Vehicle gateway network security attack identification method, device and system, vehicle gateway, vehicle and storage medium
Through the identification method performed in the vehicle gateway, the trained attack event identification model is used to identify automobile network security attacks, and the problem of false alarms or missed reports in the prior art is solved, and the model is updated in real time to adapt to new network security events, improving identification accuracy and protection capabilities.
Patent Information
- Application Number
- CN202411813989.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-10
- Publication Date
- 2025-03-18
AI Technical Summary
The prior art is prone to false alarms or missed reports when identifying automotive network security attacks, and it is difficult to effectively deal with new types of network security incidents.
Through the method executed by the vehicle gateway, a trained attack event identification model is received, communication data is obtained from the communication module and/or log data, communication abnormal events are determined, and identification is performed through the attack event identification model. In the event of a new type of network security incident, the associated communication data is transmitted to the training server, the training samples are expanded and the identification model is updated.
It improves the accuracy of network security attack identification, avoids false alarms or missed reports, and can adapt to new network security incidents in real time, enhancing the protection capabilities of automotive network security.
Smart Images
Figure CN119652617A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present invention generally relate to the field of vehicle network security technology, and more specifically, to a vehicle gateway network security attack identification method, device, system, vehicle gateway, vehicle and storage medium. Background Art
[0002] At present, the rapid development of automobile intelligence has promoted the deep integration of automobiles with the Internet, big data, communications and other industries. At the same time, it has also brought network and data security issues to automobiles. The increase in the rate of automobile networking has gradually made it a key target of cyber attacks. In the past 10 years, the number of automobile network security incidents has been increasing sharply, and the risk of security issues is prominent, but the foundation of security protection is weak. Therefore, the network security of automobiles has become an important target that needs to be developed urgently.
[0003] Current solutions usually identify network security attacks based on fixed rules, but this approach can easily lead to false positives or false negatives. Summary of the invention
[0004] In order to solve the above-mentioned problems in the prior art, in a first aspect, an embodiment of the present invention provides a vehicle gateway network security attack identification method, which is executed by a vehicle gateway, and the method includes: receiving a trained attack event identification model from a training server; obtaining communication data from a communication module and / or log data; determining a communication abnormality event based on the communication data; inputting the communication abnormality event into the attack event identification model, and identifying the network security attack event in the communication abnormality event through the attack event identification model; when a new type of network security event occurs, transmitting the communication data associated with the new type of network security event to the training server as an expansion of the training sample of the attack event identification model, so that the training server retrains and updates the attack event identification model according to the expanded training sample.
[0005] In some embodiments, the communication module includes one or more of the following: a controller area network communication module; a mobile communication module; a WIFI communication module; an Ethernet communication module.
[0006] In some implementations, the log data records all communication events or a predefined portion of communication events of the communication module.
[0007] In some embodiments, when a new type of network security event occurs, transmitting communication data associated with the new type of network security event to the training server includes: transmitting the communication data associated with the new type of network security event to a communication data collector and a log data collector respectively through communication data classification and log data classification; transmitting the collected communication data associated with the new type of network security event to the training server through the communication data collector and the log data collector.
[0008] In the second aspect, an embodiment of the present invention proposes a vehicle gateway network security attack identification device, which is implemented by a vehicle gateway, and the device includes: an identification model receiving module, configured to receive a trained attack event identification model from a training server; a communication data acquisition module, configured to obtain communication data from a communication module and / or log data; a communication anomaly determination module, configured to determine a communication anomaly event based on the communication data; a network security attack identification module, configured to input the communication anomaly event into the attack event identification model, and identify the network security attack event in the communication anomaly event through the attack event identification model; a sample expansion module, configured to transmit the communication data associated with a new type of network security event to the training server when a new type of network security event occurs, as an expansion of the training sample of the attack event identification model, so that the training server can retrain and update the attack event identification model based on the expanded training sample.
[0009] In some embodiments, the sample expansion module further includes: a sample data collection submodule, configured to: transmit the communication data associated with the new type of network security event to the communication data collector and the log data collector respectively through the communication data classification and log data classification; a sample data transmission submodule, configured to: transmit the collected communication data associated with the new type of network security event to the training server through the communication data collector and the log data collector.
[0010] In a third aspect, an embodiment of the present invention proposes a vehicle gateway, which includes a memory and a processor, wherein a computer program is stored on the memory, and when the computer program is executed by the processor, the vehicle gateway network security attack identification method described in any of the above embodiments is implemented.
[0011] In a fourth aspect, an embodiment of the present invention provides a vehicle, wherein the vehicle includes the vehicle gateway described in the above embodiment.
[0012] In the fifth aspect, an embodiment of the present invention proposes a vehicle gateway network security attack identification system, the system comprising a vehicle gateway and a training server. The vehicle gateway is used to: receive a trained attack event identification model from the training server; obtain communication data from a communication module and / or log data; determine a communication abnormality event based on the communication data; input the communication abnormality event into the attack event identification model, and identify the network security attack event in the communication abnormality event through the attack event identification model; when a new type of network security event occurs, the communication data associated with the new type of network security event is transmitted to the training server. The training server is used to: receive communication data associated with a new type of network security event from the vehicle gateway as an expansion of the training sample of the attack event identification model; retrain and update the attack event identification model based on the expanded training sample; and transmit the updated attack event identification model to the vehicle gateway.
[0013] In a sixth aspect, an embodiment of the present invention provides a storage medium storing computer-readable instructions, which, when executed by a processor, executes the method described in any of the above embodiments.
[0014] The implementation method of the present invention innovatively proposes to identify automobile network security events, and in the implementation method, data sets can be collected, updated and analyzed in real time, and the latest and more complete data sets can be used for training to obtain new models for identification, thereby improving the accuracy of identification and avoiding false positives or negative negatives.
[0015] For the latest new security incidents, the identification step is placed in the car gateway to reduce the traffic consumption and bandwidth resource occupation of the car gateway, achieve identification at a faster speed, and use a convolutional neural network with a faster training speed for training, which saves time for subsequent processing from two aspects. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] The above and other objects, features and advantages of the embodiments of the present invention will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, in which:
[0017] Figure 1 A flow chart of a vehicle gateway network security attack identification method according to an embodiment of the present invention is shown;
[0018] Figure 2 A schematic diagram showing an example of a vehicle gateway network security attack identification system according to an embodiment of the present invention.
[0019] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION
[0020] The principle and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way.
[0021] In one aspect, an embodiment of the present invention provides a vehicle gateway network security attack identification method, which is executed by a vehicle gateway. Figure 1 , which shows a flow chart of a vehicle gateway network security attack identification method according to an embodiment of the present invention. The method includes steps S101-S105.
[0022] In step S101, a trained attack event recognition model is received from a training server.
[0023] As an example, the attack event recognition model is a convolutional neural network, and its training is completed in the training server. For example, by building and installing TensorFlow on the server, it is designed through Python programming. The data processing capabilities of Python can efficiently complete the batch preprocessing of the training data set and the test data set, and the powerful computing power and GPU acceleration capabilities of the server can be used to reduce the training time of the model and obtain a trained model. The trained model is exported through TensorFlow. The trained model can detect / classify real-time data.
[0024] For example, the training server may include a preprocessing module for vehicle network security attack event data and a training model for identifying vehicle network security attack events, and train the vehicle network security attack event data through a convolutional neural network.
[0025] Just as an example, a convolutional neural network algorithm could look like this:
[0026] For the input data x, the convolution calculation formula of the σth feature map of the mth hidden layer Layer-m is defined as follows:
[0027]
[0028] in, The output obtained by extracting the features of the previous layer by the convolution kernel σ of the mth layer; w (m，σ) is the weight parameter of the convolution kernel σ of the mth layer; is the i-th feature map of the m-1th layer; b (m，σ) is the bias value; f is the activation function.
[0029] For each convolutional feature output map, perform a 1D input max.pooling operation. The result obtained by performing the maximum pooling operation on the output of the previous layer by the convolution kernel σ of the mth layer:
[0030]
[0031] The output prediction value is Pre = {pre1, pre2, ..., pren};
[0032] The output prediction value is input into the fully connected layer, and it is identified and classified to obtain the final result.
[0033] In step S102, communication data is obtained from the communication module and / or log data. As an embodiment of the present invention, the communication module may include one or more of the following: a controller area network (CAN) communication module; a mobile communication (e.g., 4G mobile communication, 5G mobile communication) module; a WIFI communication module; an Ethernet communication module.
[0034] As an implementation manner of the present invention, the log data may record all communication events of the communication module or a predefined portion of communication events.
[0035] In step S103, a communication abnormality event is determined according to the communication data.
[0036] In step S104, the abnormal communication event is input into an attack event identification model, and the network security attack event in the abnormal communication event is identified by the attack event identification model.
[0037] The trained model is put into the car gateway that generates data and runs it. In this way, the car gateway does not need to upload various types of data generated to the server for identifying network security incidents, which reduces the traffic consumption and bandwidth resource occupation of the car gateway and achieves the purpose of real-time identification and analysis.
[0038] In step S105, when a new type of network security event occurs, the communication data associated with the new type of network security event is transmitted to the training server as an expansion of the training samples of the attack event recognition model, so that the training server retrains and updates the attack event recognition model according to the expanded training samples.
[0039] As an example, vehicle data collected for real-time recognition algorithm training should be combined with the original initial data set.
[0040] When encountering the latest new type of network security incident, after identifying whether it is an attack behavior, the data is expanded into the original data set to obtain a new data set, and retrained to obtain a new model, so as to achieve the purpose of real-time updating.
[0041] The vehicle gateway network security attack identification method proposed in the embodiment of the present invention uses deep learning to apply the autoencoder convolutional neural network combined with the original β feature to the identification of network security events to better improve the identification ability. In order to enable the identification method to adapt to the real-time environment of the vehicle, the embodiment of the present invention collects and organizes the data in the vehicle in real time, especially the network data, log data and CAN data, constructs a data set for the field of vehicle network security detection, and processes and marks the data set.
[0042] As an example, the data sets are obtained by defining rule targets through network filtering and firewall mechanisms in the vehicle gateway, performing event recognition in the vehicle gateway, and realizing real-time collection of network data; deploying network intrusion detection applications in the vehicle gateway to realize the collection of log data; and realizing the collection of CAN data in the vehicle gateway according to actual conditions. The collected original data sets are uploaded to the training server through the vehicle gateway for real-time training of network security features.
[0043] The implementation mode of the present invention proposes a set of lightweight and efficient automobile network security event identification methods for embedded environments. The method realizes feature matching based on real-time analysis of automobile network attack events through real-time collection of vehicle network security data, thereby solving the problem of mismatch between traditional network security events and automobile network security events.
[0044] By building convolutional neural network training and the TensorFlow framework on the training server, the training efficiency is improved, solving the problem of low efficiency in identifying network security incidents based on deep learning.
[0045] The automotive network security incident identification method proposed in the embodiment of the present invention can collect, update and analyze data sets in real time. For the latest emerging new security incidents, the latest and more complete data sets can be used for training to obtain a new model for identification.
[0046] As an embodiment of the present invention, when a new type of network security event occurs, transmitting communication data associated with the new type of network security event to a training server may include: transmitting the communication data associated with the new type of network security event to a communication data collector and a log data collector respectively through communication data classification and log data classification; transmitting the collected communication data associated with the new type of network security event to the training server through the communication data collector and the log data collector.
[0047] On the other hand, an embodiment of the present invention proposes a vehicle gateway network security attack identification device, which is implemented by a vehicle gateway and includes a recognition model receiving module, a communication data acquisition module, a communication anomaly determination module, a network security attack identification module and a sample expansion module.
[0048] The recognition model receiving module may be configured to receive a trained attack event recognition model from a training server.
[0049] The communication data acquisition module may be configured to acquire communication data from the communication module and / or log data.
[0050] The communication anomaly determination module may be configured to determine a communication anomaly event according to the communication data.
[0051] The network security attack identification module can be configured to input the communication abnormality event into the attack event identification model, and identify the network security attack event in the communication abnormality event through the attack event identification model.
[0052] The sample expansion module can be configured to transmit communication data associated with a new type of network security event to a training server as an expansion of the training samples of the attack event identification model when a new type of network security event occurs, so that the training server can retrain and update the attack event identification model based on the expanded training samples.
[0053] As an embodiment of the present invention, the sample expansion module may further include the following submodules:
[0054] The sample data collection submodule may be configured to: transmit the communication data associated with the new network security event to the communication data collector and the log data collector respectively through the communication data classification outbound transmission and the log data classification outbound transmission;
[0055] The sample data transmission submodule may be configured to: transmit the collected communication data associated with a new type of network security event to a training server through a communication data collector and a log data collector.
[0056] It should be noted that the functions implemented by each module in the vehicle gateway network security attack identification device proposed in the embodiment of the present invention correspond one-to-one to the various steps of the vehicle gateway network security attack identification method described above. For its specific implementation methods, examples and beneficial effects, please refer to the above description of the method.
[0057] On the other hand, an embodiment of the present invention proposes a vehicle gateway, which includes a memory and a processor. A computer program is stored in the memory, and when the computer program is executed by the processor, the vehicle gateway network security attack identification method described in any of the above embodiments is implemented.
[0058] In yet another aspect, an embodiment of the present invention provides a vehicle, which includes the vehicle gateway described in the above embodiment.
[0059] In another aspect, an embodiment of the present invention provides a vehicle gateway network security attack identification system, the system comprising a vehicle gateway and a training server. Figure 2 , which shows a schematic diagram of an example of a vehicle gateway network security attack identification system according to an embodiment of the present invention.
[0060] Vehicle Gateway (in Figure 2 The vehicle gateway (shown in the figure) can be used to: receive a trained attack event recognition model from a training server; obtain communication data from a communication module and / or log data; determine abnormal communication events based on the communication data; input the abnormal communication events into the attack event recognition model, and identify network security attack events in the abnormal communication events through the attack event recognition model; when a new type of network security event occurs, transmit the communication data associated with the new type of network security event to the training server.
[0061] The training server can be used to: receive communication data associated with new network security events from the vehicle gateway as an expansion of the training samples of the attack event recognition model; retrain and update the attack event recognition model based on the expanded training samples; and transmit the updated attack event recognition model to the vehicle gateway.
[0062] As an example, the car gateway can be installed with an operating system such as Linux, with Netfilter and iptables functions, can access the training server in real time, and has an ARM machine learning open source software system. The training server can perform data noise reduction preprocessing after receiving the data. The training server can use the Ubuntu operating system and use Python programming.
[0063] As an example, the training server may include a preprocessing module for vehicle network security attack event data and a training model for identifying vehicle network security attack events, and train the vehicle network security attack event data through a convolutional neural network.
[0064] The automotive gateway operating system is used to identify automotive events.
[0065] refer to Figure 2 The automobile event recognition model operation module is located in the automobile gateway and is used to receive the recognition training model trained from the training server. The automobile event recognition model operation module sends the received recognition training model to the automobile gateway operating system.
[0066] The CAN communication module and 4G / 5G / WIFI communication module are used to collect bus network security attack events and Ethernet network security attack events. After collection, the collected data is sent to the automotive gateway operating system through CAN attack event reporting and network attack reporting for identification.
[0067] For new attack events, the event data can be transmitted to the CAN data collector, log data collector and network data collector through network data classification, log data classification and CAN data classification. Then, the vehicle network security attack event is sent back to the training server to train a new recognition training model.
[0068] As an example, the training server contains an attack event processing model based on principal component analysis, combined with a real-time identification training model for network security events based on machine learning.
[0069] As an example, the automotive gateway operating system includes a development environment that can support the operation of recognition algorithms and can support the operation and update of models sent by training servers.
[0070] On the other hand, an embodiment of the present invention provides a storage medium storing computer-readable instructions, which, when executed by a processor, executes the vehicle gateway network security attack identification method described in any of the above embodiments.
[0071] In response to the network security issues of intelligent connected vehicles, the embodiments of the present invention provide a method for dynamically identifying network security attacks on vehicle gateways to identify whether the vehicle network is under attack, improve its accuracy and recognition efficiency, and collect, update and analyze the entire network security attack data set in real time. Through deep learning, the massive heterogeneous data generated in real time by the key components of intelligent vehicles in the vehicle Ethernet, such as CAN data, log data, network data, etc., are analyzed in real time, key features are extracted, and the model obtained by deep learning is used to analyze whether the behavior is an attack behavior or a normal behavior. The identification features are applied to the vehicle gateway to realize the dynamic identification of network security attacks applied to the vehicle gateway.
[0072] The technical solution proposed by the present invention innovatively proposes to identify automobile network security events, and in the implementation plan, data sets can be collected, updated and analyzed in real time, and the latest and more complete data sets can be used for training to obtain a new model for identification, thereby improving the accuracy of identification and avoiding false positives or negative negatives.
[0073] For the latest new security incidents, the identification step is placed in the car gateway to reduce the traffic consumption and bandwidth resource occupation of the car gateway, achieve identification at a faster speed, and use a convolutional neural network with a faster training speed for training, which saves time for subsequent processing from two aspects.
[0074] For the purpose of illustration, the foregoing description of the embodiments of the present invention has been given, which is not exhaustive nor intended to limit the present invention to the disclosed exact form. It will be appreciated by those skilled in the art that various changes can be made without departing from the scope of the present invention, and that the elements therein can be replaced with equivalents. In addition, without departing from the basic scope of the present invention, many modifications can be made so that specific situations or materials are adapted to the teachings of the present invention. Therefore, the present invention is not intended to be limited to the specific embodiments disclosed as the best mode for realizing the present invention, and the present invention will include all embodiments falling within the scope of the appended claims.
Claims
1. A vehicle gateway network security attack identification method, characterized in that: The method is performed by a vehicle gateway, and the method includes: receiving a trained attack event recognition model from a training server; Obtaining communication data from a communication module and / or log data; Determine a communication abnormality event according to the communication data; Inputting the abnormal communication event into the attack event identification model, and identifying the network security attack event in the abnormal communication event through the attack event identification model; When a new type of network security event occurs, the communication data associated with the new type of network security event is transmitted to the training server as an expansion of the training samples of the attack event identification model, so that the training server can retrain and update the attack event identification model according to the expanded training samples.
2. The method according to claim 1, characterized in that The communication module includes one or more of the following: Controller area network communication module; Mobile communication module; WIFI communication module; Ethernet communication module.
3. The method according to claim 1, characterized in that The log data records all communication events or a predefined portion of communication events of the communication module.
4. The method according to claim 1, characterized in that When a new type of network security event occurs, transmitting communication data associated with the new type of network security event to the training server includes: The communication data associated with the new network security incident is transmitted to the communication data collector and the log data collector respectively through the communication data classification outbound transmission and the log data classification outbound transmission; The collected communication data associated with the new network security event is transmitted to the training server through the communication data collector and the log data collector.
5. A vehicle gateway network security attack identification device, characterized in that: The device is implemented by a vehicle gateway, and the device includes: A recognition model receiving module, configured to receive a trained attack event recognition model from a training server; A communication data acquisition module configured to acquire communication data from the communication module and / or log data; a communication anomaly determination module, configured to determine a communication anomaly event according to the communication data; A network security attack identification module, configured to input the communication abnormality event into the attack event identification model, and identify the network security attack event in the communication abnormality event through the attack event identification model; The sample expansion module is configured to transmit the communication data associated with a new type of network security event to the training server as an expansion of the training samples of the attack event identification model when a new type of network security event occurs, so that the training server can retrain and update the attack event identification model according to the expanded training samples.
6. The device according to claim 5, characterized in that The sample expansion module further includes: The sample data collection submodule is configured to: transmit the communication data associated with the new network security event to the communication data collector and the log data collector respectively through the communication data classification outbound transmission and the log data classification outbound transmission; The sample data transmission submodule is configured to: transmit the collected communication data associated with the new network security event to the training server through the communication data collector and the log data collector.
7. A vehicle gateway, characterized in that: The vehicle gateway includes a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the vehicle gateway network security attack identification method according to any one of claims 1 to 4 is implemented.
8. A vehicle, characterized in that: The vehicle comprises the vehicle gateway according to claim 7.
9. A vehicle gateway network security attack identification system, characterized in that: The system includes a vehicle gateway and a training server, wherein: The vehicle gateway is used to: Receiving a trained attack event recognition model from the training server; Obtaining communication data from a communication module and / or log data; Determine a communication abnormality event according to the communication data; Inputting the abnormal communication event into the attack event identification model, and identifying the network security attack event in the abnormal communication event through the attack event identification model; When a new type of network security event occurs, the communication data associated with the new type of network security event is transmitted to the training server, The training server is used for: receiving communication data associated with a new type of network security event from the vehicle gateway as an expansion of training samples of the attack event recognition model; Retraining and updating the attack event recognition model according to the expanded training samples; The updated attack event recognition model is transmitted to the vehicle gateway.
10. A storage medium storing computer-readable instructions, wherein when the instructions are executed by a processor, the method according to any one of claims 1 to 4 is executed.