Knowledge graph-based Internet of Vehicles threat analysis method and system, and medium

Abstract

The invention relates to an Internet of Vehicles threat analysis method and system based on a knowledge graph, and a medium. The method comprises the following steps: U1, collecting data information of an Internet of Vehicles entity object and data information of Internet of Vehicles threat intelligence; and U2, based on the data information of the Internet of Vehicles threat intelligence, extracting the feature information of the Internet of Vehicles threat intelligence by adopting a hierarchical clustering algorithm based on expected cross entropy to obtain data information of a feature matrix of the Internet of Vehicles threat intelligence, and representing the relevance between the entity object and the feature matrix of the Internet of Vehicles threat intelligence by adopting a cross validation algorithm based on a Spearman rank correlation coefficient to obtain data information of the relevance between the Internet of Vehicles entity object and the threat intelligence. According to the method, the problem that the threats of all dimensions of the Internet of Vehicles cannot be comprehensively covered can be solved, the threat information of the Internet of Vehicles can be visually displayed from all angles of the threat knowledge graph of the Internet of Vehicles, and automobile safety analysts can conveniently and flexibly analyze the safety situation of the Internet of Vehicles.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Vehicles threat analysis, and in particular to an Internet of Vehicles threat analysis method, system and medium based on a knowledge graph. Background Art

[0002] With the rapid development of electric, intelligent, networked and shared vehicles, the safety of vehicles is facing unprecedented complex challenges. While the "new four trends" of vehicles are bringing about rapid development of vehicles, they are also bringing many challenges to vehicle safety - the attack surface faced by vehicles is also increasing, including vehicle hardware, hardware interfaces, software, wireless communications (Bluetooth, WiFi, radio frequency, cellular network communications), Ethernet communications, etc.

[0003] From the perspective of network security, today's cars are in a complex network consisting of "people, cars, roads and clouds". Every point, every exposed surface, and the large amount of data generated may become a risk point and an attack point. For example, the standard OBD interface can directly access the internal network of the car. The interface between the multimedia system and the car controller's internal network, Bluetooth, WiFi, cellular network (GPRS, 3G, 4G, 5G), etc. all provide potential entrances to the car's internal network. From an attack perspective, connected cars are not much different from PCs and mobile phones in traditional Internet environments, and will face the test of various attacks from the Internet world.

[0004] Today's Internet of Vehicles uses a new generation of information and communication technology to achieve all-round network connections between vehicles and cloud platforms, vehicles and vehicles, vehicles and roads, vehicles and people, and inside vehicles. It mainly realizes the "three-network integration", that is, the integration of the in-vehicle network, the inter-vehicle network, and the in-vehicle mobile Internet. Therefore, the application environment is relatively special, the networking is more complex, the management is more difficult, and the security threats are more severe. There are threats such as remote attacks on vehicles, malicious control, and personal information leakage. The impact ranges from the playback of the in-vehicle entertainment system to the malicious manipulation of the vehicle causing major traffic safety accidents, and even to the leakage of travel information, road information, map information, etc., which poses a threat to national security.

[0005] Existing IoV threat analysis technologies usually focus on certain specific vulnerabilities and attack methods in IoV, and usually conduct IoV analysis from the perspective of mitigating vulnerabilities and detecting certain attack methods. This type of threat analysis method is relatively simple and it is difficult to capture the multifaceted and complex nature of IoV threats. Summary of the invention

[0006] In view of the above problems, the present invention provides a method, system and medium for analyzing Internet of Vehicles threats based on knowledge graph, which can not only solve the problem that the determination of threats in all dimensions of Internet of Vehicles cannot be fully covered, but also analyze the Internet of Vehicles threat knowledge graph from various angles, and can intuitively display Internet of Vehicles threat intelligence, so as to facilitate automobile security analysts to flexibly analyze the security situation of Internet of Vehicles.

[0007] In order to achieve the above-mentioned purpose and other related purposes, the technical solution provided by the present invention is as follows:

[0008] A vehicle network threat analysis method based on knowledge graph, the method comprising:

[0009] U1. Collect data information of Internet of Vehicles entity objects and data information of Internet of Vehicles threat intelligence;

[0010] U2. Based on the data information of the Internet of Vehicles threat intelligence, a hierarchical clustering algorithm based on expected cross entropy is used to extract feature information of the Internet of Vehicles threat intelligence to obtain data information of a feature matrix of the Internet of Vehicles threat intelligence;

[0011] U3. Based on the data information of the characteristic matrix of the Internet of Vehicles threat intelligence and the data information of the Internet of Vehicles entity object, a cross-validation algorithm based on the Spearman rank correlation coefficient is used to characterize the correlation between the entity object and the characteristic matrix of the Internet of Vehicles threat intelligence, and obtain data information on the correlation between the Internet of Vehicles entity object and the threat intelligence;

[0012] U4. Based on the data information of the correlation between the Internet of Vehicles entity objects and threat intelligence, an Internet of Vehicles threat knowledge graph is generated, and an Internet of Vehicles threat assessment model is constructed to analyze the threats of the Internet of Vehicles and obtain data information of the threat analysis of the Internet of Vehicles.

[0013] Furthermore, in step U2, extracting feature information of the Internet of Vehicles threat intelligence using a hierarchical clustering algorithm based on expected cross entropy includes:

[0014] U21. Based on the data information of the Internet of Vehicles threat intelligence, establish the expected cross entropy function F of the Internet of Vehicles threat intelligence,

[0015]

[0016] Among them, x is the data information of the Internet of Vehicles threat intelligence, α1, α2 and α3 are the cross entropy factors of the Internet of Vehicles threat intelligence, and the cross entropy information value of the Internet of Vehicles threat intelligence is calculated to obtain the data information of the cross information entropy value of the Internet of Vehicles threat intelligence;

[0017] U22. Based on the data information of the cross information entropy value of the Internet of Vehicles threat intelligence, a hierarchical clustering function Q of the Internet of Vehicles threat intelligence is established.

[0018]

[0019] Among them, y is the data information of the cross information entropy value of the Internet of Vehicles threat intelligence, β1, β2 and β3 are the hierarchical clustering dynamic factors of the Internet of Vehicles threat intelligence;

[0020] U23. Based on the hierarchical clustering function Q of the Internet of Vehicles threat intelligence, the feature information of the Internet of Vehicles threat intelligence is extracted to obtain data information of the feature matrix of the Internet of Vehicles threat intelligence.

[0021] Furthermore, the hierarchical clustering dynamic factors β1, β2 and β3 of the Internet of Vehicles threat intelligence are:

[0022]

[0023] Among them, y is the data information of the cross information entropy value of the Internet of Vehicles threat intelligence.

[0024] Furthermore, the cross entropy factors α1, α2 and α3 of the IoV threat intelligence are:

[0025] Among them, x is the data information of Internet of Vehicles threat intelligence.

[0026] Furthermore, in step U3, the characterization of the correlation between the entity object and the feature matrix of the Internet of Vehicles threat intelligence by using a cross-validation algorithm based on the Spearman rank correlation coefficient includes:

[0027] U31. Based on the data information of the characteristic matrix of the Internet of Vehicles threat intelligence and the data information of the Internet of Vehicles entity object, construct the Spearman rank correlation function W of the Internet of Vehicles,

[0028]

[0029] Among them, z1 is the data information of the characteristic matrix of the Internet of Vehicles threat intelligence, z2 is the data information of the Internet of Vehicles entity object, δ1, δ2 and δ3 are the relationship factors between the Internet of Vehicles threat intelligence and the entity object, and the Spearman correlation coefficient of the Internet of Vehicles threat intelligence and the entity object is characterized to obtain the data information of the Spearman correlation coefficient of the Internet of Vehicles threat intelligence and the entity object;

[0030] U32. Based on the data information of the Spearman correlation coefficient of the Internet of Vehicles threat intelligence and the entity object, a cross-validation optimization function R of the Internet of Vehicles is constructed.

[0031]

[0032] Among them, r is the data information of the Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object, γ1, γ2 and γ3 are the cross-validation optimization parameters of the Internet of Vehicles, and the Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object is optimized to obtain the data information of the optimized Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object;

[0033] U33. Based on the data information of the optimized Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object, a correlation function S is established between the entity object of the Internet of Vehicles and the feature matrix of the threat intelligence of the Internet of Vehicles,

[0034]

[0035] Among them, h is the data information of the optimized Spearman correlation coefficient between the Internet of Vehicles threat intelligence and the entity object, η1, η2 and η3 are weight coefficients, which characterize the correlation between the entity object and the feature matrix of the Internet of Vehicles threat intelligence, and obtain the data information of the correlation between the Internet of Vehicles entity object and the threat intelligence.

[0036] Furthermore, the constraints of the weight coefficients η1, η2 and η3 are:

[0037]

[0038] Furthermore, the constraint function g of the cross-validation optimization parameters γ1, γ2 and γ3 of the Internet of Vehicles is,

[0039]

[0040] Among them, the value range of the constraint function g is (0,1).

[0041] Furthermore, in step U4, the building of the Internet of Vehicles threat assessment model and the analysis of the threats to the Internet of Vehicles include:

[0042] U41. Based on the Internet of Vehicles threat knowledge graph, construct an Internet of Vehicles threat knowledge graph set;

[0043] U42. Input the Internet of Vehicles threat knowledge graph set into the Internet of Vehicles threat assessment model for training and learning, and determine the Internet of Vehicles threat assessment function G,

[0044]

[0045] Among them, q is the Internet of Vehicles threat knowledge graph set, λ1, λ2 and λ3 are Internet of Vehicles threat assessment factors, and the trained Internet of Vehicles threat assessment model is obtained;

[0046] U43. Based on the trained Internet of Vehicles threat assessment model, the Internet of Vehicles threat knowledge graph is input to analyze the threats of the Internet of Vehicles to obtain data information of the threat analysis of the Internet of Vehicles.

[0047] In order to achieve the above-mentioned purpose and other related purposes, the present invention also provides a vehicle network threat analysis system based on knowledge graph, including a computer device, which is programmed or configured to execute any step of the vehicle network threat analysis method based on knowledge graph.

[0048] In order to achieve the above-mentioned purpose and other related purposes, the present invention also provides a computer-readable storage medium, which stores a computer program programmed or configured to execute any one of the knowledge graph-based Internet of Vehicles threat analysis methods.

[0049] The present invention has the following positive effects:

[0050] 1. The present invention extracts the characteristic information of the Internet of Vehicles threat intelligence by adopting a hierarchical clustering algorithm based on expected cross entropy, and characterizes the correlation between the entity object and the characteristic matrix of the Internet of Vehicles threat intelligence by combining a cross-validation algorithm based on the Spearman rank correlation coefficient. It can not only solve the problem of not being able to comprehensively cover the determination of threats in all dimensions of the Internet of Vehicles, but also analyze the Internet of Vehicles threat knowledge graph from various angles, and can intuitively display the Internet of Vehicles threat intelligence, which is convenient for automobile security analysts to flexibly analyze the security situation of the Internet of Vehicles.

[0051] 2. The present invention constructs an IoV threat assessment model to analyze the threats of IoV. It can not only flexibly divide the IoV threat knowledge graph into various threat subgraphs to freely and flexibly display the IoV threat situation, but also solves the problem that the final analysis of IoV threats can only focus on the threats of IoV software and hardware systems, while ignoring the communication dimension that really causes the complexity of IoV threats, which is related to people, vehicles, roads, and clouds. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a schematic diagram of the method flow of the present invention;

[0053] Figure 2 It is a schematic diagram of the process of the hierarchical clustering algorithm based on expected cross entropy of the present invention;

[0054] Figure 3 It is a schematic diagram of the process of the cross-validation algorithm based on the Spearman rank correlation coefficient of the present invention;

[0055] Figure 4 A schematic diagram of a process for constructing a threat assessment model for Internet of Vehicles according to the present invention;

[0056] Figure 5 Schematic diagram of the system architecture of the present invention. DETAILED DESCRIPTION

[0057] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0058] Example 1: Figure 1 As shown, a vehicle network threat analysis method based on knowledge graph, the method includes:

[0059] U1. Collect data information of Internet of Vehicles entity objects and data information of Internet of Vehicles threat intelligence;

[0060] U2. Based on the data information of the Internet of Vehicles threat intelligence, a hierarchical clustering algorithm based on expected cross entropy is used to extract feature information of the Internet of Vehicles threat intelligence to obtain data information of a feature matrix of the Internet of Vehicles threat intelligence;

[0061] U3. Based on the data information of the characteristic matrix of the Internet of Vehicles threat intelligence and the data information of the Internet of Vehicles entity object, a cross-validation algorithm based on the Spearman rank correlation coefficient is used to characterize the correlation between the entity object and the characteristic matrix of the Internet of Vehicles threat intelligence, and obtain data information on the correlation between the Internet of Vehicles entity object and the threat intelligence;

[0062] U4. Based on the data information of the correlation between the Internet of Vehicles entity objects and threat intelligence, an Internet of Vehicles threat knowledge graph is generated, and an Internet of Vehicles threat assessment model is constructed to analyze the threats of the Internet of Vehicles and obtain data information of the threat analysis of the Internet of Vehicles.

[0063] In this embodiment, if Figure 2 As shown, in step U2, the extraction of feature information of Internet of Vehicles threat intelligence using a hierarchical clustering algorithm based on expected cross entropy includes:

[0064] U21. Based on the data information of the Internet of Vehicles threat intelligence, establish the expected cross entropy function F of the Internet of Vehicles threat intelligence,

[0065]

[0066] Among them, x is the data information of the Internet of Vehicles threat intelligence, α1, α2 and α3 are the cross entropy factors of the Internet of Vehicles threat intelligence, and the cross entropy information value of the Internet of Vehicles threat intelligence is calculated to obtain the data information of the cross information entropy value of the Internet of Vehicles threat intelligence;

[0067] U22. Based on the data information of the cross information entropy value of the Internet of Vehicles threat intelligence, a hierarchical clustering function Q of the Internet of Vehicles threat intelligence is established.

[0068]

[0069] Among them, y is the data information of the cross information entropy value of the Internet of Vehicles threat intelligence, β1, β2 and β3 are the hierarchical clustering dynamic factors of the Internet of Vehicles threat intelligence;

[0070] U23. Based on the hierarchical clustering function Q of the Internet of Vehicles threat intelligence, the feature information of the Internet of Vehicles threat intelligence is extracted to obtain data information of the feature matrix of the Internet of Vehicles threat intelligence.

[0071] In this embodiment, the hierarchical clustering dynamic factors β1, β2 and β3 of the Internet of Vehicles threat intelligence are:

[0072]

[0073] Among them, y is the data information of the cross information entropy value of the Internet of Vehicles threat intelligence.

[0074] In this embodiment, the cross entropy factors α1, α2 and α3 of the IoV threat intelligence are:

[0075]

[0076] Among them, x is the data information of Internet of Vehicles threat intelligence.

[0077] In this embodiment, if Figure 5 As shown, in step U3, the cross-validation algorithm based on the Spearman rank correlation coefficient is used to characterize the correlation between the entity object and the feature matrix of the Internet of Vehicles threat intelligence, including:

[0078] U31. Based on the data information of the characteristic matrix of the Internet of Vehicles threat intelligence and the data information of the Internet of Vehicles entity object, construct the Spearman rank correlation function W of the Internet of Vehicles,

[0079]

[0080] Among them, z1 is the data information of the characteristic matrix of the Internet of Vehicles threat intelligence, z2 is the data information of the Internet of Vehicles entity object, δ1, δ2 and δ3 are the relationship factors between the Internet of Vehicles threat intelligence and the entity object, and the Spearman correlation coefficient of the Internet of Vehicles threat intelligence and the entity object is characterized to obtain the data information of the Spearman correlation coefficient of the Internet of Vehicles threat intelligence and the entity object;

[0081] U32. Based on the data information of the Spearman correlation coefficient of the Internet of Vehicles threat intelligence and the entity object, a cross-validation optimization function R of the Internet of Vehicles is constructed.

[0082]

[0083] Among them, r is the data information of the Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object, γ1, γ2 and γ3 are the cross-validation optimization parameters of the Internet of Vehicles, and the Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object is optimized to obtain the data information of the optimized Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object;

[0084] U33. Based on the data information of the optimized Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object, a correlation function S is established between the entity object of the Internet of Vehicles and the feature matrix of the threat intelligence of the Internet of Vehicles,

[0085]

[0086] Among them, h is the data information of the optimized Spearman correlation coefficient between the Internet of Vehicles threat intelligence and the entity object, η1, η2 and η3 are weight coefficients, which characterize the correlation between the entity object and the feature matrix of the Internet of Vehicles threat intelligence, and obtain the data information of the correlation between the Internet of Vehicles entity object and the threat intelligence.

[0087] In this embodiment, the constraints of the weight coefficients η1, η2 and η3 are:

[0088]

[0089] In this embodiment, the constraint function g of the cross-validation optimization parameters γ1, γ2 and γ3 of the Internet of Vehicles is,

[0090]

[0091] Among them, the value range of the constraint function g is (0,1).

[0092] Example 2: Based on the knowledge graph-based Internet of Vehicles threat analysis method in Example 1, the present invention is further illustrated and described below.

[0093] like Figure 1 As shown, a vehicle network threat analysis method based on knowledge graph, the method includes:

[0094] U1. Collect data information of Internet of Vehicles entity objects and data information of Internet of Vehicles threat intelligence;

[0095] U2. Based on the data information of the Internet of Vehicles threat intelligence, a hierarchical clustering algorithm based on expected cross entropy is used to extract feature information of the Internet of Vehicles threat intelligence to obtain data information of a feature matrix of the Internet of Vehicles threat intelligence;

[0096] U3. Based on the data information of the characteristic matrix of the Internet of Vehicles threat intelligence and the data information of the Internet of Vehicles entity object, a cross-validation algorithm based on the Spearman rank correlation coefficient is used to characterize the correlation between the entity object and the characteristic matrix of the Internet of Vehicles threat intelligence, and obtain data information on the correlation between the Internet of Vehicles entity object and the threat intelligence;

[0097] U4. Based on the data information of the correlation between the Internet of Vehicles entity objects and threat intelligence, an Internet of Vehicles threat knowledge graph is generated, and an Internet of Vehicles threat assessment model is constructed to analyze the threats of the Internet of Vehicles and obtain data information of the threat analysis of the Internet of Vehicles.

[0098] In this embodiment, if Figure 4 As shown, in step U4, the construction of the Internet of Vehicles threat assessment model and the analysis of the threats to the Internet of Vehicles include:

[0099] U41. Based on the Internet of Vehicles threat knowledge graph, construct an Internet of Vehicles threat knowledge graph set;

[0100] U42. Input the Internet of Vehicles threat knowledge graph set into the Internet of Vehicles threat assessment model for training and learning, and determine the Internet of Vehicles threat assessment function G,

[0101]

[0102] Among them, q is the Internet of Vehicles threat knowledge graph set, λ1, λ2 and λ3 are Internet of Vehicles threat assessment factors, and the trained Internet of Vehicles threat assessment model is obtained;

[0103] U43. Based on the trained Internet of Vehicles threat assessment model, the Internet of Vehicles threat knowledge graph is input to analyze the threats of the Internet of Vehicles to obtain data information of the threat analysis of the Internet of Vehicles.

[0104] In this embodiment, the present invention provides a vehicle network threat analysis system based on a knowledge graph, including a computer device that is programmed or configured to execute any one of the steps of the vehicle network threat analysis method based on a knowledge graph.

[0105] like Figure 5As shown in the figure, from the perspective of security threats to the Internet of Vehicles, the Internet of Vehicles architecture is divided into the external network communication layer, the internal platform network layer, and the internal component layer. The main attack surfaces of the external network communication layer are: Bluetooth car keys, OBD ports, WiFi, TSP, mobile application Apps, Internet of Vehicles cloud (including possible automotive security operation center VSOC cloud and public key certificate system PKI cloud) and mutual communication channels. The attack surface of the internal platform network layer is mainly concentrated on the CAN bus. The threats to the internal component layer mainly come from security vulnerabilities of ECU (including sensors, IDPS vehicle-side components and PKI vehicle-side SDK), and the security vulnerabilities of ECU include software vulnerabilities and firmware vulnerabilities.

[0106] This application mainly consists of four modules: asset identification module, threat association module, threat analysis module, and threat display module.

[0107] The function of the asset identification module is to identify the entity elements of the Internet of Vehicles and abstract the entity elements into asset node objects of the Internet of Vehicles knowledge graph.

[0108] The threat association module is divided into two sub-functions: 1. Abstracting threat intelligence nodes from information in threat intelligence; 2. Connecting threat intelligence nodes with IoV asset nodes. This module associates IoV assets with IoV threat knowledge, thereby generating an IoV threat knowledge graph.

[0109] The threat analysis module classifies the threat levels or calculates the threat scores of the asset nodes in the Internet of Vehicles knowledge graph based on threat intelligence.

[0110] The threat display module visualizes the Internet of Vehicles threat knowledge graph to complete the Internet of Vehicles threat analysis.

[0111] Asset Identification Module

[0112] The asset identification module identifies the elements of the physical assets of the Internet of Vehicles contained in the three major parts of the Internet of Vehicles: the external network communication layer, the internal platform network layer, and the internal component layer. The types of assets include hardware systems (including ECUs, sensors and other automotive Internet electronic and electrical components, servers, etc.), hardware subsystems, software systems (including automotive basic software systems, cloud platform software systems, etc.), software subsystems, interfaces (including OBD, USB, etc.), communication protocols, bus protocols, etc.

[0113] First, to realize the functions of this module, it is necessary to collect the data of physical objects in the Internet of Vehicles. A more feasible method is to collect threat intelligence and extract relevant information about physical assets from the threat intelligence data.

[0114] After obtaining the physical asset object, these Internet of Vehicles physical asset elements are abstracted into asset node objects of the knowledge graph, that is, partial information of each type of asset node is extracted as the node identification information of the asset entity of that type. The extraction method is summarized as follows: from the information describing the physical asset object, the information that can identify the physical object is selected as the asset node identification information, and the other information is used as the attribute information of the asset object.

[0115] For hardware systems, the string information of the manufacturer and version information (as specific as possible) of the hardware system asset object is concatenated as the identification information of the asset node, and the other information of the hardware system is used as the attribute information of the hardware system asset node. Similarly, for hardware subsystems, software systems, and software subsystems, the same method is used to identify asset nodes, and other information is used as the attribute information of asset nodes.

[0116] For interface asset objects, the USB interface uses the protocol adopted by the interface and the specific version number of the protocol as the identification information of the USB interface asset object, and other information is used as the attribute information of this type of asset node; the OBD interface is identified according to the vehicle model of the automobile manufacturer where the interface is located, and other information is used as the attribute information of this type of node.

[0117] The communication protocols include common protocols in the automotive network environment, such as TCP, UDP, HTTP, SOME / IP, TLS, UDS, MQTT, etc. The specific version of the protocol is used as the identification information of the protocol asset node, and other information is used as the attribute information of the protocol asset node.

[0118] Through the above extraction method, the asset entity objects in the vehicle network are extracted as asset nodes in the vehicle network knowledge graph.

[0119] In this embodiment, the present invention provides a computer-readable storage medium, on which is stored a computer program programmed or configured to execute any one of the knowledge graph-based Internet of Vehicles threat analysis methods.

[0120] Any reference to memory, storage, database or other media used in the embodiments provided in the present application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM) and memory bus dynamic RAM (RDRAM).

[0121] In summary, the present invention can not only solve the problem of not being able to comprehensively cover the determination of threats in all dimensions of the Internet of Vehicles, but also can intuitively display Internet of Vehicles threat intelligence from various angles for the Internet of Vehicles threat knowledge graph, making it easier for automobile security analysts to flexibly analyze the security situation of the Internet of Vehicles.

[0122] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A vehicle network threat analysis method based on knowledge graph, characterized in that: The method comprises: U1. Collect data information of Internet of Vehicles entity objects and data information of Internet of Vehicles threat intelligence; U2. Based on the data information of the Internet of Vehicles threat intelligence, a hierarchical clustering algorithm based on expected cross entropy is used to extract feature information of the Internet of Vehicles threat intelligence to obtain data information of a feature matrix of the Internet of Vehicles threat intelligence; U3. Based on the data information of the characteristic matrix of the Internet of Vehicles threat intelligence and the data information of the Internet of Vehicles entity object, a cross-validation algorithm based on the Spearman rank correlation coefficient is used to characterize the correlation between the entity object and the characteristic matrix of the Internet of Vehicles threat intelligence, and obtain data information on the correlation between the Internet of Vehicles entity object and the threat intelligence; U4. Based on the data information of the correlation between the Internet of Vehicles entity objects and threat intelligence, an Internet of Vehicles threat knowledge graph is generated, and an Internet of Vehicles threat assessment model is constructed to analyze the threats of the Internet of Vehicles and obtain data information of the threat analysis of the Internet of Vehicles.

2. The Internet of Vehicles threat analysis method based on knowledge graph according to claim 1 is characterized in that: In step U2, the extracting feature information of the Internet of Vehicles threat intelligence using a hierarchical clustering algorithm based on expected cross entropy includes: U21. Based on the data information of the Internet of Vehicles threat intelligence, establish the expected cross entropy function F of the Internet of Vehicles threat intelligence, Among them, x is the data information of the Internet of Vehicles threat intelligence, α1, α2 and α3 are the cross entropy factors of the Internet of Vehicles threat intelligence, and the cross entropy information value of the Internet of Vehicles threat intelligence is calculated to obtain the data information of the cross information entropy value of the Internet of Vehicles threat intelligence; U22. Based on the data information of the cross information entropy value of the Internet of Vehicles threat intelligence, a hierarchical clustering function Q of the Internet of Vehicles threat intelligence is established. Among them, y is the data information of the cross information entropy value of the Internet of Vehicles threat intelligence, β1, β2 and β3 are the hierarchical clustering dynamic factors of the Internet of Vehicles threat intelligence; U23. Based on the hierarchical clustering function Q of the Internet of Vehicles threat intelligence, the feature information of the Internet of Vehicles threat intelligence is extracted to obtain data information of the feature matrix of the Internet of Vehicles threat intelligence.

3. The Internet of Vehicles threat analysis method based on knowledge graph according to claim 2 is characterized by: The hierarchical clustering dynamic factors β1, β2 and β3 of the Internet of Vehicles threat intelligence are: Among them, y is the data information of the cross information entropy value of the Internet of Vehicles threat intelligence.

4. The method for analyzing Internet of Vehicles threats based on knowledge graph according to claim 2 is characterized in that: The cross entropy factors α1, α2 and α3 of the Internet of Vehicles threat intelligence are: Among them, x is the data information of Internet of Vehicles threat intelligence.

5. The vehicle network threat analysis method based on knowledge graph according to claim 1 is characterized in that: In step U3, the cross-validation algorithm based on the Spearman rank correlation coefficient is used to characterize the correlation between the entity object and the feature matrix of the Internet of Vehicles threat intelligence, including: U31. Based on the data information of the characteristic matrix of the Internet of Vehicles threat intelligence and the data information of the Internet of Vehicles entity object, construct the Spearman rank correlation function W of the Internet of Vehicles, Among them, z1 is the data information of the characteristic matrix of the Internet of Vehicles threat intelligence, z2 is the data information of the Internet of Vehicles entity object, δ1, δ2 and δ3 are the relationship factors between the Internet of Vehicles threat intelligence and the entity object, and the Spearman correlation coefficient of the Internet of Vehicles threat intelligence and the entity object is characterized to obtain the data information of the Spearman correlation coefficient of the Internet of Vehicles threat intelligence and the entity object; U32. Based on the data information of the Spearman correlation coefficient of the Internet of Vehicles threat intelligence and the entity object, a cross-validation optimization function R of the Internet of Vehicles is constructed. Among them, r is the data information of the Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object, γ1, γ2 and γ3 are the cross-validation optimization parameters of the Internet of Vehicles, and the Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object is optimized to obtain the data information of the optimized Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object; U33. Based on the data information of the optimized Spearman correlation coefficient between the threat intelligence of the Internet of Vehicles and the entity object, a correlation function S is established between the entity object of the Internet of Vehicles and the feature matrix of the threat intelligence of the Internet of Vehicles, Among them, h is the data information of the optimized Spearman correlation coefficient between the Internet of Vehicles threat intelligence and the entity object, η1, η2 and η3 are weight coefficients, which characterize the correlation between the entity object and the feature matrix of the Internet of Vehicles threat intelligence, and obtain the data information of the correlation between the Internet of Vehicles entity object and the threat intelligence.

6. The vehicle network threat analysis method based on knowledge graph according to claim 5 is characterized by: The constraints of the weight coefficients η1, η2 and η3 are:

7. The vehicle network threat analysis method based on knowledge graph according to claim 5 is characterized by: The constraint function g of the cross-validation optimization parameters γ1, γ2 and γ3 of the Internet of Vehicles is, Among them, the value range of the constraint function g is (0,1).

8. The vehicle network threat analysis method based on knowledge graph according to claim 1 is characterized in that: In step U4, the construction of the Internet of Vehicles threat assessment model and the analysis of the threats to the Internet of Vehicles include: U41. Based on the Internet of Vehicles threat knowledge graph, construct an Internet of Vehicles threat knowledge graph set; U42. Input the Internet of Vehicles threat knowledge graph set into the Internet of Vehicles threat assessment model for training and learning, and determine the Internet of Vehicles threat assessment function G, Among them, q is the Internet of Vehicles threat knowledge graph set, λ1, λ2 and λ3 are Internet of Vehicles threat assessment factors, and the trained Internet of Vehicles threat assessment model is obtained; U43. Based on the trained Internet of Vehicles threat assessment model, the Internet of Vehicles threat knowledge graph is input to analyze the threats of the Internet of Vehicles to obtain data information of the threat analysis of the Internet of Vehicles.

9. A vehicle network threat analysis system based on knowledge graph, comprising a computer device, characterized in that: The computer device is programmed or configured to execute the steps of the vehicle network threat analysis method based on knowledge graph as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program that is programmed or configured to execute the knowledge graph-based Internet of Vehicles threat analysis method as described in any one of claims 1 to 8.

Images