intrusion detection method according to one embodiment of the present invention;

[0023] Figure 3 is a first flow chart of a vehicle intrusion detection method according to one embodiment of the present invention;

[0024] Figure 4 is a second flow chart of a vehicle intrusion detection method according to one embodiment of the present invention;

[0025] Figure 5 is a third flow chart of a vehicle intrusion detection method according to one embodiment of the present invention;

[0026] Figure 6 is a fourth flow chart of a vehicle intrusion detection method according to one embodiment of the present invention;

[0027] Figure 7 is a structural block diagram of a vehicle intrusion detection system according to one embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] According to an embodiment of the present invention, an embodiment of a vehicle intrusion detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system containing at least one set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The method embodiment can also be executed in an electronic device including a memory and a processor, a similar control device or a cloud. Taking an electronic device as an example, the electronic device may include one or more processors and a memory for storing data. Optionally, the electronic device may also include a communication device and a display device for communication functions. It can be understood by those of ordinary skill in the art that the above structural description is only illustrative and does not limit the structure of the above electronic device. For example, the electronic device may also include more or fewer components than the above structural description, or have a configuration different from the above structural description.

[0032] The processor may include one or more processing units. For example, the processor may include a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processing (DSP) chip, a microcontroller unit (MCU), a field-programmable gate array (FPGA), a neural network processor (NPU), a tensor processing unit (TPU), an artificial intelligence (AI) type processor, and other processing devices. Among them, different processing units may be independent components or integrated into one or more processors. In some instances, the electronic device may also include one or more processors.

[0033] The memory can be used to store computer programs, such as storing the computer program corresponding to the vehicle intrusion detection method in the embodiment of the present invention. The processor implements the above-mentioned vehicle intrusion detection method by running the computer program stored in the memory. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory may further include a memory remotely arranged relative to the processor, and these remote memories can be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0034] The communication device is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the communication device includes a network adapter (network interface controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the communication device can be a radio frequency (radio frequency, RF) module, which is used to communicate with the Internet wirelessly. In some embodiments of the present solution, the communication device is used to connect to mobile devices such as mobile phones and tablets, and instructions can be sent to electronic devices through the mobile device.

[0035] The display device may be a touch screen type liquid crystal display (LCD) and a touch display (also referred to as a "touch screen" or "touch display screen"). The liquid crystal display may enable a user to interact with a user interface of the electronic device. In some embodiments, the electronic device has a graphical user interface (GUI), and a user may interact with the GUI by finger contacts and / or gestures on a touch sensitive surface, and executable instructions for executing the above human-computer interaction functions are configured / stored in a computer program product or a readable storage medium executable by one or more processors.

[0036] Figure 1 is a flow chart of a vehicle intrusion detection method according to one embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0037] Step S101, integrating an intrusion detection system IDS component on a vehicle controller, monitoring and analyzing network communications of the vehicle controller, and collecting security events;

[0038] Step S102, establishing a communication link between the vehicle data center VDC and the vehicle controller through TCP Socket, for unified management of data interaction between the vehicle controller and the cloud situation awareness platform;

[0039] Step S103, the cloud situation awareness platform receives the security events uploaded by the VDC, analyzes the security events and generates security policies;

[0040] Step S104, obtaining and storing a registration key RK for subsequent communication encryption;

[0041] Step S105, a session key SK is negotiated between the vehicle controller and the cloud situation awareness platform to encrypt the HTTPS session content to ensure the integrity of data transmission;

[0042] Step S106, regularly pulling the latest configuration information from the cloud situation awareness platform to adapt to the update of security policies;

[0043] Step S107, upload the network attack alarms and basic information collected by the IDS component on the vehicle controller to the cloud situation awareness platform through the VDC.

[0044] In an embodiment of the present invention, an intrusion detection system IDS component is integrated on the vehicle controller to monitor and analyze the network communication of the vehicle controller and collect security events; a communication link is established between the vehicle data center VDC and the vehicle controller through TCP Socket to uniformly manage the data interaction between the vehicle controller and the cloud situation awareness platform; the cloud situation awareness platform receives the security events uploaded by VDC, analyzes the security events and generates security policies; obtains and stores the registration key RK for subsequent communication encryption; negotiates the session key SK between the vehicle controller and the cloud situation awareness platform, encrypts the HTTPS session content, and ensures the integrity of data transmission; regularly pulls the latest configuration information from the cloud situation awareness platform to adapt to the update of security policies; uploads the network attack alarms and basic information collected by the IDS component on the vehicle controller to the cloud situation awareness platform through VDC. This application significantly improves the security protection capability of the vehicle network by integrating the IDS component on the vehicle controller and utilizing the synergy between VDC and the cloud situation awareness platform. The encryption mechanism of the registration key RK and the session key SK enhances the security of data transmission, while the regular update of configuration information and the generation of security policies based on machine learning ensure that the system can adapt to the latest network threats. In addition, through deep packet inspection and abnormal traffic monitoring, this solution can more accurately identify potential network attacks, thereby providing more comprehensive protection for vehicles, and further solving the technical problem in related technologies that the existing technologies cannot ensure the security and integrity of vehicle network communications.

[0045] Furthermore, the vehicle data center VDC further includes a network intrusion detection system NIDS and a host intrusion detection system HIDS, which are used to monitor security events at the network layer and the host layer respectively. Through the collaborative work of NIDS and HIDS, it can not only detect anomalies at the network level, but also go deep into the host level to discover more hidden attack behaviors, providing all-round security protection for the vehicle. In autonomous vehicles, this multi-level monitoring is particularly important to ensure the safe operation of the vehicle in a complex network environment.

[0046] Furthermore, the acquisition module of the registration key RK uses hardware-based encryption technology for key storage to enhance security. Hardware encryption technology can provide a higher level of security than software encryption, preventing the key from being illegally accessed or tampered with, and ensuring the security of communication between the vehicle and the cloud. In scenarios involving sensitive data transmission, such as vehicle remote diagnosis and software updates, hardware-encrypted RK can effectively prevent data leakage and protect user privacy.

[0047] Furthermore, the session key SK negotiation module uses the Diffie-Hellman algorithm during the negotiation process to ensure the security and randomness of the key. The Diffie-Hellman algorithm can securely generate session keys in an insecure network environment. Even if the communication is monitored, it is difficult to crack the session key, thus protecting the communication content between the vehicle and the cloud. In the Internet of Vehicles environment, the application of this algorithm can effectively prevent man-in-the-middle attacks and ensure the confidentiality and integrity of vehicle data.

[0048] Furthermore, the security events collected by the IDS component on the vehicle controller include features such as abnormal network traffic and irregular data packet structure, which are used to identify potential network attacks. This feature recognition can help the system quickly locate the source of the attack, which is suitable for rapid response scenarios when the vehicle encounters a network attack. It can effectively reduce the damage of the attack to the vehicle network and protect vehicle data and user privacy.

[0049] Furthermore, the cloud situational awareness platform analyzes the collected security events based on machine learning algorithms to improve the accuracy and response speed of security policies. The application of machine learning algorithms enables the cloud situational awareness platform to intelligently analyze network behavior, adapt to the dynamic changes in the vehicle network environment, and adjust security policies in a timely manner to effectively respond to new network threats and provide continuous security protection for vehicles.

[0050] Furthermore, the identification of network traffic anomalies is based on the statistical analysis of historical traffic, and alarms are triggered by setting thresholds. This statistical analysis method can effectively monitor the normal operation status of vehicle networks, and is suitable for vehicle network traffic monitoring and anomaly detection scenarios. It can promptly detect abnormal fluctuations in network traffic and prevent potential network attacks.

[0051] Furthermore, the identification of irregular data packet structures is performed through deep packet inspection technology, which can analyze the structural characteristics of data packets to discover potential threats. The application of deep packet inspection technology improves the accuracy of security event detection and is suitable for deep protection scenarios of vehicle networks. It can effectively identify attack behaviors hidden in normal data packets and provide comprehensive security protection for vehicles.

[0052] Furthermore, machine learning algorithms include supervised learning, unsupervised learning, and reinforcement learning, which can adapt to different types of network attacks. The diversity of this algorithm enables the system to intelligently respond to various attack modes, which is suitable for intelligent protection scenarios of vehicle networks, and can effectively improve the adaptability and effectiveness of security strategies, providing comprehensive security protection for vehicles.

[0053] Furthermore, the generation and update of security policies are based on real-time analysis results and can be dynamically adjusted to cope with the ever-changing network environment. This dynamic adjustment mechanism enables the system to respond to changes in the network environment in real time, which is suitable for real-time protection scenarios of vehicle networks, and can effectively respond to sudden network attacks and protect the stable operation of vehicle networks.

[0054] For example, refer to Figures 2 to 6 , our specific implementation is as follows:

[0055] The vehicle controller establishes a communication link with the unified VDC through the TCP Socket channel, and the VDC interacts with the cloud situation awareness platform. The VDC and the platform transmit relevant data through HTTPS and Socket / TLS interfaces. The overall architecture is shown in the attached figure. Figure 1 .

[0056] The cloud situational awareness platform can realize the security monitoring of all controllers of the vehicle by analyzing and counting the data reported by the vehicle-side IDS components. The platform can form a security strategy by comprehensively analyzing the security events reported by the vehicle-side, and provide a security inspection strategy for all controllers of the vehicle.

[0057] The communication between all vehicle controllers and the platform is forwarded through VDC, including device registration, session negotiation, configuration pull, event upload and other information. The overall process design is as follows: Figure 2 shown.

[0058] The process of registering the key is as follows, as shown in the attached Figure 3 As shown:

[0059] 1. The IDS obtains the unique device identification number (SN) of the terminal and transmits the SN number to the VDC and forwarding platform for registration;

[0060] 2. After verifying the correctness of the SN number, the platform calculates the IDS registration key (RK) based on the SN number;

[0061] 3. After saving the RK, the platform returns the RK and its HMAC value to the VDC, which then forwards it to the controller’s IDS.

[0062] 4. After IDS verification is completed, the RK assigned by the platform is stored in an encrypted manner.

[0063] The process of session negotiation is as follows. Figure 4 As shown:

[0064] 1. The IDS carries the unique identification number (SN) of the device and a randomly generated 8-byte number encrypted by the registration key (RK), and sends the ciphertext to the VDC after HMAC signing and forwarding it to the platform to start negotiating the session key;

[0065] 2. The platform decrypts the device registration key (RK) queried by the SN and verifies whether the HMAC is legal, then calculates and generates the session key (SK). The platform encrypts SK through RK and transmits it to the VDC to forward to each controller;

[0066] 3. All subsequent HTTPS session contents will be encrypted and transmitted via SK, and integrity checked via HMAC.

[0067] 4. Each session key is valid for 24 hours and needs to be negotiated again after it expires.

[0068] The process of pulling configuration information is as follows:

[0069] 1. After each vehicle controller starts the IDS component, the IDS component autonomously calls the configuration pull interface to perform the configuration pull process. The following processes are all implemented through the configuration pull interface;

[0070] 2. After the IDS component is started and the registration process and session negotiation process are completed, the IDS component pulls the configuration and transmits the message to the IDS platform;

[0071] 3. The IDS platform generates the latest configuration and forwards it to each controller-IDS through the VDC;

[0072] 4. IDS components are updated to use new configuration files.

[0073] The event is uploaded as follows:

[0074] 1. After the IDS component completes configuration pulling, it will collect two types of data. One type is the basic information of the controller, such as system and version, which is reported once through VDC during the IDS operation cycle; the other type is various potential security events, such as network attack alarm events, which are uploaded to the platform through VDC after they occur.

[0075] The vehicle-side functions include four parts:

[0076] 1. Overall framework: identity management, network management, data management, probe management, and policy management.

[0077] 2. Security monitoring functions: network activity security monitoring, system resource security monitoring, file activity security monitoring, system configuration integrity monitoring, traffic monitoring, process security monitoring, virus detection.

[0078] 3. Ethernet security monitoring: TCP_SYN_SCAN, TCP_FIN_SCAN, etc.

[0079] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0080] In this embodiment, a vehicle intrusion detection system is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" is a combination of software and / or hardware that can implement a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0081] Figure 7 FIG. 2 is a block diagram of a vehicle intrusion detection system 200 according to one embodiment of the present invention. Figure 7 As shown, a vehicle intrusion detection system 200 is used as an example, including: a vehicle controller 201, which is used to integrate the intrusion detection system IDS component, monitor and analyze the network communication of the vehicle controller, and collect security events; a vehicle data center VDC202, which is used to establish a communication link with the vehicle controller and uniformly manage the data interaction between the vehicle controller and the cloud situation awareness platform; a cloud situation awareness platform 203, which is used to receive security events, analyze and generate security policies; a registration key RK acquisition module 204, which is used to obtain and store the registration key RK used for subsequent communication encryption; a session key SK negotiation module 205, which is used to negotiate the encryption of HTTPS session content between the vehicle controller and the cloud situation awareness platform; a configuration information pull and update module 206, which is used to regularly update the configuration information related to the security policy; a security event upload module 207, which is used to upload network attack alarms and basic information to the cloud situation awareness platform.

[0082] Optionally, in this embodiment, the processor in the above electronic device may be configured to run a computer program to perform the following steps:

[0083] Integrate the intrusion detection system IDS component on the vehicle controller to monitor and analyze the network communication of the vehicle controller and collect security events; establish a communication link between the vehicle data center VDC and the vehicle controller through TCP Socket to uniformly manage the data interaction between the vehicle controller and the cloud situation awareness platform; the cloud situation awareness platform receives security events uploaded by VDC, analyzes security events and generates security policies; obtains and stores the registration key RK for subsequent communication encryption; negotiates the session key SK between the vehicle controller and the cloud situation awareness platform, encrypts the HTTPS session content, and ensures the integrity of data transmission; regularly pulls the latest configuration information from the cloud situation awareness platform to adapt to the update of security policies; uploads the network attack alarms and basic information collected by the IDS component on the vehicle controller to the cloud situation awareness platform through VDC.

[0084] Optionally, the vehicle data center VDC further includes a network intrusion detection system NIDS and a host intrusion detection system HIDS, which are used to monitor security events at the network layer and the host layer respectively.

[0085] Optionally, the registration key RK is obtained by storing the key based on hardware encryption technology.

[0086] Optionally, the session key SK adopts the Diffie-Hellman algorithm during the negotiation process.

[0087] Optionally, the security events collected by the IDS component on the vehicle controller include abnormal network traffic and irregular data packet structure.

[0088] Optionally, the identification of network traffic anomalies is based on statistical analysis of historical traffic, and an alarm is triggered by setting a threshold.

[0089] Optionally, the identification of irregular data packet structure is performed through deep packet inspection technology.

[0090] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0091] An embodiment of the present invention further provides a non-volatile storage medium, in which a computer program is stored, wherein the computer program is configured to execute the vehicle intrusion detection method described in any of the above embodiments when running on a computer or a processor.

[0092] Optionally, in this embodiment, the above-mentioned computer program may be configured to store a computer program for performing the following steps:

[0093] Integrate the intrusion detection system IDS component on the vehicle controller to monitor and analyze the network communication of the vehicle controller and collect security events; establish a communication link between the vehicle data center VDC and the vehicle controller through TCP Socket to uniformly manage the data interaction between the vehicle controller and the cloud situation awareness platform; the cloud situation awareness platform receives security events uploaded by VDC, analyzes security events and generates security policies; obtains and stores the registration key RK for subsequent communication encryption; negotiates the session key SK between the vehicle controller and the cloud situation awareness platform, encrypts the HTTPS session content, and ensures the integrity of data transmission; regularly pulls the latest configuration information from the cloud situation awareness platform to adapt to the update of security policies; uploads the network attack alarms and basic information collected by the IDS component on the vehicle controller to the cloud situation awareness platform through VDC.

[0094] Optionally, the vehicle data center VDC further includes a network intrusion detection system NIDS and a host intrusion detection system HIDS, which are used to monitor security events at the network layer and the host layer respectively.

[0095] Optionally, the registration key RK is obtained by storing the key based on hardware encryption technology.

[0096] Optionally, the session key SK adopts the Diffie-Hellman algorithm during the negotiation process.

[0097] Optionally, the security events collected by the IDS component on the vehicle controller include abnormal network traffic and irregular data packet structure.

[0098] Optionally, the identification of network traffic anomalies is based on statistical analysis of historical traffic, and an alarm is triggered by setting a threshold.

[0099] Optionally, the identification of irregular data packet structure is performed through deep packet inspection technology.

[0100] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0101] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the vehicle intrusion detection method described in any of the above embodiments when executed by a processor.

[0102] Optionally, in this embodiment, the above computer program implements the following steps when executed by a processor:

[0103] Integrate the intrusion detection system IDS component on the vehicle controller to monitor and analyze the network communication of the vehicle controller and collect security events; establish a communication link between the vehicle data center VDC and the vehicle controller through TCP Socket to uniformly manage the data interaction between the vehicle controller and the cloud situation awareness platform; the cloud situation awareness platform receives security events uploaded by VDC, analyzes security events and generates security policies; obtains and stores the registration key RK for subsequent communication encryption; negotiates the session key SK between the vehicle controller and the cloud situation awareness platform, encrypts the HTTPS session content, and ensures the integrity of data transmission; regularly pulls the latest configuration information from the cloud situation awareness platform to adapt to the update of security policies; uploads the network attack alarms and basic information collected by the IDS component on the vehicle controller to the cloud situation awareness platform through VDC.

[0104] Optionally, the vehicle data center VDC further includes a network intrusion detection system NIDS and a host intrusion detection system HIDS, which are used to monitor security events at the network layer and the host layer respectively.

[0105] Optionally, the registration key RK is obtained by storing the key based on hardware encryption technology.

[0106] Optionally, the session key SK adopts the Diffie-Hellman algorithm during the negotiation process.

[0107] Optionally, the security events collected by the IDS component on the vehicle controller include abnormal network traffic and irregular data packet structure.

[0108] Optionally, the identification of network traffic anomalies is based on statistical analysis of historical traffic, and an alarm is triggered by setting a threshold.

[0109] Optionally, the identification of irregular data packet structure is performed through deep packet inspection technology.

[0110] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0111] In some embodiments provided in the present application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the modules can be a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, modules or indirect coupling or communication connection of modules, which can be electrical or other forms.

[0112] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0113] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of software functional modules.

[0114] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, ReadOnly Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0115] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A vehicle intrusion detection method, characterized in that: include: Integrate the intrusion detection system IDS component on the vehicle controller to monitor and analyze the network communication of the vehicle controller and collect security events; A communication link is established between the vehicle data center VDC and the vehicle controller through TCP Socket to uniformly manage the data interaction between the vehicle controller and the cloud situation awareness platform; The cloud situational awareness platform receives security events uploaded by the VDC, analyzes security events and generates security policies; Obtain and store the registration key RK for subsequent communication encryption; Negotiate the session key SK between the vehicle controller and the cloud situational awareness platform, encrypt the HTTPS session content, and ensure the integrity of data transmission; Regularly pull the latest configuration information from the cloud situational awareness platform to adapt to security policy updates; The network attack alerts and basic information collected by the IDS component on the vehicle controller are uploaded to the cloud situational awareness platform through the VDC.

2. The vehicle intrusion detection method according to claim 1, characterized in that: The vehicle data center VDC further includes a network intrusion detection system NIDS and a host intrusion detection system HIDS, which are used to monitor security events at the network layer and the host layer respectively.

3. The vehicle intrusion detection method according to claim 1, characterized in that: The registration key RK is obtained by storing the key based on hardware encryption technology.

4. The vehicle intrusion detection method according to claim 1, characterized in that: The session key SK adopts the Diffie-Hellman algorithm during the negotiation process.

5. The vehicle intrusion detection method according to claim 1, characterized in that: The security events collected by the IDS component on the vehicle controller include abnormal network traffic and irregular data packet structure.

6. The vehicle intrusion detection method according to claim 5, characterized in that: The identification of network traffic anomalies is based on statistical analysis of historical traffic, and alarms are triggered by setting thresholds.

7. The vehicle intrusion detection method according to claim 5, characterized in that: The identification of irregular data packet structure is performed through deep packet inspection technology.

8. A vehicle intrusion detection system, characterized in that: include: The vehicle controller is used to integrate the IDS component of the intrusion detection system, monitor and analyze the network communication of the vehicle controller, and collect security events; The vehicle data center VDC is used to establish a communication link with the vehicle controller and uniformly manage the data interaction between the vehicle controller and the cloud situation awareness platform; Cloud-based situational awareness platform, used to receive security events, analyze and generate security policies; A registration key RK acquisition module, used to acquire and store the registration key RK used for subsequent communication encryption; The session key SK negotiation module is used to negotiate the encryption of the HTTPS session content between the vehicle controller and the cloud situational awareness platform; Configuration information pull and update module, used to regularly update configuration information related to security policies; The security event upload module is used to upload network attack alerts and basic information to the cloud situation awareness platform.

9. An electronic device, comprising a memory and a processor, characterized in that: The memory stores a computer program, and the processor is configured to run the computer program to execute the vehicle intrusion detection method described in any one of claims 1 to 7.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a computer program, wherein the computer program is configured to execute the vehicle intrusion detection method described in any one of claims 1 to 7 when running on a computer or a processor.

Images