A detection and defense system, method, device and equipment for in-vehicle communication

Abstract

The present application relates to the field of in-vehicle communication, and specifically provides a detection and defense system, method, device and equipment for in-vehicle communication, the system includes a data acquisition module, an identity authentication module, an intrusion detection module, an encryption module, a defense control module, an alarm module and a log recording and analysis module; through the system modules, the communication data of the communication protocol bus can be monitored in real time, the identity of the data source can be authenticated, the legitimacy of the data content can be verified, the abnormality of the data flow pattern can be detected, and effective defense measures can be taken in time when intrusion behavior is detected. The system can achieve the effect of detection and defense of the in-vehicle communication protocol bus.

Description

Technical Field

[0001] The present application relates to the field of in-vehicle communications, and in particular, to a system, method, device and equipment for detecting and defending in-vehicle communications. Background Art

[0002] With the rapid development of automobile intelligence and networking, many electronic control units (ECUs) in the car realize information exchange and collaborative work through the serial communication protocol (CAN) bus, controlling key systems such as the engine, brakes, and steering. The CAN bus has the characteristics of multi-master structure and high transmission rate, and is widely used in the field of automotive electronics. However, network security was not fully considered at the beginning of its design, and there are many security risks. For example, CAN bus communication adopts broadcast form and lacks an effective identity authentication mechanism. Any access node can send data.

[0003] Therefore, in the prior art, attackers can easily access the CAN bus through the OBD-II interface, vehicle-mounted Wi-Fi or Bluetooth vulnerabilities, and then send false instructions, tamper with data or eavesdrop on sensitive information, seriously threatening vehicle safety and user privacy. In the Internet of Vehicles environment, the CAN bus in the car lacks sufficient security protection mechanisms, and there are risks such as being vulnerable to malicious attacks and data being easily stolen or tampered with.

[0004] Therefore, how to realize the detection and defense of the in-vehicle communication protocol bus is a technical problem that needs to be solved. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a method for detecting and defending in-vehicle communications. The technical solution of the embodiments of the present application can achieve the effect of detecting and defending the in-vehicle communication protocol bus.

[0006] In the first aspect, an embodiment of the present application provides a detection and defense system for in-vehicle communication, including a data acquisition module, an identity authentication module, an intrusion detection module, an encryption module, a defense control module, an alarm module, and a log recording and analysis module; the data acquisition module is used to acquire data frames on a communication protocol bus to be detected in real time, and send the data frames to the intrusion detection module, wherein the data frames include at least one of header information, data domain content, and transmission time; the identity authentication module is used to authenticate each node on the communication protocol bus to be detected, and send the identity authentication result to the defense control module; the intrusion detection module is used to analyze the data frame through a preset algorithm, obtain the analysis result, and send the analysis result to the defense control module; the encryption module is used to encrypt the identity identification and data frame on each node; the defense control module is used to take preset measures for defense according to the identity authentication result and the analysis result, and send the intrusion information to the alarm module; the alarm module is used to alarm according to the intrusion information and send the intrusion information to the client; the log recording and analysis module is used to record and analyze the data frame, identity authentication result, analysis result, and intrusion information.

[0007] In the above system, the present application detects the communication data of the communication protocol bus in real time, performs relevant identity authentication and intrusion detection on the data, can timely detect intrusion information, and take measures such as timely recording, defense, alarm and analysis of the intrusion information, thereby achieving the detection and security defense effect of the in-vehicle communication protocol bus.

[0008] In some embodiments, the identity authentication module is specifically used to: extract corresponding identity authentication information from the database according to one or more data in the data frame through one or more preset algorithms; decrypt and verify the data frame through the encryption algorithm and the identity authentication information to determine whether the data frame meets the standards.

[0009] In the above system, the present application verifies the data frame through the algorithm and the identity authentication information of the database, and can accurately determine whether there is an abnormality in the data frame.

[0010] In some embodiments, the intrusion detection module is specifically used to: analyze the change information of the data frame through a preset algorithm to obtain an analysis result, wherein the change information includes: at least one of attribute information, threshold information, change rate information, frame sequence information, node forwarding rules, domain name and message correlation.

[0011] In the above system, the present application can detect and analyze the multi-dimensional information that changes in the data frame through a preset algorithm, thereby achieving a more comprehensive detection effect of intrusion information.

[0012] In some embodiments, the defense control module is specifically used to: when it is determined that a malicious data frame or an illegal node has accessed based on the identity authentication results and the analysis results, cut off the connection between the malicious node and the communication protocol bus to be detected, and send intrusion information to the alarm module.

[0013] In the above system, when malicious data frames or illegal node access are detected, corresponding measures can be taken in time for security defense and alarm.

[0014] In some embodiments, the log recording and analysis module is specifically used to: log data frames, identity authentication results, analysis results and intrusion information and upload them to the cloud, wherein the cloud determines the attack methods and paths by analyzing the data frames, identity authentication results, analysis results and intrusion information uploaded by multiple vehicles.

[0015] In the above system, the present application can record various data and upload them to the cloud, which is convenient for users to query and for the cloud to perform analysis and detection of various data and attack detection.

[0016] On the second aspect, an embodiment of the present application provides a method for detecting and defending in-vehicle communications, which is applied to a detection and defense system including a cloud side and a vehicle side. When the method is executed by the vehicle side, it includes: authenticating each node on the communication protocol bus to be detected to obtain an authentication result; analyzing the data frame through a preset algorithm to obtain an analysis result; taking preset measures for defense based on the authentication result and the analysis result, and recording the data frame, authentication result, analysis result and related intrusion information and uploading them to the cloud.

[0017] In the above system of the present application, the vehicle side can collect and verify the data of each node on the communication protocol bus, and then send the analysis results of the data frame as well as the data frame, identity authentication results and related intrusion information to the cloud for risk detection.

[0018] On the third aspect, an embodiment of the present application provides another method for detecting and defending in-vehicle communications, which is characterized in that it is applied to a detection and defense system including a cloud side and a vehicle side. When the method is executed by the cloud side, it includes: receiving information to be analyzed sent by the vehicle side, wherein the information to be analyzed includes at least one of a data frame transmitted by the vehicle-side communication protocol bus, an identity authentication result, an analysis result, and related intrusion information; analyzing the risk information of the information to be analyzed, and issuing an alarm.

[0019] In the above system of the present application, the cloud achieves a rapid warning effect by performing risk analysis on the data frames, identity authentication results, analysis results and related intrusion information sent by the vehicle.

[0020] In a fourth aspect, an embodiment of the present application provides a detection and defense device for in-vehicle communication, including:

[0021] A verification module is used to authenticate each node on the communication protocol bus to be detected and obtain an authentication result;

[0022] An analysis module is used to analyze the data frame using a preset algorithm to obtain analysis results;

[0023] The defense module is used to take preset measures for defense according to the identity authentication results and analysis results, and to record the data frames, identity authentication results, analysis results and related intrusion information and upload them to the cloud.

[0024] In a fifth aspect, an embodiment of the present application provides another in-vehicle communication detection and defense device, including:

[0025] A receiving module, used to receive information to be analyzed sent by the vehicle end, wherein the information to be analyzed includes at least one of a data frame transmitted by the vehicle end communication protocol bus, an identity authentication result, an analysis result, and related intrusion information;

[0026] The analysis module is used to analyze the risk information of the information to be analyzed and issue an alarm.

[0027] In a sixth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method provided in the fourth aspect or the fifth aspect are executed.

[0028] In a seventh aspect, an embodiment of the present application provides a readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method provided in the fourth aspect or the fifth aspect are performed.

[0029] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1A schematic block diagram of an in-vehicle communication detection and defense system provided in an embodiment of the present application;

[0032] Figure 2 A flow chart of a method for detecting and defending in-vehicle communication provided in an embodiment of the present application;

[0033] Figure 3 A flowchart of another in-vehicle communication detection and defense method provided in an embodiment of the present application;

[0034] Figure 4 A schematic block diagram of a detection and defense device for in-vehicle communication provided in an embodiment of the present application;

[0035] Figure 5 A schematic block diagram of another in-vehicle communication detection and defense device provided in an embodiment of the present application;

[0036] Figure 6 A schematic block diagram of the structure of an in-vehicle communication detection and defense device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0038] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0039] First, some terms involved in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0040] CAN bus (Controller Area Network) is a serial communication protocol bus, mainly used for real-time applications. It can use twisted pair to transmit signals and is one of the most widely used field buses in the world.

[0041] The OBD-II interface is the second generation standard interface of the On-Board Diagnostic (OBD) system, which is mainly used to monitor faults in automobile engines and emission systems.

[0042] The Domain Name System (DNS) is a service of the Internet. As a distributed database that maps domain names and IP addresses, it enables people to access the Internet more conveniently. DNS uses UDP ports.

[0043] HSM (Hardware Security Module) is a computer hardware device used to protect and manage keys and sensitive data used by strong authentication systems and provide related cryptographic operations. The core function of HSM revolves around encryption and decryption, which can protect sensitive data and ensure that only authorized recipients or applications can access the data.

[0044] The present application is applied to the detection scenario of the in-vehicle communication bus. The specific scenario is to monitor the communication data of the communication protocol bus in real time through the data acquisition module, identity authentication module, intrusion detection module, encryption module, defense control module, alarm module and log recording and analysis module of the detection and defense system, authenticate the source of the data, verify the legitimacy of the data content, detect anomalies in the data traffic pattern, and take effective defense measures in time when an intrusion is detected.

[0045] With the rapid development of automobile intelligence and networking, many electronic control units (ECUs) in the car realize information exchange and collaborative work through the serial communication protocol (CAN) bus, controlling key systems such as the engine, brakes, and steering. The CAN bus has the characteristics of multi-master structure and high transmission rate, and is widely used in the field of automotive electronics. However, its design did not fully consider network security, and there are many security risks. For example, CAN bus communication adopts broadcast form, lacks an effective identity authentication mechanism, and any access node can send data. For this reason, in the prior art, attackers can easily access the CAN bus through OBD-II interface, vehicle-mounted Wi-Fi or Bluetooth vulnerabilities, and then send false instructions, tamper with data or eavesdrop on sensitive information, which seriously threatens vehicle safety and user privacy. In the Internet of Vehicles environment, the CAN bus in the car lacks sufficient security protection mechanism, and there are risks such as easy malicious attacks and easy theft or tampering of data.

[0046] To this end, the present application provides a detection and defense system for in-vehicle communication, including a data acquisition module, an identity authentication module, an intrusion detection module, an encryption module, a defense control module, an alarm module and a log recording and analysis module; the data acquisition module is used to acquire data frames on the communication protocol bus to be detected in real time, and send the data frames to the intrusion detection module, wherein the data frames include at least one of header information, data domain content and transmission time; the identity authentication module is used to authenticate each node on the communication protocol bus to be detected, and send the identity authentication result to the defense control module; the intrusion detection module is used to analyze the data frame through a preset algorithm, obtain the analysis result, and send the analysis result to the defense control module; the encryption module is used to encrypt the identity identification and data frame on each node; the defense control module is used to take preset measures for defense according to the identity authentication result and the analysis result, and send the intrusion information to the alarm module; the alarm module is used to alarm according to the intrusion information and send the intrusion information to the client; the log recording and analysis module is used to record and analyze the data frame, the identity authentication result, the analysis result and the intrusion information. By real-time detection of the communication data of the communication protocol bus, relevant identity authentication and intrusion detection are performed on the data, intrusion information can be detected in a timely manner, and timely recording, defense, alarm and analysis of the intrusion information can be carried out to achieve the detection and security defense effect of the in-vehicle communication protocol bus.

[0047] In the embodiment of the present application, the execution entity may be an in-vehicle communication detection and defense device in an in-vehicle communication detection and defense system. In actual applications, the in-vehicle communication detection and defense device may be electronic devices such as terminal devices and servers, which are not limited here.

[0048] Combine the following Figure 1 The in-vehicle communication detection and defense system of the embodiment of the present application is described in detail.

[0049] Please see Figure 1 , Figure 1 A schematic block diagram of an in-vehicle communication detection and defense system 100 provided in an embodiment of the present application is shown in FIG. Figure 1 The in-vehicle communication detection and defense system shown includes:

[0050] Data collection module 110 , identity authentication module 120 , intrusion detection module 130 , encryption module 140 , defense control module 150 , alarm module 160 and log recording and analysis module 170 .

[0051] The data acquisition module 110 is used to acquire data frames on the communication protocol bus to be detected in real time, and send the data frames to the intrusion detection module 130, wherein the data frames include at least one of header information, data domain content and transmission time; the identity authentication module 120 is used to authenticate each node on the communication protocol bus to be detected, and send the identity authentication result to the defense control module 150; the intrusion detection module 130 is used to analyze the data frame through a preset algorithm, obtain the analysis result, and send the analysis result to the defense control module 150; the encryption module 140 is used to encrypt the identity identification and data frame on each node; the defense control module 150 is used to take preset measures for defense according to the identity authentication result and the analysis result, and send the intrusion information to the alarm module 160; the alarm module 160 is used to alarm according to the intrusion information and send the intrusion information to the client; the log recording and analysis module 170 is used to record and analyze the data frame, identity authentication result, analysis result and intrusion information.

[0052] In some embodiments of the present application, the identity authentication module 120 is specifically used to: extract corresponding identity authentication information from a database based on one or more data in a data frame through one or more preset algorithms; decrypt and verify the data frame through an encryption algorithm and the identity authentication information to determine whether the data frame meets the standards.

[0053] In the above process, the present application verifies the data frame through the algorithm and the identity authentication information of the database, and can accurately determine whether there is an abnormality in the data frame.

[0054] The detection of data frames can also detect the format, identifier, data content, transmission frequency and other characteristics of the data frame, effectively identifying and preventing various types of intrusions, whether they are external attacks that break through the border protection or abnormal operations of internal malicious nodes.

[0055] It is understandable that the identity authentication process can be a verification process performed separately when the data frame passes through each node on the communication protocol bus to be detected. Before identity authentication, an effective identity authentication mechanism can be established to ensure that only legitimate ECUs can communicate on the CAN bus, and sensitive data can be encrypted for transmission to prevent data from being eavesdropped or tampered with, thereby improving the security of CAN bus communication.

[0056] It is understandable that the identity authentication result includes whether the identity authentication is passed or not, and the reason for passing or not, etc. The preset algorithm may be an existing data frame detection algorithm, or may specify corresponding types of algorithm content according to different data frames.

[0057] It is understandable that the analysis result may include at least one of the header information, data field content and transmission time of the data frame, and may also include data in which the header information, data field content and transmission time in the data frame vary.

[0058] It is understandable that the encryption module 140 can use an encryption algorithm provided by professionals during the encryption process.

[0059] Specifically: a dedicated hardware security module can be used to handle identity authentication and encryption functions. For example, HSM has an independent processing unit and a secure storage area, which can isolate sensitive information such as encryption keys from the main system to improve security. In this solution, the core functions of the identity authentication module 120 and the encryption module 140 are performed by the HSM, and the data acquisition module 110 and the intrusion detection module 130 transmit the relevant data to the HSM for processing, and the HSM feeds back the processing results to the defense control module 150 for corresponding operations.

[0060] It is understandable that the preset measure may be to cut off the connection between the malicious node and the CAN bus.

[0061] It is understandable that the intrusion information includes the time, node, and intrusion data of the intrusion. The intrusion module can specifically adopt a distributed detection architecture. Small intrusion detection units are deployed on different CAN bus subnets or key ECU nodes of the vehicle. These units are responsible for detecting local CAN bus communications and aggregating the detection results to a central management unit. The central management unit conducts a comprehensive analysis based on the reports of each distributed detection unit to determine whether there is an intrusion behavior and determine the scope and impact of the intrusion, and then triggers the corresponding defense measures. This solution can improve the real-time and locality of detection and reduce the risk of data transmission delays and single point failures.

[0062] Optionally, the identity authentication module 120 is specifically used to authenticate each node (ECU) in the CAN bus communication. During the system initialization phase or when the node is connected, a unique identity (such as an encryption key pair) is assigned to each legitimate ECU and stored in the identity authentication database. When a data frame is received, the corresponding identity authentication information is extracted from the database based on the source address information or other identification information in the data frame, and the data frame is decrypted and verified through an encryption algorithm to determine whether the data comes from a legitimate node. If the identity authentication fails, the data frame is marked as suspicious and passed to the defense control module 150.

[0063] In some embodiments of the present application, the intrusion detection module 130 is specifically used to: analyze the change information of the data frame through a preset algorithm to obtain an analysis result, wherein the change information includes: attribute information, threshold information, change rate information, frame sequence information, node forwarding rules, domain name and at least one of message correlation.

[0064] In the above process, the present application can detect and analyze the multi-dimensional information that changes in the data frame through a preset algorithm, thereby achieving a more comprehensive detection effect of intrusion information.

[0065] The change information may also include preset strategies and working conditions. In addition to conventional rule-based and feature-based detection algorithms, the preset algorithm can build more complex deep learning models, such as convolutional neural networks (CNN) or recurrent neural networks (RNN) to analyze the timing characteristics and potential patterns of CAN bus data. The model is trained with a large amount of normal and abnormal data, so that the model can automatically learn the abnormal features in the data and improve the detection ability of unknown attack types. At the same time, the reinforcement learning algorithm is used to optimize the defense control strategy, automatically select the best defense measures according to different intrusion scenarios, and improve the system's adaptability.

[0066] Optionally, the attribute information detection includes checking whether the CAN bus attributes of the data frame, such as baud rate, frame format, etc., comply with standard specifications. If not, it is determined to be abnormal.

[0067] Optionally, the threshold information detection includes setting a threshold range for data values ​​in the data frame, such as vehicle speed data, engine speed data, etc. If it exceeds the normal threshold range, it is regarded as an abnormal data frame.

[0068] Optionally, the change rate information detection includes analyzing the change rate of key data in the data frame, such as a sudden change in vehicle acceleration, etc. If the change rate is abnormal, there may be intrusion behavior.

[0069] Optionally, the frame sequence information detection includes analyzing the sequence of CAN bus data frames to determine whether it conforms to normal communication sequence logic. If a disordered or abnormal sequence occurs, the detection mechanism is triggered.

[0070] Optionally, the forwarding rule detection includes checking whether the data forwarding rules of the nodes involved in data forwarding are violated to ensure that the data is transmitted on a legal forwarding path.

[0071] Optionally, DNS (domain name) detection is included in communications involving network domain name resolution to detect whether DNS requests and responses are legitimate and to prevent malicious DNS hijacking.

[0072] Optionally, the message correlation detection includes analyzing the correlation between different data frames, such as the logical correspondence between control instructions and feedback information. If a mismatch occurs, it is determined to be abnormal.

[0073] Optionally, preset strategy detection includes detecting data frames according to preset security policies, such as the type of communication data allowed within a specific time period, communication restrictions between specific ECUs, etc. Data frames that do not comply with the policies will be marked.

[0074] Optionally, the operating condition detection includes detecting the CAN bus communication data in combination with the vehicle's current operating conditions, such as driving mode, engine operating status, etc., to ensure that the data is consistent with the current operating conditions.

[0075] In some embodiments of the present application, the defense control module 150 is specifically used to: when it is determined that a malicious data frame or an illegal node has accessed based on the identity authentication results and the analysis results, cut off the connection between the malicious node and the communication protocol bus to be detected, and send intrusion information to the alarm module 160.

[0076] In the above process, when malicious data frames or illegal node access are detected again, the present application can take corresponding measures in a timely manner for security defense and alarm.

[0077] In some embodiments of the present application, the log recording and analysis module 170 is specifically used to: log data frames, identity authentication results, analysis results, and intrusion information and upload them to the cloud, wherein the cloud determines the attack methods and paths by analyzing the data frames, identity authentication results, analysis results, and intrusion information uploaded by multiple vehicles.

[0078] In some embodiments of the present application, the present application is applied to perform comprehensive security checks and initialization of the CAN bus during vehicle startup to ensure the secure establishment of communications between ECUs. When the vehicle is undergoing software upgrades or remote diagnosis, the system performs strict security checks and monitoring on the upgrade data or diagnostic data transmitted through the CAN bus to prevent malicious data from being mixed in.

[0079] In the above process, this application can record and upload various data to the cloud, which is convenient for users to query and for the cloud to analyze and detect various data and attack detection. Correlation analysis is performed in the cloud to obtain a series of information such as attack paths and attack methods that can be used for operation and maintenance analysis, which helps to quickly locate the root cause of the problem and formulate targeted protection strategies, thereby improving the security protection level of the entire Internet of Vehicles.

[0080] In the above Figure 1In the process shown, the present application provides a detection and defense system for in-vehicle communication, including a data acquisition module 110, an identity authentication module 120, an intrusion detection module 130, an encryption module 140, a defense control module 150, an alarm module 160, and a log recording and analysis module 170; the data acquisition module 110 is used to obtain data frames on the communication protocol bus to be detected in real time, and send data frames to the intrusion detection module 130, wherein the data frames include at least one of header information, data domain content, and transmission time; the identity authentication module 120 is used to authenticate each node on the communication protocol bus to be detected, and send data frames to the defense control module 1 50 sends the identity authentication result; the intrusion detection module 130 is used to analyze the data frame through the preset algorithm, obtain the analysis result, and send the analysis result to the defense control module 150; the encryption module 140 is used to encrypt the identity identification and data frame on each node; the defense control module 150 is used to take preset measures for defense according to the identity authentication result and the analysis result, and send the intrusion information to the alarm module 160; the alarm module 160 is used to alarm according to the intrusion information and send the intrusion information to the client; the log recording and analysis module 170 is used to record and analyze the data frame, the identity authentication result, the analysis result and the intrusion information. By real-time detection of the communication data of the communication protocol bus, relevant identity authentication and intrusion detection are performed on the data, the intrusion information can be detected in time, and the intrusion information can be recorded, defended, alarmed and analyzed in time, so as to achieve the effect of detection and security defense of the in-vehicle communication protocol bus.

[0081] Combine the following Figure 2 The detection and defense method of in-vehicle communication in an embodiment of the present application is described in detail.

[0082] Please see Figure 2 , Figure 2 A flow chart of a method for detecting and defending in-vehicle communication provided in an embodiment of the present application is applied to a detection and defense system including a cloud and a vehicle. When the method is executed by the vehicle, Figure 2 The detection and defense methods for in-vehicle communication shown include:

[0083] Step 210: Authentication is performed on each node on the communication protocol bus to be detected to obtain an authentication result.

[0084] Specifically: the data frames on the communication protocol bus to be detected are acquired in real time, and the identity of each node on the communication protocol bus to be detected is authenticated.

[0085] Step 220: Analyze the data frame using a preset algorithm to obtain an analysis result.

[0086] Specifically: Based on the identity authentication and analysis results, take preset measures for defense, issue an alarm based on the intrusion information, and send the intrusion information to the client.

[0087] Step 230: Based on the identity authentication results and analysis results, take preset measures for defense, and record the data frame, identity authentication results, analysis results and related intrusion information and upload them to the cloud.

[0088] Specifically: record and analyze data frames, authentication results, analysis results and intrusion information.

[0089] In the above Figure 2 In the process shown, the vehicle side of the present application can collect and verify the data of each node on the communication protocol bus, and then send the analysis results of the data frame as well as the data frame, identity authentication results and related intrusion information to the cloud for risk detection.

[0090] also, Figure 2 The specific methods and steps shown can be found in Figure 1 The contents executed by the system modules shown are not described in detail here.

[0091] Combine the following Figure 3 Another method for detecting and defending in-vehicle communication according to an embodiment of the present application is described in detail.

[0092] Please see Figure 3 , Figure 3 A flowchart of another in-vehicle communication detection and defense method provided in an embodiment of the present application is applied to a detection and defense system including a cloud and a vehicle. When the method is executed by the cloud, Figure 3 The detection and defense methods for in-vehicle communication shown include:

[0093] Step 310: Receive the information to be analyzed sent by the vehicle.

[0094] The information to be analyzed includes at least one of a data frame transmitted by the vehicle-side communication protocol bus, an identity authentication result, an analysis result, and related intrusion information.

[0095] Step 320: Analyze the risk information of the information to be analyzed and issue an alarm.

[0096] Specifically: The cloud determines the attack methods and paths by analyzing the data frames, identity authentication results, analysis results, and intrusion information uploaded by multiple vehicles.

[0097] In the above Figure 3 In the process shown, the cloud of this application achieves the effect of rapid warning by performing risk analysis on the data frames, identity authentication results, analysis results and related intrusion information sent by the vehicle.

[0098] also, Figure 3 The specific methods and steps shown can be found in Figure 1 The contents executed by the system modules shown are not described in detail here.

[0099] Previous article Figure 2-Figure 3 Describes the detection and defense methods of in-vehicle communication. Figure 4-Figure 6 Describe the detection and defense apparatus for in-vehicle communications.

[0100] Please refer to Figure 4 , is a schematic block diagram of a detection and defense device 400 for in-vehicle communication provided in an embodiment of the present application. The device 400 may be a module, program segment or code on an electronic device. The device 400 is similar to the above Figure 2 The method embodiment corresponds to and can be executed Figure 2 The various steps involved in the method embodiment and the specific functions of the device 400 can be found in the description below. To avoid repetition, the detailed description is appropriately omitted here.

[0101] Optionally, the device 400 includes:

[0102] The verification module 410 is used to authenticate each node on the communication protocol bus to be detected and obtain an authentication result;

[0103] The analysis module 420 is used to analyze the data frame using a preset algorithm to obtain an analysis result;

[0104] The defense module 430 is used to take preset measures for defense according to the identity authentication results and analysis results, and to record the data frames, identity authentication results, analysis results and related intrusion information and upload them to the cloud.

[0105] Please refer to Figure 5 , is a schematic block diagram of another in-vehicle communication detection and defense device 500 provided in an embodiment of the present application. The device 500 may be a module, program segment or code on an electronic device. The device 500 is similar to the above Figure 3 The method embodiment corresponds to and can be executed Figure 3 The various steps involved in the method embodiment and the specific functions of the device 500 can be found in the description below. To avoid repetition, the detailed description is appropriately omitted here.

[0106] Optionally, the device 500 includes:

[0107] The receiving module 510 is used to receive the information to be analyzed sent by the vehicle end, wherein the information to be analyzed includes at least one of a data frame transmitted by the vehicle end communication protocol bus, an identity authentication result, an analysis result, and related intrusion information;

[0108] The analysis module 520 is used to analyze the risk information of the information to be analyzed and issue an alarm.

[0109] Please refer to Figure 6 The structure schematic diagram of a detection and defense device for in-vehicle communication provided in an embodiment of the present application is shown in FIG. 6 . The device may include a memory 610 and a processor 620. Optionally, the device may also include: a communication interface 630 and a communication bus 640. The device is similar to the above Figure 2 or Figure 3 The method embodiment corresponds to and can be executed Figure 2 or Figure 3 The various steps involved in the method embodiment and the specific functions of the device can be found in the description below.

[0110] Specifically, the memory 610 is used to store computer-readable instructions.

[0111] Processor 620 is used to process the readable instructions stored in the memory and can execute Figure 2 or Figure 3 The steps in the method.

[0112] The communication interface 630 is used for signaling or data communication with other node devices, for example, for communication with a server or a terminal, or for communication with other device nodes, but the embodiments of the present application are not limited thereto.

[0113] The communication bus 640 is used to realize direct connection and communication among the above components.

[0114] The communication interface 630 of the device in the embodiment of the present application is used to communicate signals or data with other node devices. The memory 610 can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The memory 610 can also be at least one storage device located away from the aforementioned processor. The memory 610 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 520, the electronic device executes the aforementioned Figure 2 or Figure 3The method process shown. The processor 620 can be used on the device 400 or the device 500, and is used to perform the functions in the present application. Exemplarily, the above-mentioned processor 620 can be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and the embodiments of the present application are not limited thereto.

[0115] The embodiment of the present application also provides a readable storage medium, when the computer program is executed by a processor, Figure 2 or Figure 3 The method process in the method embodiment shown is executed by the electronic device.

[0116] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0117] In summary, the embodiment of the present application provides a detection and defense system, method, device and equipment for in-vehicle communication, the system includes a data acquisition module, an identity authentication module, an intrusion detection module, an encryption module, a defense control module, an alarm module and a log recording and analysis module; the data acquisition module is used to obtain data frames on the communication protocol bus to be detected in real time, and send the data frames to the intrusion detection module, wherein the data frames include at least one of header information, data domain content and transmission time; the identity authentication module is used to authenticate each node on the communication protocol bus to be detected, and send the authentication result to the defense control module; the intrusion detection module is used to analyze the data frame by a preset algorithm, obtain the analysis result, and send the analysis result to the defense control module; the encryption module is used to encrypt the identity identification and data frame on each node; the defense control module is used to take preset measures for defense according to the identity authentication result and the analysis result, and send the intrusion information to the alarm module; the alarm module is used to alarm according to the intrusion information and send the intrusion information to the client; the log recording and analysis module is used to record and analyze the data frame, the identity authentication result, the analysis result and the intrusion information. Through this system, the effect of detection and defense of the in-vehicle communication protocol bus can be achieved.

[0118] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0119] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0120] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0121] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0122] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0123] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A detection and defense system for in-vehicle communication, characterized in that: include: Data acquisition module, identity authentication module, intrusion detection module, encryption module, defense control module, alarm module, and log recording and analysis module; The data acquisition module is used to acquire data frames on the communication protocol bus to be detected in real time, and send the data frames to the intrusion detection module, wherein the data frames include at least one of header information, data field content and transmission time; The identity authentication module is used to authenticate each node on the communication protocol bus to be detected and send the identity authentication result to the defense control module; The intrusion detection module is used to analyze the data frame by a preset algorithm to obtain an analysis result, and send the analysis result to the defense control module; The encryption module is used to encrypt the identity identification and the data frame on each node; The defense control module is used to take preset measures for defense according to the identity authentication result and the analysis result, and send intrusion information to the alarm module; The alarm module is used to generate an alarm based on the intrusion information and send the intrusion information to the client; The log recording and analysis module is used to record and analyze the data frame, the identity authentication result, the analysis result and the intrusion information.

2. The system according to claim 1, characterized in that The identity authentication module is specifically used for: Extracting corresponding identity authentication information from a database according to one or more data in the data frame by using one or more preset algorithms; The data frame is decrypted and verified using an encryption algorithm and the identity verification information to determine whether the data frame complies with the standard.

3. The system according to claim 1 or 2, characterized in that: The intrusion detection module is specifically applied to: The change information of the data frame is analyzed by the preset algorithm to obtain an analysis result, wherein the change information includes: at least one of attribute information, threshold information, change rate information, frame sequence information, node forwarding rules, domain name and message correlation.

4. The system according to claim 1 or 2, characterized in that: The defense control module is specifically used for: When it is determined according to the identity authentication result and the analysis result that a malicious data frame or an illegal node has accessed, the connection between the malicious node and the communication protocol bus to be detected is cut off, and intrusion information is sent to the alarm module.

5. The system according to claim 1 or 2, characterized in that: The log recording and analysis module is specifically used for: The data frame, the identity authentication result, the analysis result and the intrusion information are recorded in a log and uploaded to the cloud, wherein the cloud determines the attack means and path by analyzing the data frames, identity authentication results, analysis results and intrusion information uploaded by multiple vehicles.

6. A method for detecting and defending in-vehicle communication, characterized in that: Applied to a detection and defense system including a cloud and a vehicle, the method, when executed by the vehicle, includes: Perform identity authentication on each node on the communication protocol bus to be detected, and obtain an identity authentication result; Analyze the data frame using a preset algorithm to obtain an analysis result; According to the identity authentication result and the analysis result, preset measures are taken for defense, and the data frame, the identity authentication result, the analysis result and related intrusion information are recorded and uploaded to the cloud.

7. A method for detecting and defending in-vehicle communication, characterized in that: Applied to a detection and defense system including a cloud and a vehicle, the method, when executed by the cloud, includes: Receiving information to be analyzed sent by the vehicle end, wherein the information to be analyzed includes at least one of a data frame transmitted by the vehicle end communication protocol bus, an identity authentication result, an analysis result, and related intrusion information; Analyze the risk information of the information to be analyzed and issue an alarm.

8. A detection and defense device for in-vehicle communication, characterized in that: include: A verification module is used to authenticate each node on the communication protocol bus to be detected and obtain an authentication result; An analysis module, used to analyze the data frame using a preset algorithm to obtain an analysis result; The defense module is used to take preset measures for defense according to the identity authentication result and the analysis result, and to record the data frame, the identity authentication result, the analysis result and related intrusion information and upload them to the cloud.

9. A detection and defense device for in-vehicle communication, characterized in that: include: A receiving module, used to receive information to be analyzed sent by the vehicle end, wherein the information to be analyzed includes at least one of a data frame transmitted by the vehicle end communication protocol bus, an identity authentication result, an analysis result, and related intrusion information; The analysis module is used to analyze the risk information of the information to be analyzed and issue an alarm.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method according to claim 6 or 7 are executed.

Images