Vehicle network security threat analysis method and device, vehicle and storage medium

Abstract

The invention relates to the technical field of network security, and discloses a vehicle network security threat analysis method and device, a vehicle and a storage medium, and the method comprises the steps: constructing a detailed vehicle asset database and a related threat intelligence database, carrying out the correlation analysis of the two databases, quickly and accurately recognizing a target threat source which may attack vehicle assets, and improving the safety of the vehicle network security. Omission or misjudgment of the threat source is prevented, and the detection flexibility, accuracy and comprehensiveness are improved. And then, based on the vehicle network communication graph, analyzing a propagation path when the target threat source attacks the corresponding vehicle assets and a risk level of the propagation path, thereby generating a threat propagation path graph, so as to visually display the threat propagation path graph to a user, thereby performing effective security decision and management.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a vehicle network security threat analysis method, device, vehicle and storage medium. Background Art

[0002] Vehicle cybersecurity threats refer to various potential factors in the electronic systems and communication networks of vehicles that may be maliciously exploited, thereby causing damage to the normal operation of the vehicle, user safety and privacy, etc. Cybersecurity threat analysis can identify, evaluate and mitigate security threats in the system.

[0003] At present, threat analysis for vehicle asset network security mainly relies on manual experience and static security analysis tools. However, due to the complexity of vehicle network architecture and its high real-time and dynamic nature, traditional methods are difficult to quickly and accurately identify and analyze all potential threat sources and propagation paths. In addition, vehicle technology is rapidly updated, and new models and functions are constantly introduced. Traditional methods lack flexibility and adaptability, and it is difficult to respond to emerging security threats in a timely manner, resulting in inefficiency of traditional methods and prone to omissions and misjudgments. Summary of the invention

[0004] In view of this, the present invention provides a vehicle network security threat analysis method, device, vehicle and storage medium to solve the problem that traditional manual or static security analysis tools are inefficient and have low accuracy when identifying threats.

[0005] In a first aspect, the present invention provides a vehicle network security threat analysis method, the method comprising:

[0006] Build a vehicle asset database and a threat intelligence database related to vehicle assets, and obtain a vehicle network communication graph including communication links of vehicle assets;

[0007] Perform correlation analysis on the vehicle asset database and threat intelligence database, identify target threat sources that pose an attack threat to vehicle assets, and generate a threat source list;

[0008] Based on the threat source list and vehicle network communication diagram, determine the propagation path of each target threat source when attacking vehicle assets and the risk level of each propagation path;

[0009] The target threat sources and propagation paths are marked according to the risk level to generate a threat propagation path map.

[0010] Beneficial effects: The present invention constructs a detailed vehicle asset database and a related threat intelligence database, performs correlation analysis on the two, quickly and accurately identifies target threat sources that may attack vehicle assets, prevents omission or misjudgment of threat sources, and improves detection flexibility, accuracy, and comprehensiveness. Then, based on the vehicle network communication diagram, the propagation path and risk level of the target threat source when attacking the corresponding vehicle assets are analyzed, thereby generating a threat propagation path diagram for visual display to the user, thereby making effective security decisions and management.

[0011] In some optional implementations, correlation analysis is performed on the vehicle asset database and the threat intelligence database to identify target threat sources that pose an attack threat to vehicle assets and generate a threat source list, including:

[0012] According to the vehicle asset database, the asset category to which the vehicle asset belongs is obtained, and according to the threat intelligence database, the attack asset category of each threat source is obtained;

[0013] The asset category of the vehicle assets and the attack asset category of the threat source are associated and matched, the target threat source posing an attack threat to the vehicle assets and the corresponding threat characteristics are identified, and a threat source list is obtained.

[0014] Beneficial effects: The present invention performs category association matching on the constructed vehicle asset database and threat intelligence database, quickly identifies target threat sources that may attack vehicle assets, improves threat detection efficiency, and generates a threat source list based on the threat characteristics of the target threat source to facilitate users to make security decisions and management.

[0015] In some optional implementations, the threat characteristics include a target attack asset, a geographic location, and a plurality of risk indicators; based on the threat source list and the vehicle network communication diagram, determining a propagation path when each target threat source attacks the vehicle asset and a risk level of each propagation path includes:

[0016] Based on the geographical location of each target threat source, the communication path of the vehicle network communication graph is analyzed to obtain the propagation path of each target threat source when attacking the corresponding target attack asset;

[0017] The weighted sum of multiple risk indicators of the target threat source is used to calculate the risk level of the propagation path.

[0018] Beneficial effects: The present invention analyzes the propagation path of the target threat source attacking the vehicle assets based on the geographical location of the target threat source and the vehicle network communication diagram, and calculates the risk level of the propagation path according to the risk indicators of different aspects of the threat source, so that the staff can understand the severity of the threat to the vehicle assets in a timely manner.

[0019] In some optional implementations, target threat sources and propagation paths are marked according to risk levels to generate a threat propagation path map, including:

[0020] Determine the icon of the target threat source and the line color of the propagation path based on the risk level;

[0021] Generate a threat propagation path map using the target threat source icon and the line color of the propagation path.

[0022] Beneficial effects: The present invention generates a threat propagation path map through icons of target threat sources corresponding to risk levels and line colors of propagation paths, so that security managers can intuitively understand the spread of threats.

[0023] In some optional implementations, building a vehicle asset database includes:

[0024] Acquire the controller information of the vehicle; wherein the controller information includes at least some of the following items: hardware information, software information, communication protocol and network communication address;

[0025] Based on the hardware information and / or the software information, identifying the asset category of each controller of the vehicle;

[0026] An identifier is assigned to a corresponding controller according to the asset category, and attribute information of each controller is configured according to a communication protocol and / or a network communication address to obtain a vehicle asset database.

[0027] Beneficial effects: The present invention obtains the hardware information, software information, communication protocol and network communication address of the vehicle controller, classifies the controller as an asset and assigns a corresponding identifier, configures attribute information for each controller, and then builds a vehicle asset database to comprehensively manage the assets of the entire vehicle, which is conducive to improving the comprehensiveness and accuracy of threat analysis results.

[0028] In some optional implementations, building a threat intelligence database related to vehicle assets includes:

[0029] Obtain threat intelligence information in real time and pre-process the threat intelligence information;

[0030] Threat features are extracted from the preprocessed threat intelligence information to obtain a threat intelligence database related to vehicle assets; wherein the threat features include at least some of the following items: threat source type, threat source source, risk indicator, attack asset category, attack mode and geographic location.

[0031] Beneficial effect: This embodiment obtains threat intelligence information and preprocesses it, extracts threat features of the threat intelligence information such as threat source type, threat source source, attack asset category, attack mode and geographical location, and then constructs a threat intelligence database, so as to avoid missing or misjudging the threat source that attacks the vehicle assets when conducting threat analysis on the vehicle assets, and improve the comprehensiveness and accuracy of the analysis results.

[0032] In some optional embodiments, the method further comprises:

[0033] Display a threat propagation path diagram, and in response to user interaction instructions, display controller information and / or threat characteristics of the threat source.

[0034] Beneficial effects: The present invention displays a threat propagation path diagram, which helps users intuitively understand the propagation path of the threat source when it attacks the vehicle assets, and then implement the plan in time. In addition, it can realize the user interaction function, which helps users view the threat source and the relevant information of the vehicle assets, so as to manage the network security.

[0035] In a second aspect, the present invention provides a vehicle network security threat analysis device, the device comprising:

[0036] A first processing module is used to build a vehicle asset database and a threat intelligence database related to the vehicle assets, and obtain a vehicle network communication graph including communication links of the vehicle assets;

[0037] The second processing module is used to perform correlation analysis on the vehicle asset database and the threat intelligence database, identify target threat sources that pose an attack threat to vehicle assets, and generate a threat source list;

[0038] A third processing module is used to determine the propagation path of each target threat source when attacking the vehicle assets and the risk level of each propagation path based on the threat source list and the vehicle network communication diagram;

[0039] The fourth processing module is used to mark the target threat source and propagation path according to the risk level and generate a threat propagation path map.

[0040] In a third aspect, the present invention provides a vehicle, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the vehicle network security threat analysis method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0041] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the vehicle network security threat analysis method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 is a schematic flow chart of a vehicle network security threat analysis method according to an embodiment of the present invention;

[0044] Figure 2 is a flow chart of another vehicle network security threat analysis method according to an embodiment of the present invention;

[0045] Figure 3 is a structural block diagram of a vehicle network security threat analysis device according to an embodiment of the present invention;

[0046] Figure 4 Schematic diagram of the hardware structure of a vehicle according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0048] At present, threat modeling for vehicle asset network security mainly relies on manual experience and static security analysis tools. Traditional network security threat modeling methods are inefficient and prone to omissions and misjudgments, and have many limitations when applied to vehicle assets. On the one hand, the vehicle network architecture is complex and highly real-time and dynamic. Traditional methods are difficult to quickly and accurately identify and analyze all potential threat sources and propagation paths. On the other hand, vehicle technology is rapidly updated, and new models and functions are constantly introduced. Traditional methods lack flexibility and adaptability and are difficult to respond to emerging security threats in a timely manner. At the same time, existing modeling methods often cannot well integrate security information from multiple sources such as vehicle manufacturers, suppliers, and third-party security agencies, resulting in insufficient integrity and accuracy of threat models.

[0049] Therefore, the embodiment of the present invention provides a vehicle network security threat analysis method, which constructs a detailed vehicle asset database and a related threat intelligence database, performs correlation analysis on the two, and identifies target threat sources that may attack vehicle assets. Then, based on the vehicle network communication diagram, the propagation path and the risk level of the path when the target threat source attacks the corresponding vehicle assets are analyzed, thereby generating a threat propagation path diagram for visual display to the user, so as to make effective security decisions and management.

[0050] According to an embodiment of the present invention, an embodiment of a vehicle network security threat analysis method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0051] In this embodiment, a vehicle network security threat analysis method is provided, which can be used for vehicle and other asset security analysis systems. Figure 1 is a flow chart of a vehicle network security threat analysis method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0052] Step S101, constructing a vehicle asset database and a threat intelligence database related to vehicle assets, and obtaining a vehicle network communication diagram including communication links of vehicle assets.

[0053] In some optional implementations, vehicle system information can be collected, such as detailed information of the Electronic Control Unit (ECU), the software version of the central control system, vehicle communication modules (such as Bluetooth, gateway, cellular network), and other vehicle asset data. In addition, these vehicle asset data are sorted and classified, and assets are subdivided according to functions such as power systems and entertainment systems. For example, ECUs related to engine injection and ignition control are classified as power system assets, thereby building a vehicle asset database.

[0054] In some optional implementations, web crawler technology can be used to monitor the network and capture threat intelligence information related to vehicle network security threats; it can also cooperate with professional security agencies to obtain threat intelligence information about new vehicle attack methods; it can also collect threat intelligence information feedback from industry entities such as automobile manufacturers and suppliers. Then, information from multiple sources such as vehicle manufacturers, suppliers, and third-party security agencies is collected, sorted and analyzed, and then a threat intelligence database is constructed to improve the completeness and accuracy of threat analysis.

[0055] Specifically, according to the network topology and communication protocol of the vehicle, a network modeling tool is used to draw a vehicle network communication diagram, and each asset node and communication link is represented in a graphical manner. Based on the vehicle asset database constructed in the previous article, the asset nodes are accurately located and drawn, and these nodes are represented in the diagram as specific graphics. Then, the internal bus connection between the asset nodes and the connection link between the asset nodes and the external network are drawn, and arrows are added to the communication link to indicate the direction of data transmission, so as to obtain a vehicle network communication diagram containing the communication link of the vehicle assets.

[0056] Step S102, performing correlation analysis on the vehicle asset database and the threat intelligence database, identifying target threat sources that pose an attack threat to vehicle assets, and generating a threat source list.

[0057] Specifically, it can match the known vulnerabilities, working modes, asset categories, etc. of vehicle assets with threat intelligence to quickly and accurately identify target threat sources that pose potential attack risks to vehicle assets. It has greater flexibility and identifies more comprehensive threat sources.

[0058] Step S103, based on the threat source list and the vehicle network communication diagram, determine the propagation path of each target threat source when attacking the vehicle assets and the risk level of each propagation path.

[0059] Specifically, the vehicle network communication graph usually includes the in-vehicle network (such as the CAN bus) and the out-of-vehicle network (such as connecting to the Internet via a cellular network). For each target threat source in the threat source list, determine its possible entry point to the vehicle network, such as the mobile phone connection interface, wireless communication module, etc. Starting from the entry point, trace the possible propagation path along the links and nodes in the vehicle network communication graph. For each possible propagation path, record the network nodes, communication links, and vehicle asset nodes that the threat source passes through to obtain a complete propagation path for the target threat source.

[0060] Step S104: mark the target threat source and propagation path according to the risk level to generate a threat propagation path map.

[0061] Specifically, different icons and line colors can be used to mark target threat sources and propagation paths, so that relevant information can be intuitively displayed to users for effective security decision-making and management.

[0062] The vehicle network security threat analysis method provided in this embodiment constructs a detailed vehicle asset database and a related threat intelligence database, performs correlation analysis on the two, quickly and accurately identifies target threat sources that may attack vehicle assets, prevents omission or misjudgment of threat sources, and improves detection flexibility, accuracy, and comprehensiveness. Then, based on the vehicle network communication diagram, the propagation path and the risk level of the path when the target threat source attacks the corresponding vehicle assets are analyzed, thereby generating a threat propagation path diagram for visual display to the user, thereby making effective security decisions and management.

[0063] In this embodiment, a vehicle network security threat analysis method is provided, which can be used for vehicle and other asset security analysis systems. Figure 2 is a flow chart of a vehicle network security threat analysis method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0064] Step S201, constructing a vehicle asset database and a threat intelligence database related to vehicle assets, and obtaining a vehicle network communication diagram including communication links of vehicle assets.

[0065] Specifically, the controller information of the vehicle is obtained, wherein the controller information includes at least some of the following items: hardware information, software information, communication protocol, and network communication address. Then, based on the hardware information and / or software information, the asset category of each controller of the vehicle is identified. Finally, an identifier is assigned to the corresponding controller according to the asset category, and the attribute information of each controller is configured according to the communication protocol and / or the network communication address, so as to obtain a vehicle asset database.

[0066] In some optional implementations, the OBD scanning tool is connected to the diagnostic interface of the vehicle, the scanning program is started, the information of each ECU of the vehicle is read, and the data is transmitted to the background server. The asset identification and classification software is run on the server side, and the read ECU information is analyzed and processed according to the pre-set classification rules and algorithms, and the asset category to which each ECU belongs is determined, and an identifier and related attribute information are assigned to it. The classification results are stored in the vehicle asset database, and an asset inventory report is generated for subsequent analysis and query. For example, for a test vehicle, after scanning, it is found that the model of its engine control unit is "XXX_ECM_V1.2" and the software version is "V1.0.3". Through analysis, it is determined that it belongs to the power system asset, and the identifier is assigned as "POW_01", and its related attributes are recorded in the database, such as the communication protocol is CAN bus, the IP address is "192.168.1.10", etc.

[0067] This embodiment obtains the hardware information, software information, communication protocol, and network communication address of the vehicle controller, classifies the controller as an asset and assigns a corresponding identifier. It also configures attribute information for each controller, thereby building a vehicle asset database and comprehensively managing all vehicle assets, which is beneficial to improving the comprehensiveness and accuracy of threat analysis results.

[0068] Specifically, threat intelligence information is acquired in real time and preprocessed. Then, threat features are extracted from the preprocessed threat intelligence information to obtain a threat intelligence database related to vehicle assets; wherein the threat features include at least some of the following items: threat source type, threat source source, risk indicator, attack asset category, attack mode, and geographic location.

[0069] In some optional implementations, a threat intelligence information collection module is developed to establish connections with multiple threat intelligence data sources through an API interface or web crawler technology to regularly obtain the latest threat intelligence information. The collected intelligence data is preprocessed, including data cleaning, deduplication, format conversion and other operations to ensure the quality and availability of the data. Use big data analysis tools, such as Hadoop or Spark, to analyze the preprocessed intelligence data, and use data mining algorithms and machine learning techniques to extract threat features and patterns related to vehicle assets. The analysis results are stored in a threat intelligence database, and a threat intelligence report is generated and reported to security managers on a regular basis. For example, by analyzing the threat intelligence library of a security vendor, it was discovered that a new type of malware "CarTrojan_2024" has recently been discovered that specifically targets the Bluetooth communication module of a vehicle, and has the function of stealing user privacy information and remotely controlling the vehicle. The threat intelligence is recorded in the database, and its relevant features and the type of vehicle assets attacked are marked.

[0070] This embodiment obtains threat intelligence information and preprocesses it to extract threat characteristics of the threat intelligence information, including threat source type, threat source origin, attack asset category, attack mode, and geographic location, and then builds a threat intelligence database. This avoids missing or misjudging threat sources that attack vehicle assets when conducting threat analysis on vehicle assets, thereby improving the comprehensiveness and accuracy of the analysis results.

[0071] Step S202: perform correlation analysis on the vehicle asset database and the threat intelligence database, identify target threat sources that pose an attack threat to vehicle assets, and generate a threat source list.

[0072] Specifically, the above step S202 includes:

[0073] Step S2021, obtaining the asset category to which the vehicle asset belongs according to the vehicle asset database, and obtaining the attack asset category of each threat source according to the threat intelligence database.

[0074] Specifically, when building the database, it is necessary to add the asset category of the vehicle assets to the vehicle asset database, and add the attack asset category targeted by the threat source to the threat intelligence database, so as to perform correlation analysis between the two and quickly identify the threat source that has the probability of posing a threat to the vehicle assets.

[0075] Step S2022, associate and match the asset category of the vehicle asset and the attack asset category of the threat source, identify the target threat source that poses an attack threat to the vehicle asset and the corresponding threat characteristics, and obtain a threat source list.

[0076] Specifically, the vehicle asset database and the threat intelligence database are integrated, and the threat source identification algorithm is run to associate the vehicle asset information with the threat intelligence information (e.g., category matching), identify the target threat sources that may attack, and generate a threat source list. The threat source list contains the target threat sources and their corresponding threat characteristics. The threat characteristics include the type, source, target attack assets, geographic location, and other information of the target threat source for further analysis and processing by security managers. For example, through association analysis, it is found that the Bluetooth communication module of a test vehicle is at risk of being attacked by a hacker group located in a specific foreign region. The hacker group often uses a specific Bluetooth vulnerability to attack, and the threat source information is recorded in the threat source list.

[0077] This embodiment will perform category association matching on the constructed vehicle asset database and threat intelligence database to quickly identify target threat sources that may attack vehicle assets, improve threat detection efficiency, and generate a threat source list based on the threat characteristics of the target threat source to facilitate users to make security decisions and management.

[0078] Step S203, based on the threat source list and the vehicle network communication diagram, determine the propagation path of each target threat source when attacking the vehicle assets and the risk level of each propagation path.

[0079] Specifically, the above step S203 includes:

[0080] Step S2031 , performing communication path analysis on the vehicle network communication graph based on the geographical location of each target threat source, and obtaining a propagation path when each target threat source attacks the corresponding target attack asset.

[0081] Specifically, the threat source list and the vehicle network communication diagram are combined to run the graph analysis algorithm to simulate the propagation path of the threat source in the vehicle network. According to the geographical location of the target threat source, the isolation mechanism and access control strategy between different network areas are considered, the feasibility and propagation probability of each propagation path are evaluated, and the propagation path with a larger propagation probability (greater than the set probability) is selected as the propagation path when the target threat source attacks the target attack asset.

[0082] Step S2032: weighted sum of multiple risk indicators of the target threat source is performed to calculate the risk level of the propagation path.

[0083] Specifically, a threat assessment index system is formulated to evaluate the risk indicators of threat sources. The risk indicators may include primary indicators such as the possibility of threat occurrence, the degree of threat impact, and the complexity of the attack. In addition, each primary indicator can be further subdivided into several secondary indicators. For example, the possibility of threat occurrence can be subdivided into secondary indicators such as the activity of the threat source, the degree of exposure of the vehicle network, and the effectiveness of vehicle network security protection measures; the degree of threat impact can be subdivided into secondary indicators such as the impact on vehicle functions, the impact on driving safety, and the impact on user privacy. Invite vehicle safety experts and professionals in related fields to set weight values ​​for each secondary indicator based on experience and actual conditions, and formulate corresponding scoring standards. It should be noted that after evaluating the risk indicators of a threat source once, it can be recorded in the threat feature for direct call later to reduce the process of repeated calculations.

[0084] Furthermore, for each target threat source, a quantitative assessment is performed based on the risk indicators and scoring criteria of the threat assessment index system to calculate the risk value of each target threat source. For example, the risk value is calculated using the weighted average method, and the formula is: risk value = ∑ (secondary indicator score × corresponding weight). Then, the threat is divided into different levels according to the size of the risk value, such as a risk value greater than or equal to 80 is high risk, a risk value greater than or equal to 60 and less than 80 is medium risk, and a risk value less than 60 is low risk. Finally, a threat assessment report is generated, which lists the assessment results and related information of each threat source in detail to provide a basis for security decision-making.

[0085] For example, for a cyber attack threat against a vehicle's braking system, after evaluation, the probability of the threat is scored as 70 points (out of 100 points) and the weight is 0.4; the impact on driving safety is scored as 90 points and the weight is 0.6. The risk value of the threat is: 70×0.4+90×0.6=82, which is a high-risk threat, that is, the risk level of the corresponding propagation path is high risk. The detailed assessment information of the threat source is recorded in the threat assessment report, including the threat feature description, risk value calculation process, recommended preventive measures, etc., so that managers can view and maintain vehicle assets.

[0086] This embodiment analyzes the propagation path of the target threat source when it attacks the vehicle assets based on the geographical location of the target threat source and the vehicle network communication diagram, and calculates the risk level of the propagation path according to risk indicators of different aspects of the threat source, so that the staff can understand the severity of the threat to the vehicle assets in a timely manner.

[0087] Step S204: mark the target threat source and propagation path according to the risk level to generate a threat propagation path map.

[0088] Specifically, the above step S204 includes:

[0089] Step S2041, determining the icon of the target threat source and the line color of the propagation path according to the risk level.

[0090] Specifically, the higher the risk level, the more eye-catching the icon of the threat source and the line color of the corresponding propagation path should be, so that the user can promptly notice the threat source and its attack path.

[0091] Step S2042, using the icon of the target threat source and the line color of the propagation path, a threat propagation path map is generated.

[0092] Specifically, in order to display the threat propagation path diagram on the visual interface, different icons are used to represent the threat source, and different colors and line styles are used to mark the propagation paths of different risk levels, so that security managers can intuitively understand the spread of threats. For example, for a threat source that invades through the vehicle's wireless network, it is analyzed that it may enter the internal network through the vehicle's gateway device and then spread to multiple key ECUs along the CAN bus. In the threat propagation path diagram, the path from the wireless network to the gateway is marked as yellow, indicating a medium risk; the path from the gateway to each ECU is marked as red (high risk) or orange (low risk) according to the importance of the ECU and the possibility of being attacked.

[0093] Step S205 , displaying a threat propagation path diagram, and in response to a user's interactive instruction, displaying controller information and / or threat characteristics of the threat source.

[0094] Specifically, develop threat modeling system software and use a database management system (such as MySQL or Oracle) to store vehicle asset information, threat intelligence information, threat assessment results and other data. Design data structures and table relationships to ensure data consistency and integrity. Implement threat model building algorithms in the software to integrate the results of various links such as asset identification and classification, threat source identification and location, threat propagation path analysis, and threat assessment and quantification into a unified threat model.

[0095] Furthermore, a visualization interface is developed, and a graphic library and front-end development framework (such as Echarts and Vue.js) are used to realize the visualization of the threat model. Graphic elements such as the network topology diagram of vehicle assets and the threat propagation path diagram are drawn on the interface, and different icons, colors and lines are used to represent information such as assets, threat sources, propagation paths and threat levels. In addition, user interaction functions are implemented to allow users to operate on the visualization interface, such as clicking on asset icons to view detailed information, searching for specific threat sources, switching between different view modes (such as list view and graphic view), etc.

[0096] For example, when a user clicks on the engine control unit icon of a test vehicle on the visual interface, a window will pop up showing the detailed information of the ECU, including the identifier, model, version, system, IP address, communication protocol, etc. At the same time, the threat propagation path and connected threat sources related to the ECU will be highlighted in the threat propagation path diagram. Users can also enter keywords such as "malware" or "Bluetooth attack" in the search box, and the system will quickly filter out the relevant threat sources and propagation paths, and mark and display them on the interface.

[0097] In some optional implementations, for threat sources with geographic location information, such as hacker organizations or malicious servers located by IP addresses, GIS technology can also be used to mark their geographic locations on a map to intuitively understand the geographical distribution of the threat sources.

[0098] The vehicle network security threat analysis method provided in this embodiment comprehensively uses a variety of advanced technical means, including big data analysis, artificial intelligence algorithms, automated asset identification and visual modeling technology, to achieve comprehensive, rapid and accurate modeling of vehicle asset network security threats. First, the vehicle assets are comprehensively scanned and identified through automated tools to build a detailed vehicle asset database. Then, big data analysis technology is used to collect and integrate threat intelligence information from different channels, and artificial intelligence algorithms are used to intelligently identify and classify threat sources. Next, based on the vehicle network topology and communication protocol, the threat propagation path is analyzed, and a quantitative assessment method is used to determine the risk level of the threat. Finally, the threat model is intuitively presented to the user through a visual interface to facilitate effective security decision-making and management.

[0099] The present invention uses automated asset identification and big data analysis technology to quickly collect and process vehicle asset information and threat intelligence information, greatly shortening the threat modeling cycle and improving threat analysis efficiency. Compared with traditional manual modeling methods, the efficiency is increased by several times or even dozens of times.

[0100] The present invention uses artificial intelligence algorithms and multi-source threat intelligence to more accurately identify potential threat sources and threat propagation paths, reducing the risk of omissions and misjudgments. Artificial intelligence algorithms can discover hidden patterns and associations from massive amounts of data, improving the ability to identify new and unknown threats. At the same time, the integration of threat intelligence from different channels makes the understanding of threats more comprehensive and in-depth, and can more accurately assess the nature and degree of harm of threats, enhancing the accuracy of threat identification.

[0101] The present invention establishes a scientific threat assessment index system and adopts a quantitative assessment method to make the threat assessment results more objective, accurate and comparable, thereby improving the scientific nature of threat assessment. Instead of relying solely on subjective experience for threat assessment, the threat risk value is obtained by quantitative analysis of multiple factors and comprehensive calculation, thereby providing a more reliable basis for security decision-making. Different threats can be sorted according to their risk values, and high-risk threats can be processed first, thereby improving the utilization efficiency of security resources.

[0102] In this embodiment, a vehicle network security threat analysis device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0103] This embodiment provides a vehicle network security threat analysis device, such as Figure 3 As shown, including:

[0104] The first processing module 301 is used to build a vehicle asset database and a threat intelligence database related to vehicle assets, and obtain a vehicle network communication graph including communication links of vehicle assets;

[0105] The second processing module 302 is used to perform correlation analysis on the vehicle asset database and the threat intelligence database, identify target threat sources that pose an attack threat to vehicle assets, and generate a threat source list;

[0106] The third processing module 303 is used to determine the propagation path of each target threat source when attacking the vehicle assets and the risk level of each propagation path based on the threat source list and the vehicle network communication diagram;

[0107] The fourth processing module 304 is used to mark the target threat source and the propagation path according to the risk level and generate a threat propagation path map.

[0108] In some optional implementations, the first processing module 301 is further used to:

[0109] Acquire the controller information of the vehicle; wherein the controller information includes at least some of the following items: hardware information, software information, communication protocol and network communication address;

[0110] Based on the hardware information and / or the software information, identifying the asset category of each controller of the vehicle;

[0111] An identifier is assigned to a corresponding controller according to the asset category, and attribute information of each controller is configured according to a communication protocol and / or a network communication address to obtain a vehicle asset database.

[0112] In some optional implementations, the first processing module 301 is further used to:

[0113] Obtain threat intelligence information in real time and pre-process the threat intelligence information;

[0114] Threat features are extracted from the preprocessed threat intelligence information to obtain a threat intelligence database related to vehicle assets; wherein the threat features include at least some of the following items: threat source type, threat source source, risk indicator, attack asset category, attack mode and geographic location.

[0115] In some optional implementations, the second processing module 302 is further configured to:

[0116] According to the vehicle asset database, the asset category to which the vehicle asset belongs is obtained, and according to the threat intelligence database, the attack asset category of each threat source is obtained;

[0117] The asset category of the vehicle assets and the attack asset category of the threat source are associated and matched, the target threat source posing an attack threat to the vehicle assets and the corresponding threat characteristics are identified, and a threat source list is obtained.

[0118] In some optional implementations, the threat characteristics include a target attack asset, a geographic location, and multiple risk indicators; the third processing module 303 is further used to:

[0119] Based on the geographical location of each target threat source, the communication path of the vehicle network communication graph is analyzed to obtain the propagation path of each target threat source when attacking the corresponding target attack asset;

[0120] The weighted sum of multiple risk indicators of the target threat source is used to calculate the risk level of the propagation path.

[0121] In some optional implementations, the fourth processing module 304 is further configured to:

[0122] Determine the icon of the target threat source and the line color of the propagation path based on the risk level;

[0123] Generate a threat propagation path map using the target threat source icon and the line color of the propagation path.

[0124] In some optional embodiments, the device is also used for:

[0125] Display a threat propagation path diagram, and in response to user interaction instructions, display controller information and / or threat characteristics of the threat source.

[0126] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0127] The vehicle network security threat analysis device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0128] The embodiment of the present invention further provides a vehicle having the above Figure 3 The vehicle cybersecurity threat analysis device is shown.

[0129] See also Figure 4 , Figure 4 is a schematic diagram of the structure of a vehicle provided by an optional embodiment of the present invention, such as Figure 4 As shown, the vehicle includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common motherboard or installed in other ways as needed. The processor can process instructions executed in the vehicle, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 4 A processor 10 is taken as an example.

[0130] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0131] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0132] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created according to the use of the vehicle, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the vehicle via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0133] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0134] The vehicle further includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 4 The example of connecting through bus is taken in the following.

[0135] The input device 30 can receive input digital or character information and generate key signal input related to the user settings and function control of the vehicle, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device may be a touch screen.

[0136] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0137] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0138] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A vehicle network security threat analysis method, characterized in that: The method comprises: Build a vehicle asset database and a threat intelligence database related to vehicle assets, and obtain a vehicle network communication graph including communication links of vehicle assets; Perform correlation analysis on the vehicle asset database and threat intelligence database, identify target threat sources that pose an attack threat to vehicle assets, and generate a threat source list; Based on the threat source list and vehicle network communication diagram, determine the propagation path of each target threat source when attacking vehicle assets and the risk level of each propagation path; The target threat sources and propagation paths are marked according to the risk level to generate a threat propagation path map.

2. The method according to claim 1, characterized in that: The above-mentioned correlation analysis of the vehicle asset database and the threat intelligence database is performed to identify the target threat source that poses an attack threat to the vehicle assets and generate a threat source list, including: According to the vehicle asset database, the asset category to which the vehicle asset belongs is obtained, and according to the threat intelligence database, the attack asset category of each threat source is obtained; The asset category of the vehicle assets and the attack asset category of the threat source are associated and matched, the target threat source posing an attack threat to the vehicle assets and the corresponding threat characteristics are identified, and a threat source list is obtained.

3. The method according to claim 2, characterized in that The threat characteristics include target attack assets, geographic locations, and multiple risk indicators; the propagation path of each target threat source attacking the vehicle assets and the risk level of each propagation path are determined based on the threat source list and the vehicle network communication diagram, including: Based on the geographical location of each target threat source, the communication path of the vehicle network communication graph is analyzed to obtain the propagation path of each target threat source when attacking the corresponding target attack asset; The weighted sum of multiple risk indicators of the target threat source is used to calculate the risk level of the propagation path.

4. The method according to claim 1, characterized in that: The target threat source and propagation path are marked according to the risk level to generate a threat propagation path map, including: Determine the icon of the target threat source and the line color of the propagation path based on the risk level; Generate a threat propagation path map using the target threat source icon and the line color of the propagation path.

5. The method according to any one of claims 1 to 4, characterized in that The constructing of the vehicle asset database comprises: Acquire the controller information of the vehicle; wherein the controller information includes at least some of the following items: hardware information, software information, communication protocol and network communication address; Based on the hardware information and / or the software information, identifying the asset category of each controller of the vehicle; An identifier is assigned to a corresponding controller according to the asset category, and attribute information of each controller is configured according to a communication protocol and / or a network communication address to obtain a vehicle asset database.

6. The method according to claim 5, characterized in that The construction of a threat intelligence database related to vehicle assets includes: Obtain threat intelligence information in real time and pre-process the threat intelligence information; Threat features are extracted from the preprocessed threat intelligence information to obtain a threat intelligence database related to vehicle assets; wherein the threat features include at least some of the following items: threat source type, threat source source, risk indicator, attack asset category, attack mode and geographic location.

7. The method according to claim 6, characterized in that The method further comprises: The threat propagation path diagram is displayed, and in response to user interaction instructions, the controller information and / or threat characteristics of the threat source are displayed.

8. A vehicle network security threat analysis device, characterized in that: The device comprises: A first processing module is used to build a vehicle asset database and a threat intelligence database related to the vehicle assets, and obtain a vehicle network communication graph including communication links of the vehicle assets; The second processing module is used to perform correlation analysis on the vehicle asset database and the threat intelligence database, identify target threat sources that pose an attack threat to vehicle assets, and generate a threat source list; A third processing module is used to determine the propagation path of each target threat source when attacking the vehicle assets and the risk level of each propagation path based on the threat source list and the vehicle network communication diagram; The fourth processing module is used to mark the target threat source and propagation path according to the risk level and generate a threat propagation path map.

9. A vehicle, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the vehicle network security threat analysis method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the vehicle network security threat analysis method according to any one of claims 1 to 7.

Images