Intrusion detection method and device of vehicle-mounted network, computer equipment and storage medium

Abstract

The invention relates to the technical field of Internet of Vehicles, and discloses an intrusion detection method and device of a vehicle-mounted network, computer equipment and a storage medium, applied to a vehicle end, the method comprises the following steps: detecting traffic data from external equipment of the vehicle-mounted network; transmitting the traffic data to a firewall of the kernel space, and detecting whether a head abnormal condition exists in the traffic data by using a first rule pre-configured in the firewall; if the head abnormal condition does not exist in the traffic data, copying the traffic data to the user space, and detecting the traffic data by using a second rule pre-configured in the user space to obtain event data; and generating a corresponding intrusion alarm log according to the event data, and storing the intrusion alarm log in a local database. According to the method, the problems of insufficient detection fineness, single attack behavior processing mode and incapability of effectively processing encrypted data in vehicle-mounted network intrusion detection are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle networking, and in particular to an intrusion detection method, device, computer equipment and storage medium for a vehicle-mounted network. Background Art

[0002] With the rapid development of intelligent connected vehicles, in order to ensure the safety of intelligent connected vehicles in networking scenarios, it is necessary to implement security control strategies to ensure networking security. However, improper user operation or attacker intrusion can easily lead to changes in security control strategies. Therefore, intrusion detection is particularly important for the Internet of Vehicles. By monitoring the traffic information from outside to inside the car, detecting whether it contains network attacks, and uploading the detection results to the cloud, we can promptly understand the major network security threats encountered by connected vehicles.

[0003] At present, there are many deficiencies in the existing vehicle network intrusion detection methods, such as insufficient detection precision, limited payload data detection, and only relying on four tables and five chains for basic detection, which makes it difficult to deeply explore the potential risks in the payload; the attack behavior processing method is single, and only based on the header characteristics of the attack traffic data for analysis and interception, lacking diversified response measures; unable to effectively process encrypted data, and unable to accurately identify security threats in encrypted traffic. Although the method of monitoring the traffic information from outside to inside the car and uploading the detection results to the cloud can understand network security threats to a certain extent, there is still much room for improvement in detection precision, attack behavior processing, and encrypted data processing. Summary of the invention

[0004] In view of this, embodiments of the present invention provide an intrusion detection method, apparatus, computer equipment and storage medium for an intrusion detection in a vehicle network to solve the problems of insufficient detection precision, a single method for handling attack behaviors and an inability to effectively process encrypted data in intrusion detection in a vehicle network.

[0005] In a first aspect, an embodiment of the present invention provides an intrusion detection method for an in-vehicle network, which is applied to a vehicle side, and the method includes:

[0006] Detect traffic data from external devices in the vehicle network;

[0007] The flow data is transmitted to a firewall in the kernel space, and a first rule pre-configured in the firewall is used to detect whether there is a header abnormality in the flow data;

[0008] If the traffic data does not have a header abnormality, the traffic data is copied to the user space, and the traffic data is detected using a second rule pre-configured in the user space to obtain event data;

[0009] A corresponding intrusion alarm log is generated according to the event data, and the intrusion alarm log is stored in a local database.

[0010] Further, the detecting whether there is a header abnormality in the traffic data by using a first rule pre-configured in the firewall includes:

[0011] Parsing the traffic data to obtain target data corresponding to a preset level protocol;

[0012] Identify the data source of the target data and determine whether the data source is an authorized device. If the data source is an unauthorized device, intercept the target data and determine whether there is a header anomaly in the traffic data.

[0013] Detect whether there is a preset type of attack behavior in the target data. If there is a preset type of attack behavior, intercept the attack behavior based on the defense mechanism, and determine whether there is a header anomaly in the traffic data.

[0014] Furthermore, the interception operation on the attack behavior based on the defense mechanism includes:

[0015] If the attack behavior belongs to the type of denial of service attack, the receiving frequency of the current service interface is adjusted to the preset frequency;

[0016] If the attack behavior belongs to the Ping flood attack type, a request quantity threshold is set, and a clearing operation is performed on Ping requests in the target data that exceed the request quantity threshold;

[0017] If the attack behavior belongs to the SYN flood attack type, setting the resource link condition between the external device and the vehicle end to be that the external device is an authorized device and the number of handshakes with the vehicle end reaches a preset number;

[0018] If the attack behavior belongs to the XMAS attack type, a TCP data packet with a specific flag bit in the target data is identified, and an interception operation is performed on the TCP data packet with the specific flag bit.

[0019] Furthermore, the method further comprises:

[0020] If there is an abnormality in the header of the traffic data, abnormal information is generated;

[0021] Outputting the abnormal information to the kernel space of the vehicle end;

[0022] In the kernel space, the abnormal information is read into the user space by using a preset listener, and a corresponding intrusion alarm log is generated in the user space according to the abnormal information.

[0023] Further, the detecting the traffic data using the second rule pre-configured in the user space to obtain event data includes:

[0024] Identifying encrypted data in the traffic data and an encryption type of the encrypted data;

[0025] Querying a target decryption algorithm associated with the encryption type in a preset algorithm database, and using the target decryption algorithm to decrypt the encrypted data to obtain original data;

[0026] The original data is detected according to the pre-configured second rule to obtain event data.

[0027] Further, the detecting the original data according to the pre-configured second rule to obtain event data includes:

[0028] Parsing the original data to obtain multiple data packets and a protocol type corresponding to each of the data packets;

[0029] Obtaining the attack keyword in the second rule and the preset behavior mode corresponding to the protocol type;

[0030] Detecting whether the attack keyword exists in the data packet, and detecting whether the behavior pattern of the data packet matches the preset behavior pattern;

[0031] If the attack keyword exists in the data packet, or if the behavior pattern of the data packet matches the preset behavior pattern, the data packet is used as the event data.

[0032] Further, generating a corresponding intrusion alarm log according to the event data includes:

[0033] Analyze the event data to obtain correlations and attack links between multiple attack behaviors;

[0034] Constructing an attack scenario based on the association relationship and the attack link;

[0035] Determine the risk level of the attack scenario and generate a corresponding intrusion alarm log according to the risk level.

[0036] In a second aspect, an embodiment of the present invention provides an intrusion detection device for a vehicle network, which is applied to a vehicle end, and the device includes:

[0037] A detection module, used to detect traffic data from external devices of the vehicle network;

[0038] A transmission module, used for transmitting the flow data to a firewall in a kernel space, and detecting whether there is a header anomaly in the flow data by using a first rule pre-configured in the firewall;

[0039] A copy module, configured to copy the traffic data to a user space if there is no abnormal header condition in the traffic data, and detect the traffic data using a second rule pre-configured in the user space to obtain event data;

[0040] The generating module is used to generate a corresponding intrusion alarm log according to the event data, and store the intrusion alarm log in a local database.

[0041] In a third aspect, an embodiment of the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0042] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method of the first aspect or any corresponding embodiment thereof.

[0043] The method provided in the embodiment of the present application has the following beneficial effects:

[0044] The method provided in the embodiment of the present application adopts a two-layer verification structure of kernel space and user space, and first transmits the flow data to the firewall of the kernel space to detect the abnormality of the header. If there is no abnormality in the header, the flow data is copied to the user space for detection using the second rule. This layered detection method breaks through the limitation of the existing iptables-based detection method that only relies on four tables and five chains for basic detection. It can go deep into the payload part of the flow data and timely discover the potential risk information hidden therein, greatly improving the precision of vehicle-mounted network intrusion detection and enhancing the ability to prevent complex network attacks. In addition, the present application generates a corresponding intrusion alarm log based on the event data and stores it in a local database. Through this log recording method, it is possible to count the frequency of occurrence of different types of threats, analyze the source and scope of impact of the threats, etc., solving the problem of being unable to comprehensively evaluate and analyze network security threats.

[0045] The method provided in the embodiment of the present application can determine the abnormality of the traffic data header and enhance the accuracy and comprehensiveness of detection by parsing the traffic data, identifying the source and detecting the attack behavior; take corresponding defense interception operations for different attacks, effectively deal with various attacks, and improve the pertinence and effectiveness of defense; generate and process abnormal information when the traffic data header is abnormal, and ensure that it is converted into an intrusion alarm log in time, which is conducive to timely discovery and response to potential threats; perform detailed detection on the original data after decrypting the encrypted data, which solves the problem of encrypted data detection, expands the detection range, and improves the probability and accuracy of detecting abnormal data packets; analyzes event data to construct attack scenarios and judges the risk level to generate alarm logs, so that the logs are more valuable for reference and accurately reflect the network security threat status.

[0046] The method provided in the embodiment of the present application adopts a targeted defense mechanism for different types of attack behaviors, greatly improving the security of the vehicle-mounted network. When the attack behavior belongs to the denial of service attack type, the receiving frequency of the current service interface is adjusted to the preset frequency, which can effectively alleviate the service congestion caused by a large number of requests and ensure the availability of normal services. If it is a Ping flood attack type, setting a request number threshold and performing a clearing operation on Ping requests that exceed the threshold can prevent too many Ping requests from occupying network resources and ensure the stable operation of the network. For the SYN flood attack type, setting the resource link condition between the external device and the vehicle end to the external device being an authorized device and the number of handshakes reaching a preset number can effectively filter out malicious connection requests and protect the vehicle-end system from the impact of SYN flood attacks. When the attack behavior belongs to the XMAS attack type, identifying TCP packets with specific flags and performing interception operations can timely prevent XMAS attacks and prevent attackers from using packets with special flags to carry out malicious attacks.

[0047] The method provided in the embodiment of the present application, when detecting the original data, obtains multiple data packets and corresponding protocol types by parsing the original data, and then for each data packet, on the one hand, detects whether there are attack keywords, and on the other hand, detects whether its behavior pattern matches the preset behavior pattern corresponding to the protocol type. This multi-dimensional detection method greatly improves the precision of the detection and does not miss any potential abnormal situation. Then, when it is detected that there are attack keywords in the data packet or the behavior pattern does not match the preset behavior pattern, the data packet is used as event data, and an intrusion alarm log can be generated based on the event data and stored in the local database, which provides rich means and basis for further analysis and processing of attack behaviors, and is no longer limited to a single processing method. In addition, the present application can also identify encrypted data and its encryption type in the traffic data, and then query the target decryption algorithm associated with it in the preset algorithm database, decrypt the encrypted data to obtain the original data, thereby incorporating the encrypted data into the detection range, making the intrusion detection of the entire vehicle network more comprehensive and effective. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 is a flow chart of an intrusion detection method for a vehicle network according to some embodiments of the present invention;

[0050] Figure 2 is a flow chart of another intrusion detection method for an in-vehicle network according to some embodiments of the present invention;

[0051] Figure 3 is a structural block diagram of an intrusion detection system for a vehicle network according to an embodiment of the present invention;

[0052] Figure 4 is a structural block diagram of another intrusion detection system for an in-vehicle network according to an embodiment of the present invention;

[0053] Figure 5 is a structural block diagram of an intrusion detection device for a vehicle network according to an embodiment of the present invention;

[0054] Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0056] According to an embodiment of the present invention, an intrusion detection method, apparatus, computer device and storage medium for a vehicle network are provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0057] In this embodiment, a vehicle network intrusion detection method is provided, which is applied to the vehicle side. Figure 1 is a flow chart of an intrusion detection method for a vehicle network according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0058] Step S11, detecting traffic data from external devices of the vehicle network.

[0059] In the embodiments of the present application, the intelligent connected vehicle will interact with external devices, such as other vehicles, roadside devices or cloud services. The traffic data between these external devices and the vehicle network contains various types of interaction information (such as TCP, HTTP, IMAP, SSH, MQTT, TELNET, etc.). Since these interaction information may contain potential security threats, by discovering the traffic data of these external hosts accessing the intelligent connected vehicle, it can lay the foundation for subsequent judgment of whether these flows pose security risks (such as abnormal header conditions, attack behaviors, etc.), thereby realizing intrusion detection of the intelligent connected vehicle system.

[0060] Step S12, transmitting the traffic data to the firewall in the kernel space, and using the first rule pre-configured in the firewall to detect whether there is any abnormality in the header of the traffic data.

[0061] It should be noted that the kernel space is the core area of ​​the operating system, which manages system resources, processes hardware interactions and other low-level operations. The firewall is located in the kernel space, used for network security protection and has preset rules for detecting and filtering traffic data. The firewall has a specific network traffic detection architecture, which consists of four tables and five chains. This structure is designed to comprehensively and orderly detect and manage network traffic flowing into and out of the firewall. The four tables set rules for network connection status, packet filtering and other aspects from different dimensions, while the five chains (including original chains and custom chains based on special routing processing) are like process channels, allowing traffic to flow through these chains in a predetermined order. The rules on each chain are like checkpoints to filter and judge traffic.

[0062] Specifically, the process of configuring the first rule in the firewall includes: first, clarify the functional requirements of the created custom chain, such as specific types of attack prevention or specific network traffic management. Secondly, determine the name of the custom chain according to the requirements, such as "my_input_rule", and use the command "iptables-wN [custom chain name]" to create a custom chain, that is, open up a specific rule processing area in the kernel space, laying the foundation for subsequent rule configuration. Thirdly, determine which traffic will be introduced into the custom chain for processing, and transfer the incoming traffic (such as the incoming traffic corresponding to the INPUT chain) to the newly created custom chain through a command similar to "iptables-w-AINPUT-j [custom chain name]" so that it can be detected and processed according to the custom rules. Finally, add rules under the custom chain according to specific security requirements. For example, for high-frequency ping attacks, use commands such as "iptables-wA [custom chain name] -picmp-mlimit --limit1 / s --limit-burst20-jNFLOG --nflog-group10 --nflog-prefixFI REWALL-2" to add rules. These rules will detect and filter the passing traffic data in the firewall mechanism of the kernel space.

[0063] In the embodiment of the present application, the first rule pre-configured in the firewall is used to detect whether there is a header abnormality in the traffic data, including the following steps A1-A3:

[0064] Step A1, parse the traffic data to obtain target data corresponding to the preset level protocol.

[0065] It should be noted that in the kernel space firewall, when processing the L3 (network layer) and L4 (transport layer) target data of the seven-layer protocol based on the NetFilter application iptables detection rule (the first rule), it is necessary to parse the relevant protocol data from the traffic data, such as the source IP and destination IP of the network layer IP datagram, the port number and flag bit of the transport layer TCP or UDP segment, etc.

[0066] Specifically, there are two methods for parsing network traffic data: parsing based on protocol standards: for IPv4 and IPv6 protocols, obtain information based on the header structure identification field; parse the source port, destination port, flags and other fields of the 20-byte header of the TCP protocol, and the source port, destination port and other fields of the 8-byte header of the UDP protocol. Parsing using tools and libraries: use network packet capture tools such as Wireshark, parse from the bottom to the top with the help of predefined parsers and display them as parsing trees; use programming language related libraries such as Python's Scapy library to create, send, capture and parse network data packets.

[0067] Step A2, identifying the data source of the target data and determining whether the data source is an authorized device. If the data source is an unauthorized device, intercepting the target data and determining whether there is a header anomaly in the traffic data.

[0068] Specifically, first, use the target data (such as the source IP address in the IP datagram) to determine which device the data is sent from. Secondly, compare the identified data source with the pre-set authorized device list (which can be a whitelist stored locally, containing information such as legal IP addresses or device identification). If the data source is not in the authorized device list, an interception operation is performed and it is determined that there is an abnormality in the header of the traffic data.

[0069] Step A3, detecting whether there is a preset type of attack behavior in the target data. If there is a preset type of attack behavior, an interception operation is performed on the attack behavior based on the defense mechanism, and determining whether there is a header anomaly in the traffic data.

[0070] Specifically, based on the target data (including network layer and transport layer related data), check whether there is a preset type of attack behavior, such as judging Ping flood attacks based on Ping request frequency, detecting SYN flood attacks based on TCP connection SYN flags and connection establishment features, etc. If an attack behavior is detected, the corresponding defense mechanism is activated to intercept, and then determine whether there is an abnormality in the traffic data header.

[0071] In the embodiment of the present application, the interception operation is performed on the attack behavior based on the defense mechanism, including the following steps A31-A34:

[0072] Step A31: If the attack behavior belongs to the type of denial of service attack, the receiving frequency of the current service interface is adjusted to a preset frequency.

[0073] Specifically, when a denial of service attack is detected, the service interface receiving frequency is adjusted to the preset frequency to limit malicious traffic and protect service and system security. The preset frequency is determined based on multiple factors. For example, if the system performance test shows that the system is stable and not vulnerable to attacks when receiving no more than 100 requests per second, the preset rate can be set to 100 / s. In terms of technical implementation, the frequency can be adjusted through the network configuration tool or the security policy management module. In the Linux system and when using iptables to manage the network, the kernel parameters can be modified or adjusted with traffic control tools (such as tc), such as setting the receiving queue length and processing rate; the iptables extension module (such as ipset) can also be used to define rules to control traffic and limit or discard traffic that does not meet the preset frequency.

[0074] Step A32: If the attack behavior belongs to the Ping flood attack type, a request quantity threshold is set, and a clearing operation is performed on Ping requests in the target data that exceed the request quantity threshold.

[0075] Specifically, when setting the Ping request number threshold, it is necessary to consider the normal network usage (determine the reasonable range through historical data statistical analysis) and the processing capacity of the network equipment (to ensure that the normal monitoring function is not affected). For example, when the device can process 1,000 Ping requests per second and normally does not exceed 50 per second, the threshold can be set to 100 per second. When using iptables to manage the network in a Linux system, you can write custom rules to set thresholds, such as using the conntrack module of iptables to create a rule chain for processing Ping requests and set a counter to count the number, and trigger a clearing operation when the threshold is reached. After identifying Ping requests that exceed the threshold, these request packets can be discarded through the DROP target of iptables, such as adding rules to the rule chain to prevent Ping request flooding attacks. Ping requests that exceed the threshold can also be redirected to a specific module for analysis or recording (such as recording the attack source IP) to prevent them from spreading in the network.

[0076] Step A33, if the attack behavior belongs to the SYN flood attack type, the resource link condition between the external device and the vehicle end is set to that the external device is an authorized device and the number of handshakes with the vehicle end reaches a preset number.

[0077] Specifically, first establish a list of authorized devices for the vehicle-side system, including identification information such as IP address, MAC address or digital certificate and store it in a local database or configuration file. When an external device connects to the vehicle-side, its identity is verified, and the identification is compared with the list through the network layer (checking the source IP address) or the transport layer (such as the first handshake of the TCP connection) to determine whether it is an authorized device.

[0078] The preset number of handshakes is determined based on the vehicle-side system security policy and resource limitations. For example, considering limited resources and preventing SYN flood attacks, after testing the normal connection, the three-way handshake is completed within 5 times (including retransmission), so the preset number is set to 5 times. The vehicle-side uses the network protocol stack mechanism or security module to monitor the number of handshakes. For TCP connections, a counting function is added to its connection state machine implementation. When the SYN packet of the external device is received, the counting starts and is updated in the subsequent handshake process. If the preset number is exceeded, it is determined that there may be an attack or anomaly. Only when the external device is an authorized device and the number of handshakes meets the standard is it allowed to establish a complete resource link. Otherwise, the vehicle-side takes corresponding measures (rejection if not authorized, interruption of connection if the handshake exceeds the number and banning of the source IP for a period of time).

[0079] Step A34, if the attack behavior belongs to the XMAS attack type, identify the TCP data packets with specific flag bits in the target data, and perform interception operations on the TCP data packets with specific flag bits.

[0080] It should be noted that in the XMAS attack, the TCP data packet is maliciously constructed, and its flag bit combination is special. The normal TCP communication flag bit setting has rules, and the typical characteristics of the TCP data packet of the XMAS attack are that FIN (end connection flag), URG (urgent pointer flag), and PSH (push data flag) are all set to 1 at the same time.

[0081] Specifically, when analyzing TCP packets, parse the header according to the protocol standard, and use bit operations (binary conversion and bit mask operations during programming) to read the flag bit to determine whether it meets the XMAS attack characteristics. When using iptables to manage the network in the Linux system, create rules (-ptcp combined with specific flag bit matching rules, such as DROP when FIN, URG, PSH are 1) and add them to the INPUT or FORWARD chain for interception. It can also be intercepted through the DPI technology of the built-in firewall, IDS / IPS, and can be discarded or alarmed when it meets the characteristics.

[0082] The method provided in the embodiment of the present application adopts a targeted defense mechanism for different types of attack behaviors, greatly improving the security of the vehicle-mounted network. When the attack behavior belongs to the denial of service attack type, the receiving frequency of the current service interface is adjusted to the preset frequency, which can effectively alleviate the service congestion caused by a large number of requests and ensure the availability of normal services. If it is a Ping flood attack type, setting a request number threshold and performing a clearing operation on Ping requests that exceed the threshold can prevent too many Ping requests from occupying network resources and ensure the stable operation of the network. For the SYN flood attack type, setting the resource link condition between the external device and the vehicle end to the external device being an authorized device and the number of handshakes reaching a preset number can effectively filter out malicious connection requests and protect the vehicle-end system from the impact of SYN flood attacks. When the attack behavior belongs to the XMAS attack type, identifying TCP packets with specific flags and performing interception operations can timely prevent XMAS attacks and prevent attackers from using packets with special flags to carry out malicious attacks.

[0083] Step S13: If there is no abnormality in the header of the traffic data, the traffic data is copied to the user space, and the traffic data is detected using the second rule pre-configured in the user space to obtain event data.

[0084] It should be noted that user space is the operating environment provided by the operating system for user programs. It has low permissions and cannot directly access kernel resources, which can protect the system. Traffic data is initially in the kernel space, and user space programs cannot process it directly. It is necessary to use eBPF+pcap (filtering+interception) to efficiently copy it to the user space. The purpose is to use the pre-configured second rule to detect traffic data to identify security issues and obtain event data. Specifically, the second rule is the snort application rule, and snort is an open source intrusion detection system. In the process, the user space application uses this rule to deeply detect data: receiving kernel space traffic data, the snort unpacking module decrypts the original data, and transmits the original data to the rule module for detection according to the responsibility chain mode. The detected event data is handed over to the log management module. The snort rules can comprehensively analyze traffic data, identify security threats according to preset rules, and help network security protection to detect anomalies and respond in time.

[0085] In the embodiment of the present application, the flow data is detected using the second rule pre-configured in the user space to obtain event data, including the following steps B1-B3:

[0086] Step B1, identifying encrypted data in traffic data and the encryption type of the encrypted data.

[0087] Specifically, when identifying traffic data encryption data and its encryption type: first check the specific field of the data packet protocol header (such as the IPsec protocol identifier in the IP header), determine the existence of encrypted data and preliminarily infer the encryption type through the unique protocol identifier (such as the SSL / TLS handshake message); then analyze the data block characteristics (such as the data characteristics after AES encryption) and match them with the encryption algorithm library (such as RSA algorithm feature comparison) to determine the encryption type.

[0088] Step B2: query the preset algorithm database for a target decryption algorithm associated with the encryption type, and use the target decryption algorithm to decrypt the encrypted data to obtain the original data.

[0089] As an example, assume that the traffic data encryption is identified as TLS1.2 algorithm, which contains RSA public key and AES symmetric encryption combination. The corresponding decryption algorithm is found in the preset algorithm library, and the RSA encrypted part (if it is the AES symmetric key encryption result) is decrypted with the private key to obtain the AES symmetric key, and then divided into blocks according to the AES encryption block size, and the AES encrypted data is decrypted block by block according to its decryption algorithm rules, and all decrypted blocks are combined to obtain the original data.

[0090] Step B3: detect the original data according to the pre-configured second rule to obtain event data.

[0091] In the embodiment of the present application, step B3 includes the following steps B31-B34:

[0092] Step B31, parse the original data to obtain multiple data packets and the protocol type corresponding to each data packet.

[0093] Specifically, the original data is composed of multiple parts, which can be split into multiple data packets through parsing. In addition, during the splitting process, the protocol type corresponding to each data packet is determined. This operation is the basis for subsequent rule detection based on different protocol types, because different protocol types have different security risk characteristics and behavior patterns. Clarifying the protocol type helps to more accurately detect whether there is content related to security threats in the data packet.

[0094] Step B32, obtaining the attack keyword in the second rule and the preset behavior pattern corresponding to the protocol type.

[0095] Specifically, after parsing the original data to obtain the data packet and protocol type, key detection information is obtained from the pre-configured second rule, including attack keywords (such as "malware", "exploit", and other security threat-related content) and preset behavior patterns corresponding to the data packet protocol type (different protocol types have their own normal or potential attack behavior judgment patterns predefined based on security policies).

[0096] Step B33, detecting whether there is an attack keyword in the data packet, and detecting whether the behavior pattern of the data packet matches a preset behavior pattern.

[0097] Specifically, two tests are performed on each data packet: one is to detect whether the attack keyword obtained in step B32 is present in the data packet, for example, to check whether the data content in the data packet contains specific attack keywords such as "malware"; the other is to detect whether the behavior pattern of the data packet matches the preset behavior pattern obtained in step B32, that is, to determine whether the behavior of the data packet conforms to the normal or security policy-compliant behavior pattern under its corresponding protocol type (such as TCP or UDP), so as to determine whether the data packet has potential security risks or abnormal situations.

[0098] Step B34: If the attack keyword exists in the data packet, or the behavior pattern of the data packet matches the preset behavior pattern, the data packet is regarded as event data.

[0099] Specifically, if a data packet meets any of the two conditions, that is, the attack keyword exists in the data packet, or the behavior pattern of the data packet matches the preset behavior pattern, the data packet is identified as a possible security risk or abnormal situation, and the data packet is used as event data. These event data can be processed by subsequent modules (such as the log management module) to record and analyze security events.

[0100] The method provided in the embodiment of the present application, when detecting the original data, obtains multiple data packets and corresponding protocol types by parsing the original data, and then for each data packet, on the one hand, detects whether there are attack keywords, and on the other hand, detects whether its behavior pattern matches the preset behavior pattern corresponding to the protocol type. This multi-dimensional detection method greatly improves the precision of the detection and does not miss any potential abnormal situation. Then, when it is detected that there are attack keywords in the data packet or the behavior pattern does not match the preset behavior pattern, the data packet is used as event data, and an intrusion alarm log can be generated based on the event data and stored in the local database, which provides rich means and basis for further analysis and processing of attack behaviors, and is no longer limited to a single processing method. In addition, the present application can also identify encrypted data and its encryption type in the traffic data, and then query the target decryption algorithm associated with it in the preset algorithm database, decrypt the encrypted data to obtain the original data, thereby incorporating the encrypted data into the detection range, making the intrusion detection of the entire vehicle network more comprehensive and effective.

[0101] In the embodiment of the present application, the method further includes the following steps C1-C3:

[0102] Step C1: if there is any abnormality in the header of the traffic data, abnormal information is generated.

[0103] Specifically, attack detection is performed on L3 and L4 layer traffic data based on NetFilter and iptables detection rules (focusing on header features). When the traffic data header is abnormal, exception information is generated to record and identify the exception for subsequent processing (output, generation of alarm logs). The exception information includes the exception type, source and destination IP addresses, port number (if relevant), timestamp, etc., to locate and analyze the source and nature of the exception.

[0104] Step C2, output the abnormal information to the kernel space of the vehicle side.

[0105] Specifically, the kernel space is responsible for system-level operations and resource management. Outputting exception information to the kernel space allows related kernel modules (such as security monitoring and log management modules) to obtain the information for in-depth analysis or association with other security data. In the vehicle-side network security detection architecture, the kernel space centrally processes system-level events. This is in line with the principle of layered architecture and can clearly divide the kernel layer and user layer functions. The kernel space can use its own functional resources to uniformly manage and pre-process exception information, and then pass the results to the user space for generating advanced application operations such as intrusion alarm logs.

[0106] Step C3: In the kernel space, the abnormal information is read to the user space by using a preset listener, and a corresponding intrusion alarm log is generated in the user space according to the abnormal information.

[0107] Specifically, the preset listener is an information exchange component between the kernel and user space, which can identify kernel-specific information. Because the operating system isolates the two spaces, the kernel has core content, and direct access by the user space without a listener will destroy the isolation mechanism, causing system crashes and data leaks. In addition, the kernel has high permissions and the user space has low permissions, so the listener can safely transmit information within the permissions.

[0108] Step S14: Generate a corresponding intrusion alarm log according to the event data, and store the intrusion alarm log in a local database.

[0109] In the embodiment of the present application, generating a corresponding intrusion alarm log according to the event data includes the following steps D1-D3:

[0110] Step D1, analyzing event data to obtain correlations and attack links between multiple attack behaviors.

[0111] Specifically, event data contains multiple independent attack behaviors, which are inherently related. When analyzing, we need to analyze the characteristics of attack behaviors, such as different types of attack attempts at different times (such as port scanning followed by malicious access to specific services), and determine the correlation (causal or logical relationship) by analyzing the sequence of attack behaviors, source and destination addresses, ports, etc., and then obtain the attack link from the initial attack point to the final target.

[0112] Step D2: construct an attack scenario based on the association relationship and attack link.

[0113] Specifically, after clarifying the correlation between attack behaviors and attack links, we can construct attack scenarios to better assess the nature and impact of attacks. We can construct scenarios by combining attack behaviors in a logical order and in a mutual relationship. For example, if the attack link is an external network scanning the internal boundary firewall port, using an open port to invade the internal server and then expanding horizontally, the constructed scenario includes elements such as attackers, firewalls, servers, and expansion targets, which can clearly present the attack path, target, and means.

[0114] Step D3, determine the risk level of the attack scenario, and generate a corresponding intrusion alarm log according to the risk level.

[0115] Specifically, we first determine the risk level of the attack scenario based on multiple factors (attack type, target, progress, etc.), such as low risk of password brute force cracking, high risk of exploiting zero-day vulnerabilities; higher risk of attacking critical business servers than ordinary servers; higher risk of intrusion to obtain data than exploratory attacks. Then we generate intrusion alarm logs based on the risk level. High-risk logs are more detailed and contain emergency prompts and response suggestions, while low-risk logs are more concise and focus on recording attack behaviors for statistical analysis.

[0116] As an example, Figure 2 As shown in the figure, firstly, the in-and-out stack data (including traffic data of multiple protocol types) flowing into the four tables and five chains of the firewall are detected. The detection basis is NetFilter's iptables detection rule (first rule) to determine whether the header feature is abnormal. If abnormal, the traffic data is copied to the user space based on eBPF+pcap, and the snort rule (second rule) is applied in the user space to deeply detect the data part and generate a detection alarm log; if it is not abnormal, NFlog is generated. Finally, the log management module uploads or archives according to the policy.

[0117] The method provided by the embodiment of the present application first detects the flow data from the external device of the vehicle network, and detects it in different spaces using different rules, thereby increasing the level and dimension of detection and improving the precision of detection. When the flow data is transmitted to the firewall of the kernel space, the pre-configured first rule is used to detect the abnormality of the header, and the potential source of abnormal flow can be discovered in time. If there is no abnormality in the header, the flow data is copied to the user space and further detected with the pre-configured second rule. This phased and multi-space detection method greatly improves the comprehensiveness and precision of the detection. Secondly, there is no longer a single processing method for attack behavior. After detecting abnormal flow data, the present application will generate a corresponding intrusion alarm log according to the generated event data, and store it in the local database, which provides a basis for subsequent analysis and processing, and enriches the means of processing attack behavior. Finally, for encrypted data, the present application does not directly process the encrypted data itself, but analyzes the behavior pattern of the flow data by detecting the abnormality of the header of the flow data and the rules of multiple spaces. Even if the data is encrypted, abnormal flow can be found to a certain extent, thereby effectively handling the detection problems brought by encrypted data.

[0118] Figure 3 is a schematic diagram of the structure of an intrusion detection system for a vehicle network according to an embodiment of the present invention. Figure 3 As shown, the system includes: a vehicle end 100, a pipe end 200 and a cloud end 300;

[0119] The vehicle end 100 is used to execute the intrusion detection method of the vehicle network, including detecting the flow data from the external device of the vehicle network, transmitting the flow data to the firewall of the kernel space, using the first rule pre-configured in the firewall to detect whether there is a header abnormality in the flow data, if not, copying the flow data to the user space and using the second rule pre-configured in the user space to detect the flow data to obtain event data, generating a corresponding intrusion alarm log according to the event data and storing the intrusion alarm log in the local database, if there is a header abnormality, generating abnormal information and outputting it to the kernel space, using a preset listener in the kernel space to read the abnormal information to the user space and generating a corresponding intrusion alarm log according to the abnormal information in the user space, and other operations;

[0120] The management end 200 is used to communicate and interact with the vehicle end 100 and the cloud end 300, manage the data transmission between the vehicle end 100 and the cloud end 300, such as preliminary screening and sorting of the data uploaded by the vehicle end 100, forwarding the intrusion alarm log and other related data of the vehicle end 100 to the cloud end 300, and sending the relevant configuration information, update rules, etc. of the cloud end 300 to the vehicle end 100;

[0121] The cloud 300 is used to store and analyze data such as intrusion alarm logs from multiple vehicle terminals 100, explore potential network security threat trends through technologies such as big data analysis, provide support such as rule updates and security policy optimization for the vehicle terminals 100, and remotely monitor and manage the network security status of the vehicle terminals 100.

[0122] Specifically, Figure 4 As shown, the vehicle end 100 includes: a system initialization module 101, a configuration management module 102, a rule module 103, and a log management module 104;

[0123] The system initialization module 101 is used to initialize the hardware and software environment required by the vehicle network intrusion detection system when the vehicle end 100 is started, such as loading network drivers, initializing memory space, starting related processes, etc., to ensure that the system can run normally and perform subsequent intrusion detection work;

[0124] The configuration management module 102 is used to manage various configuration information of the vehicle end 100, including the configuration parameters of the first rule of the firewall, the second rule of the user space, the relevant parameters for communicating with external devices, and the configuration parameters required for the operation of each module in the intrusion detection system, and can update and adjust these configuration information as needed;

[0125] A rule module 103, used for formulating and storing a first rule and a second rule for intrusion detection;

[0126] The log management module 104 is used to receive and manage security logs in the intrusion detection process.

[0127] Specifically, the rule module 103 includes: a first rule (IPtables rules based on L3 and L4 layers in the seven-layer protocol), a second rule (custom snort rules based on L5 and L7 deep packet detection in the seven-layer protocol), wherein the seven-layer protocol includes: L1 physical layer, L2 data link layer, L3 network layer, L4 transport layer, L5 session layer, L6 presentation layer, and L7 application layer;

[0128] The first rule is used to detect traffic data in the firewall, specifically including parsing the traffic data to obtain target data corresponding to the preset layer protocol (L3, L4 layer), identifying the data source of the target data to determine whether it is an authorized device, if it is an unauthorized device, intercepting the target data to determine whether there is a header anomaly in the traffic data, detecting whether there is a preset type of attack behavior in the target data, if so, performing an interception operation on the attack behavior based on the defense mechanism and determining whether there is a header anomaly in the traffic data;

[0129] The second rule is used to detect the decrypted original data in the user space, specifically including parsing the original data to obtain multiple data packets and the protocol type (L5, L7 layer) corresponding to each data packet, obtaining the attack keyword in the second rule and the preset behavior pattern corresponding to the protocol type, detecting whether there is an attack keyword in the data packet and whether the behavior pattern of the data packet matches the preset behavior pattern. If so, the data packet is used as event data.

[0130] Specifically, the log management module 104 includes: a system log archive manager, an Iptables log listener, and a snort detection log manager;

[0131] The system log archive manager is used to archive and manage the system logs during the operation of the vehicle end 100, including operations such as log storage, classification, and backup, to ensure the integrity and queryability of the system logs, so as to facilitate subsequent analysis and troubleshooting of the system operation status;

[0132] Iptables log listener is used to monitor the log information generated by the firewall (based on IPtables rules) when detecting traffic data. When it is detected that traffic data triggers the firewall rules, relevant log content is obtained in time for subsequent analysis or interaction with other modules;

[0133] The snort detection log manager is used to manage the logs generated by snort rule-based detection, including recording detailed information during the detection process, such as the detected event data, detection time, data packets involved, etc. At the same time, these logs are analyzed and sorted to generate intrusion alarm logs and other operations.

[0134] In this embodiment, an intrusion detection device for a vehicle network is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the term "module" may be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0135] This embodiment provides an intrusion detection device for an in-vehicle network, which is applied to a vehicle end, such as Figure 5 As shown, including:

[0136] A detection module 51, used to detect traffic data from external devices of the vehicle network;

[0137] The transmission module 52 is used to transmit the traffic data to the firewall in the kernel space, and detect whether there is a header anomaly in the traffic data by using a first rule pre-configured in the firewall;

[0138] The copy module 53 is used for copying the traffic data to the user space if there is no abnormality in the header of the traffic data, and detecting the traffic data using the second rule pre-configured in the user space to obtain event data;

[0139] The generating module 54 is used to generate a corresponding intrusion alarm log according to the event data, and store the intrusion alarm log in a local database.

[0140] In an optional embodiment of the present application, the transmission module 52 is used to parse the traffic data to obtain the target data corresponding to the preset level protocol; identify the data source of the target data and determine whether the data source is an authorized device. If the data source is an unauthorized device, an interception operation is performed on the target data, and it is determined whether there is a header abnormality in the traffic data; detect whether there is a preset type of attack behavior in the target data. If there is a preset type of attack behavior, an interception operation is performed on the attack behavior based on the defense mechanism, and it is determined that there is a header abnormality in the traffic data.

[0141] In an optional embodiment of the present application, the transmission module 52 is used to adjust the receiving frequency of the current service interface to a preset frequency if the attack behavior is a denial of service attack type; if the attack behavior is a Ping flood attack type, a request quantity threshold is set, and a clearing operation is performed on Ping requests in the target data that exceed the request quantity threshold; if the attack behavior is a SYN flood attack type, a resource link condition between the external device and the vehicle end is set to that the external device is an authorized device and the number of handshakes with the vehicle end reaches a preset number; if the attack behavior is an XMAS attack type, a TCP data packet with a specific flag bit in the target data is identified, and an interception operation is performed on the TCP data packet with the specific flag bit.

[0142] In an optional embodiment of the present application, the device also includes: a reading module, which is used to generate exception information if there is a header abnormality in the traffic data; output the exception information to the kernel space of the vehicle; in the kernel space, use a preset listener to read the exception information to the user space, and generate a corresponding intrusion alarm log in the user space based on the exception information.

[0143] In an optional embodiment of the present application, the copy module 53 is used to identify the encrypted data in the traffic data and the encryption type of the encrypted data; query the target decryption algorithm associated with the encryption type in the preset algorithm database, and use the target decryption algorithm to decrypt the encrypted data to obtain the original data; detect the original data according to the pre-configured second rule to obtain event data.

[0144] In an optional embodiment of the present application, the copy module 53 is used to parse the original data to obtain multiple data packets and the protocol type corresponding to each data packet; obtain the attack keyword in the second rule and the preset behavior pattern corresponding to the protocol type; detect whether there is an attack keyword in the data packet, and detect whether the behavior pattern of the data packet matches the preset behavior pattern; if there is an attack keyword in the data packet, or whether the behavior pattern of the data packet matches the preset behavior pattern, then the data packet is used as event data.

[0145] In an optional embodiment of the present application, a generation module 54 is used to analyze event data to obtain correlation relationships and attack links between multiple attack behaviors; construct attack scenarios based on the correlation relationships and attack links; determine the risk level of the attack scenario, and generate corresponding intrusion alarm logs based on the risk level.

[0146] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system).

[0147] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0148] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0149] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the use of a computer device based on the presentation of a small program landing page, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0150] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0151] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0152] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0153] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A vehicle network intrusion detection method, characterized in that: Applied to the vehicle side, the method includes: Detect traffic data from external devices in the vehicle network; Transmitting the traffic data to a firewall in the kernel space, and using a first rule pre-configured in the firewall to detect whether there is a header anomaly in the traffic data; If the traffic data does not have a header abnormality, the traffic data is copied to the user space, and the traffic data is detected using a second rule pre-configured in the user space to obtain event data; A corresponding intrusion alarm log is generated according to the event data, and the intrusion alarm log is stored in a local database.

2. The method according to claim 1, characterized in that The detecting whether there is a header abnormality in the traffic data by using a first rule pre-configured in the firewall includes: Parsing the traffic data to obtain target data corresponding to a preset level protocol; Identify the data source of the target data and determine whether the data source is an authorized device. If the data source is an unauthorized device, intercept the target data and determine whether there is a header anomaly in the traffic data. Detect whether there is a preset type of attack behavior in the target data. If there is a preset type of attack behavior, intercept the attack behavior based on the defense mechanism, and determine whether there is a header anomaly in the traffic data.

3. The method according to claim 2, characterized in that The intercepting operation on the attack behavior based on the defense mechanism includes: If the attack behavior belongs to the type of denial of service attack, the receiving frequency of the current service interface is adjusted to the preset frequency; If the attack behavior belongs to the Ping flood attack type, a request quantity threshold is set, and a clearing operation is performed on Ping requests in the target data that exceed the request quantity threshold; If the attack behavior belongs to the SYN flood attack type, setting the resource link condition between the external device and the vehicle end to be that the external device is an authorized device and the number of handshakes with the vehicle end reaches a preset number; If the attack behavior belongs to the XMAS attack type, a TCP data packet with a specific flag bit in the target data is identified, and an interception operation is performed on the TCP data packet with the specific flag bit.

4. The method according to claim 1, characterized in that: The method further comprises: If there is an abnormality in the header of the traffic data, abnormal information is generated; Outputting the abnormal information to the kernel space of the vehicle end; In the kernel space, the abnormal information is read into the user space by using a preset listener, and a corresponding intrusion alarm log is generated in the user space according to the abnormal information.

5. The method according to claim 1, characterized in that The detecting the traffic data by using the second rule pre-configured in the user space to obtain event data includes: Identifying encrypted data in the traffic data and an encryption type of the encrypted data; Querying a target decryption algorithm associated with the encryption type in a preset algorithm database, and decrypting the encrypted data using the target decryption algorithm to obtain original data; The original data is detected according to the pre-configured second rule to obtain event data.

6. The method according to claim 5, characterized in that The detecting the original data according to the pre-configured second rule to obtain event data includes: Parsing the original data to obtain multiple data packets and a protocol type corresponding to each of the data packets; Obtaining the attack keyword in the second rule and the preset behavior mode corresponding to the protocol type; Detecting whether the attack keyword exists in the data packet, and detecting whether the behavior pattern of the data packet matches the preset behavior pattern; If the attack keyword exists in the data packet, or if the behavior pattern of the data packet matches the preset behavior pattern, the data packet is used as the event data.

7. The method according to claim 1, characterized in that The generating a corresponding intrusion alarm log according to the event data includes: Analyze the event data to obtain correlations and attack links between multiple attack behaviors; Constructing an attack scenario based on the association relationship and the attack link; Determine the risk level of the attack scenario and generate a corresponding intrusion alarm log according to the risk level.

8. An intrusion detection device for an in-vehicle network, applied to a vehicle, characterized in that: The device comprises: A detection module, used to detect traffic data from external devices of the vehicle network; A transmission module, used for transmitting the flow data to a firewall in a kernel space, and detecting whether there is a header anomaly in the flow data by using a first rule pre-configured in the firewall; A copy module, configured to copy the traffic data to a user space if there is no abnormal header condition in the traffic data, and detect the traffic data using a second rule pre-configured in the user space to obtain event data; The generating module is used to generate a corresponding intrusion alarm log according to the event data, and store the intrusion alarm log in a local database.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 7.

Images