Intrusion detection method and device for in-vehicle network, computer device and storage medium

Abstract

The application relates to the technical field of Internet of Vehicles, and discloses an intrusion detection method and device of a vehicle-mounted network, computer equipment and a storage medium, which are applied to a vehicle end. The method comprises the following steps: detecting traffic data from external equipment of the vehicle-mounted network; transmitting the traffic data to a firewall in a kernel space, and detecting whether there is a header abnormal situation in the traffic data by using a first rule preconfigured in the firewall; if the traffic data does not have the header abnormal situation, copying the traffic data to a user space, and detecting the traffic data by using a second rule preconfigured in the user space to obtain event data; generating corresponding intrusion alarm logs according to the event data, and storing the intrusion alarm logs in a local database. The application solves the problems of insufficient detection accuracy, single attack behavior processing mode and ineffective processing of encrypted data in the intrusion detection of the vehicle-mounted network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Vehicles, and in particular to an intrusion detection method and device for vehicle-mounted network, a computer device and a storage medium. BACKGROUND

[0002] With the rapid development of intelligent networked vehicles, in order to protect the safety of intelligent networked vehicles in the networked scene, a safety control strategy needs to be implemented to protect the networked safety. However, improper user operation or intruder intrusion can easily lead to changes in the safety control strategy, and therefore, intrusion detection is particularly important for vehicle networking. By monitoring the traffic information from outside the vehicle to the inside of the vehicle, it is detected whether the network attack is included, and the detection result is uploaded to the cloud, so that the major network security threats encountered by the networked vehicle can be understood in a timely manner.

[0003] At present, the existing vehicle-mounted network intrusion detection method has many deficiencies, such as insufficient detection precision, limited payload data detection, relying only on four tables and five chains for basic detection, and being difficult to deeply mine potential risks in the payload; the processing mode of attack behavior is single, only based on the analysis and interception of the header features of attack traffic data, and lacks diversified measures; encrypted data cannot be effectively processed, and security threats in encrypted traffic cannot be accurately identified. By monitoring the traffic information from outside the vehicle to the inside of the vehicle and uploading the detection result to the cloud, the network security threats can be understood to a certain extent, but there is still a lot of room for improvement in terms of detection precision, attack behavior processing and encrypted data processing. SUMMARY

[0004] Therefore, the embodiments of the present application provide an intrusion detection method and device for vehicle-mounted network, a computer device and a storage medium, to solve the problems of insufficient detection precision, single attack behavior processing mode and inability to effectively process encrypted data in vehicle-mounted network intrusion detection.

[0005] In a first aspect, the embodiments of the present application provide an intrusion detection method for vehicle-mounted network, applied to a vehicle end, and the method comprises:

[0006] detecting traffic data from an external device of the vehicle-mounted network;

[0007] transmitting the traffic data to a firewall in a kernel space, and detecting whether there is a header abnormality in the traffic data by using a first rule pre-configured in the firewall;

[0008] if there is no header abnormality in the traffic data, copying the traffic data to a user space, and detecting the traffic data by using a second rule pre-configured in the user space to obtain event data;

[0009] According to the event data, a corresponding intrusion alarm log is generated, and the intrusion alarm log is stored in a local database.

[0010] Further, the first rule preconfigured in the firewall is used to detect whether there is a header abnormal situation in the traffic data, including:

[0011] The traffic data is parsed to obtain target data corresponding to a preset level protocol;

[0012] The data source of the target data is identified, and it is judged whether the data source is an authorized device. If the data source is an unauthorized device, an interception operation is performed on the target data, and it is determined that there is a header abnormal situation in the traffic data;

[0013] It is detected whether there is a preset type of attack behavior in the target data. If there is a preset type of attack behavior, an interception operation is performed on the attack behavior based on a defense mechanism, and it is determined that there is a header abnormal situation in the traffic data.

[0014] Further, the interception operation on the attack behavior based on the defense mechanism includes:

[0015] If the attack behavior belongs to a denial of service attack type, the receiving frequency of the current service interface is adjusted to a preset frequency;

[0016] If the attack behavior belongs to a Ping flooding attack type, a request quantity threshold is set, and a Ping request exceeding the request quantity threshold in the target data is executed to clear the operation;

[0017] If the attack behavior belongs to a SYN flooding attack type, the resource link condition between the external device and the vehicle end is set to be that the external device is an authorized device and the handshake number with the vehicle end reaches a preset number;

[0018] If the attack behavior belongs to an XMAS attack type, TCP data packets with specific flag bits in the target data are identified, and an interception operation is performed on the TCP data packets with specific flag bits.

[0019] Further, the method further includes:

[0020] If the traffic data has a header abnormal situation, an abnormal information is generated;

[0021] The abnormal information is output to the kernel space of the vehicle end;

[0022] In the kernel space, the abnormal information is read to the user space by using a preset listener, and a corresponding intrusion alarm log is generated in the user space according to the abnormal information.

[0023] Further, the detecting the traffic data according to the second preconfigured rule in the user space to obtain event data comprises:

[0024] identifying encrypted data in the traffic data and an encryption type of the encrypted data;

[0025] querying a target decryption algorithm associated with the encryption type in a preset algorithm database, and decrypting the encrypted data according to the target decryption algorithm to obtain original data;

[0026] detecting the original data according to the second preconfigured rule to obtain event data.

[0027] Further, the detecting the traffic data according to the second preconfigured rule in the user space to obtain event data comprises:

[0028] parsing the original data to obtain a plurality of data packets and a protocol type corresponding to each data packet;

[0029] obtaining an attack keyword in the second rule and a preset behavior mode corresponding to the protocol type;

[0030] detecting whether the attack keyword exists in the data packet, and detecting whether a behavior mode of the data packet matches the preset behavior mode;

[0031] if the attack keyword exists in the data packet or the behavior mode of the data packet does not match the preset behavior mode, regarding the data packet as the event data.

[0032] Further, the generating an intrusion alert log according to the event data comprises:

[0033] analyzing the event data to obtain an association relationship between a plurality of attack behaviors and an attack link;

[0034] constructing an attack scene based on the association relationship and the attack link;

[0035] judging a risk level of the attack scene, and generating a corresponding intrusion alert log according to the risk level.

[0036] In a second aspect, an embodiment of the present application provides an intrusion detection device of a vehicle-mounted network, applied to a vehicle end, and the device comprises:

[0037] a detection module, configured to detect traffic data from an external device of the vehicle-mounted network;

[0038] The transmission module is configured to transmit the traffic data to a firewall in a kernel space, and detect whether there is a header abnormal condition in the traffic data by using a first rule preconfigured in the firewall.

[0039] The copying module is configured to copy the traffic data to a user space if there is no header abnormal condition in the traffic data, and detect the traffic data by using a second rule preconfigured in the user space to obtain event data.

[0040] The generating module is configured to generate an intrusion alarm log corresponding to the event data, and store the intrusion alarm log in a local database.

[0041] In a third aspect, an embodiment of the present application provides a computer device, including a memory and a processor, which are communicatively connected with each other, and the memory stores computer instructions, and the processor executes the computer instructions to perform the method in the first aspect or any of the corresponding embodiments.

[0042] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to make a computer execute the method in the first aspect or any of the corresponding embodiments.

[0043] The method provided by the embodiment of the present application has the following beneficial effects:

[0044] The method provided by the embodiment of the present application adopts a two-layer verification structure of a kernel space and a user space, transmits the traffic data to a firewall in the kernel space to detect a header abnormal condition, and copies the traffic data to the user space to detect by using a second rule if there is no header abnormal condition. This layered detection method breaks through the limitation of the existing iptables detection method which only relies on four tables and five chains for basic detection, can deeply access the payload part of the traffic data, and timely discovers potential risk information hidden therein, greatly improves the fineness of the vehicle-mounted network intrusion detection, and enhances the prevention ability against complex network attacks. In addition, the embodiment generates an intrusion alarm log corresponding to the event data, and stores the intrusion alarm log in a local database. Through this log recording method, the occurrence frequency of different types of threats can be counted, the source and influence range of the threats can be analyzed, and the problem that the network security threats cannot be comprehensively evaluated and analyzed is solved.

[0045] The method provided by the embodiment of the application can judge the abnormality of the header of the traffic data, enhance the detection accuracy and comprehensiveness by analyzing the traffic data, identifying the source and detecting the attack behavior; corresponding defense and interception operations are taken for different attacks, various attacks are effectively coped with, and the pertinence and effectiveness of the defense are improved; the processing exception information is generated when the header of the traffic data is abnormal, the intrusion alarm log is ensured to be converted in time, potential threats are discovered in time, the original data is detected in detail after the encrypted data is decrypted, the problem of encrypted data detection is solved, the detection range is expanded, and the probability and accuracy of detecting abnormal data packets are improved; the attack scene is constructed by analyzing the event data, the risk level is judged, the alarm log is generated, the log has more reference value, and the network security threat condition is accurately reflected.

[0046] The method provided by the embodiment of the application takes corresponding defense mechanisms for different types of attack behaviors, greatly improves the security of the vehicle-mounted network. When the attack behavior belongs to the denial of service attack type, the receiving frequency of the current service interface is adjusted to a preset frequency, which can effectively alleviate the service congestion caused by a large number of requests and ensure the availability of normal services. If it is a Ping flooding attack type, a request number threshold is set and a Ping request exceeding the threshold is executed to clear the operation, which can prevent too many Ping requests from occupying network resources and ensure the stable operation of the network. For the SYN flooding attack type, the resource link condition between the external device and the vehicle end is set as the external device being an authorized device and the number of handshakes reaching a preset number, which can effectively filter out malicious connection requests and protect the vehicle end system from the influence of SYN flooding attacks. When the attack behavior belongs to the XMAS attack type, the TCP data packet with a specific flag bit is identified and an interception operation is performed, which can timely prevent XMAS attacks and prevent attackers from using special flag bit data packets for malicious attacks.

[0047] The method provided by the embodiment of the application can greatly improve the detection accuracy by analyzing the original data to obtain a plurality of data packets and corresponding protocol types, and then detecting whether an attack keyword exists in each data packet and whether the behavior mode of the data packet matches the preset behavior mode corresponding to the protocol type. The multi-dimensional detection manner does not miss any potential abnormal situation. Then, when it is detected that the attack keyword exists in the data packet or the behavior mode does not match the preset behavior mode, the data packet is taken as event data, and the intrusion alarm log can be generated according to the event data and stored in the local database, which provides rich means and basis for further analyzing and processing the attack behavior, and is no longer limited to a single processing manner. In addition, the application can identify the encrypted data and the encryption type of the traffic data, then query the target decryption algorithm associated with the encrypted data in the preset algorithm database, decrypt the encrypted data to obtain the original data, so as to include the encrypted data in the detection range, and make the intrusion detection of the entire vehicle network more comprehensive and effective. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the description of the embodiments or the prior art. Obviously, the drawings described below are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0049] Figure 1 FIG. 1 is a flowchart of a vehicle network intrusion detection method according to some embodiments of the present application;

[0050] Figure 2 FIG. 2 is a flowchart of another vehicle network intrusion detection method according to some embodiments of the present application;

[0051] Figure 3 FIG. 3 is a structural block diagram of a vehicle network intrusion detection system according to an embodiment of the present application;

[0052] Figure 4 FIG. 4 is a structural block diagram of another vehicle network intrusion detection system according to an embodiment of the present application;

[0053] Figure 5 FIG. 5 is a structural block diagram of a vehicle network intrusion detection device according to an embodiment of the present application;

[0054] Figure 6 FIG. 6 is a hardware structure schematic diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0056] According to the embodiments of the present application, the vehicle-mounted network intrusion detection method and device, computer equipment and storage medium are provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0057] In the present embodiment, a vehicle-mounted network intrusion detection method is provided, which is applied to a vehicle end, Figure 1 is a flowchart of a vehicle-mounted network intrusion detection method according to the embodiments of the present application, as Figure 1 shown, the flow includes the following steps:

[0058] Step S11, detecting traffic data from external devices of the vehicle-mounted network.

[0059] In the embodiments of the present application, the intelligent connected vehicle will interact with external devices such as other vehicles, roadside devices or cloud services, and the traffic data between these external devices and the vehicle-mounted network contains various types of interaction information such as TCP, HTTP, IMAP, SSH, MQTT and TELNET. Since security threats may be hidden in these interaction information, by finding the traffic data of the external host accessing the intelligent connected vehicle, a foundation can be laid for subsequent judgment of whether the traffic exists security risks (such as header abnormal situation, attack behavior, etc.), so as to realize the intrusion detection of the intelligent connected vehicle system.

[0060] Step S12, transmitting the traffic data to the firewall in the kernel space, and using the first rule preconfigured in the firewall to detect whether there is a header abnormal situation in the traffic data.

[0061] It should be noted that the kernel space is the core area of the operating system, manages system resources, handles hardware interactions, and other underlying operations. The firewall is in the kernel space, is used for network security protection, and is preconfigured with rules for detecting and screening traffic data. The firewall has a specific network traffic detection architecture, which is composed of four tables and five chains. This structure aims to comprehensively and orderly detect and manage network traffic flowing into and out of the firewall. The four tables set rules for network connection status, packet filtering, and other aspects from different dimensions, while the five chains (including the original chain and the custom chain based on special routing processing) act like flow channels, allowing traffic to flow through these chains in a predetermined order. The rules on each chain are like checkpoints that screen and determine the traffic.

[0062] Specifically, the process of configuring the first rule in the firewall includes: first, clearly defining the functional requirements of the created custom chain, such as preventing specific types of attacks or managing specific network traffic. Second, determine the name of the custom chain according to the requirements, such as "my_input_rule", use the command "iptables-w-N[custom chain name]" to create a custom chain, which opens a specific rule processing area in the kernel space, laying the foundation for subsequent rule configuration. Third, determine which traffic to introduce into the custom chain for processing, use a command similar to "iptables-w-AINPUT-j[custom chain name]" to transfer incoming traffic (such as the incoming traffic corresponding to the INPUT chain) to the newly created custom chain for detection and processing according to custom rules. Finally, according to specific security requirements, add rules under the custom chain, such as for high-frequency ping attacks, use a command like "iptables-w-A[custom chain name]-picmp-mlimit--limit1 / s--limit-burst20-jNFLOG--nflog-group10--nflog-prefixFI REWALL-2" to add rules. These rules will detect and screen traffic data in the kernel space firewall mechanism.

[0063] In the embodiments of the present application, the first rule preconfigured in the firewall is used to detect whether there is a header abnormality in the traffic data, including the following steps A1-A3:

[0064] Step A1, parse the traffic data to obtain target data corresponding to a pre-set hierarchical protocol.

[0065] It should be noted that in the kernel space firewall, based on NetFilter, the iptables detection rule (the first rule) processes the L3 (network layer) and L4 (transport layer) layer target data of the seven-layer protocol, and needs to parse the relevant protocol data from the traffic data, such as the source IP and destination IP of the network layer IP datagram, the port number and flag bit of the transport layer TCP or UDP segment, and the like.

[0066] Specifically, there are two network traffic data parsing methods: protocol standard-based parsing: for IPv4 and IPv6 protocols, the information is obtained from the identification field according to the header structure; the source port, destination port, flag bit and other fields of the 20-byte header of the TCP protocol, and the source port, destination port and other fields of the 8-byte header of the UDP protocol are parsed. Tool and library parsing: using network packet capture tools such as Wireshark, with the help of pre-defined parsers, the data is parsed from the bottom layer to the high layer and displayed in a parsing tree; using programming language related libraries such as Python Scapy library to create, send, capture and parse network packets.

[0067] Step A2, identifying the data source of the target data, and determining whether the data source is an authorized device. If the data source is an unauthorized device, the target data is intercepted, and it is determined that there is a header abnormality in the traffic data.

[0068] Specifically, first, the target data (such as the source IP address in the IP datagram and the like) is used to determine from which device the data is sent. Second, the identified data source is compared with a pre-set authorized device list (which can be a white list stored locally, containing legal IP addresses or device identifiers and the like). If the data source is not in the authorized device list, the interception operation is performed, and it is determined that there is a header abnormality in the traffic data.

[0069] Step A3, detecting whether there is a preset type of attack behavior in the target data. If there is a preset type of attack behavior, the attack behavior is intercepted based on the defense mechanism, and it is determined that there is a header abnormality in the traffic data.

[0070] Specifically, based on the target data (containing network layer and transport layer related data), it is checked whether there is a preset type of attack behavior, such as judging Ping flood attack according to Ping request frequency, detecting SYN flood attack according to TCP connection SYN flag bit and connection establishment characteristics, and the like. If the attack behavior is detected, the corresponding defense mechanism is started to intercept, and then it is determined whether there is an abnormality in the header of the traffic data.

[0071] In the embodiments of the present application, the attack behavior is intercepted based on the defense mechanism, including the following steps A31-A34:

[0072] Step A31, if the attack behavior belongs to the denial of service attack type, the receiving frequency of the current service interface is adjusted to the preset frequency.

[0073] Specifically, when detecting the denial of service attack, the service interface receiving frequency is adjusted to the preset frequency to limit malicious traffic and protect the service and system security. The preset frequency is determined based on multiple factors, such as system performance test. When the system is stable and not easy to be attacked under the condition of receiving no more than 100 requests per second, the preset rate can be set to 100 / s. In technical implementation, the frequency can be adjusted through network configuration tools or security policy management modules. In Linux system and using iptables to manage network, the kernel parameters can be modified or the traffic control tools (such as tc) can be used to adjust, such as setting the receiving queue length and processing rate; the iptables extension module (such as ipset) can also be used to define rules to control traffic, limit or discard traffic that does not meet the preset frequency.

[0074] Step A32, if the attack behavior belongs to the Ping flood attack type, the request number threshold is set, and the Ping request exceeding the request number threshold in the target data is executed to clear the operation.

[0075] Specifically, when setting the Ping request number threshold, the normal use of the network (determined by historical data statistical analysis to determine a reasonable range) and the processing capacity of the network device (to ensure that the normal monitoring function is not affected) should be considered. For example, the device can process 1000 Ping requests per second and the normal number per second is not more than 50, and the threshold can be set to 100 per second. In Linux system using iptables to manage network, custom rules can be written to set the threshold, such as using the conntrack module of iptables to create a rule chain to process Ping requests and design a counter to count the number, and trigger the clearing operation when the threshold is reached. After identifying the Ping request exceeding the threshold, the iptables DROP target can be used to discard these request packets, such as adding rules in the rule chain to achieve this, to prevent Ping request flood attack. The Ping request exceeding the threshold can also be redirected to a specific module for analysis or recording (such as recording the attack source IP), which aims to prevent its spread in the network.

[0076] Step A33, if the attack behavior belongs to the SYN flood attack type, the resource link condition between the external device and the vehicle end is set as the external device being an authorized device and the handshake times with the vehicle end reaching a preset number.

[0077] Specifically, first, an authorized device list of the vehicle end system is established, containing identification information such as IP address, MAC address or digital certificate and stored in a local database or configuration file. When an external device is connected to the vehicle end, the identity is verified, and the identification is compared with the list through the network layer (checking the source IP address) or the transmission layer (such as the first handshake of TCP connection) to determine whether it is an authorized device.

[0078] The preset number of handshakes is determined according to the security policy and resource limitation of the vehicle end system. For example, considering the limited resources and SYN flooding attack prevention, it is tested that the three-way handshake is completed within 5 times (including retransmission) when a normal connection is made, and the preset number is set to 5. The vehicle end uses the network protocol stack mechanism or the security module to monitor the number of handshakes. For TCP connection, a counting function is added in the implementation of its connection state machine. The counting starts from receiving the SYN packet of the external device and is updated in the subsequent handshake process. If the number of handshakes exceeds the preset number, it is determined that there may be an attack or an anomaly. Only when the external device is an authorized device and the number of handshakes meets the standard, a complete resource link is allowed to be established, otherwise the vehicle end takes corresponding measures (unauthorized devices are rejected, and the connection is interrupted and the source IP is blocked for a period of time if the number of handshakes exceeds the preset number).

[0079] In step A34, if the attack behavior belongs to the XMAS attack type, TCP packets with specific flag bits in the target data are identified, and the TCP packets with specific flag bits are intercepted.

[0080] It should be noted that in the XMAS attack, the TCP packet is maliciously constructed, and the flag bit combination is special. The flag bits of normal TCP communication are set regularly, and the typical feature of the TCP packet of the XMAS attack is that the FIN (end connection flag), URG (urgent pointer flag) and PSH (push data flag) are all set to 1.

[0081] Specifically, when analyzing the TCP packet, the header is parsed according to the protocol standard, and the flag bits are read by bit operation (binary conversion and bit mask operation in programming) to determine whether they meet the XMAS attack characteristics. In the Linux system, when managing the network using iptables, rules are created (-ptcp combined with specific flag bit matching rules, such as FIN, URG and PSH set to 1, then DROP) and added to the INPUT or FORWARD chain for interception. It can also be intercepted through the DPI technology of the built-in firewall, IDS / IPS, and discarded or alarmed when it meets the characteristics.

[0082] The method provided by the embodiments of the present application adopts a targeted defense mechanism for different types of attack behaviors, greatly improving the security of the vehicle-mounted network. When the attack behavior belongs to the denial-of-service attack type, the receiving frequency of the current service interface is adjusted to a preset frequency, which can effectively alleviate the service congestion caused by a large number of requests and ensure the availability of normal services. If it is a Ping flooding attack type, a request number threshold is set and a Ping request exceeding the threshold is executed to clear the operation, which can prevent excessive Ping requests from occupying network resources and ensure the stable operation of the network. For the SYN flooding attack type, the resource link condition between the external device and the vehicle end is set as the external device being an authorized device and the number of handshakes reaching a preset number, which can effectively filter out malicious connection requests and protect the vehicle end system from the influence of SYN flooding attacks. When the attack behavior belongs to the XMAS attack type, the TCP data packet with a specific flag bit is identified and an interception operation is performed, which can timely prevent XMAS attacks and prevent attackers from using special flag bit data packets for malicious attacks.

[0083] In step S13, if the traffic data does not have a header abnormality, the traffic data is copied to the user space, and the traffic data is detected by using a second rule pre-configured in the user space to obtain event data.

[0084] It should be noted that the user space is a running environment provided by the operating system for user programs, has low permission and cannot directly access kernel resources, and can protect the system. The traffic data is initially in the kernel space, and the user space program cannot directly process it, and needs to be copied to the user space by using eBPF+pcap (filtering+interception) for efficient detection of the traffic data by using a pre-configured second rule to identify security problems to obtain event data. Specifically, the second rule is a snort application rule, and snort is an open source intrusion detection system. In the process, the user space application program uses the rule to deeply detect the data: receives the traffic data in the kernel space, decrypts the original data by using a snort unpacking module, transmits the original data to a rule module for detection in a responsibility chain mode, and transmits the detected event data to a log management module. The snort rule can comprehensively analyze the traffic data, identify security threats according to a preset rule, and is helpful for network security protection to timely discover abnormalities and respond.

[0085] In the embodiments of the present application, the traffic data is detected by using a second rule pre-configured in the user space to obtain event data, including the following steps B1-B3:

[0086] In step B1, encrypted data in the traffic data and an encryption type of the encrypted data are identified.

[0087] Specifically, when identifying the encrypted data of the traffic data and the encryption type thereof, first, a specific field in a protocol header of a data packet (such as an IPsec protocol identified in an IP header) is checked, the existence of encrypted data is determined and the encryption type is preliminarily inferred through a unique identifier of the protocol (such as an SSL / TLS handshake message); then, the encrypted data is analyzed for a data block feature (such as a feature of data encrypted by AES) and matched with an encryption algorithm library (such as a comparison of an RSA algorithm feature) to determine the encryption type.

[0088] Step B2, querying a target decryption algorithm associated with the encryption type in a preset algorithm database, and decrypting the encrypted data by using the target decryption algorithm to obtain original data.

[0089] As an example, it is assumed that the encrypted data of the traffic data is identified as a TLS1.2 algorithm, which includes a combination of an RSA public key and AES symmetric encryption. The corresponding decryption algorithm is found in the preset algorithm library, the RSA encrypted part (if it is a result of AES symmetric key encryption) is decrypted by using a private key to obtain an AES symmetric key, the AES encrypted data is decrypted block by block according to the decryption algorithm rule, all decrypted blocks are combined, and the original data is obtained.

[0090] Step B3, detecting the original data according to a second rule configured in advance to obtain event data.

[0091] In the embodiments of the present application, step B3 includes the following steps B31-B34.

[0092] Step B31, parsing the original data to obtain a plurality of data packets and a protocol type corresponding to each data packet.

[0093] Specifically, the original data is composed of multiple parts, which can be split into multiple data packets by parsing. In the process of splitting, the protocol type corresponding to each data packet is determined. This operation is the basis for subsequent rule detection according to different protocol types, because different protocol types have different security risk characteristics and behavior patterns, and the protocol type is helpful to more accurately detect whether there is a security threat related content in the data packet.

[0094] Step B32, obtaining an attack keyword and a preset behavior mode corresponding to the protocol type in the second rule.

[0095] Specifically, after the data packets and the protocol type are obtained by parsing the original data, the detection key information is obtained from the second rule configured in advance, including obtaining the attack keyword (such as "malware", "exploit" and other security threat related content) and the preset behavior mode corresponding to the protocol type of the data packet (different protocol types have their own normal or potential attack behavior judgment modes predefined based on security policies).

[0096] Step B33, detecting whether the attack keywords exist in the data packet and detecting whether the behavior mode of the data packet matches the preset behavior mode.

[0097] Specifically, two detections are performed for each data packet: one is detecting whether the attack keywords obtained in step B32 exist in the data packet, for example, checking whether the data content in the data packet contains specific attack keywords such as "malware"; the other is detecting whether the behavior mode of the data packet matches the preset behavior mode obtained in step B32, that is, judging whether the behavior of the data packet conforms to the normal or security policy conforming behavior mode under the corresponding protocol type (such as TCP or UDP) of the data packet, so as to determine whether the data packet has potential security risks or abnormal situations.

[0098] Step B34, if the attack keywords exist in the data packet or the behavior mode of the data packet does not match the preset behavior mode, the data packet is taken as event data.

[0099] Specifically, if the data packet satisfies any one of the two conditions, that is, the attack keywords exist in the data packet or the behavior mode of the data packet matches the preset behavior mode, the data packet is determined to have potential security risks or abnormal situations, and thus the data packet is taken as event data. The event data can be processed by subsequent modules (such as a log management module) to record and analyze security events.

[0100] The method provided in the embodiments of the present application, when detecting the original data, obtains a plurality of data packets and corresponding protocol types by analyzing the original data, and then for each data packet, on one hand, detects whether the attack keywords exist, and on the other hand, detects whether the behavior mode matches the preset behavior mode corresponding to the protocol type. This multi-dimensional detection manner greatly improves the detection precision and does not miss any potential abnormal situation. Then, when detecting that the attack keywords exist in the data packet or the behavior mode does not match the preset behavior mode, the data packet is taken as event data. Subsequently, the intrusion alarm log can be generated according to the event data and stored in the local database, which provides rich means and basis for further analyzing and processing the attack behavior, and is no longer limited to a single processing manner. In addition, the application can also identify the encrypted data and the encryption type in the traffic data, then query the target decryption algorithm associated with the encrypted data in the preset algorithm database, and decrypt the encrypted data to obtain the original data, so as to include the encrypted data in the detection range, so that the intrusion detection of the entire vehicle-mounted network is more comprehensive and effective.

[0101] In the embodiments of the present application, the method further includes the following steps C1-C3:

[0102] Step C1, if the traffic data has a header abnormal situation, generating abnormal information.

[0103] Specifically, the NetFilter and iptables detection rules are used to detect attacks on L3 and L4 layer traffic data (focus on the header features), and abnormal traffic data headers generate abnormal information, which is used to record and identify abnormalities for subsequent processing (output, generate alarm logs), and the abnormal information includes abnormal types, source and destination IP addresses, port numbers (if related), timestamps, etc., to locate and analyze the source and nature of the abnormality.

[0104] Step C2, output the abnormal information to the kernel space of the vehicle end.

[0105] Specifically, the kernel space is responsible for system-level operations and resource management. Outputting abnormal information to the kernel space allows related kernel modules (such as security monitoring and log management modules) to obtain this information for in-depth analysis or correlation with other security data. In the vehicle end network security detection architecture, the kernel space processes system-level events, which is in line with the principles of layered architecture and can clearly separate kernel and user functions. The kernel space can use its own functional resources to uniformly manage and preprocess abnormal information, and then pass the results to the user space for generating intrusion alert logs and other advanced application operations.

[0106] Step C3, in the kernel space, use the preset listener to read the abnormal information to the user space, and generate the corresponding intrusion alert log in the user space according to the abnormal information.

[0107] Specifically, the preset listener is an information exchange component between the kernel and the user space, which can identify kernel-specific information. Because the operating system isolates the two spaces, the kernel has core content, and without a listener, the user space directly accessing will break the isolation mechanism, causing system crashes and data leaks. Therefore, the listener can safely transfer information within the permission.

[0108] Step S14, generating a corresponding intrusion alert log according to the event data, and storing the intrusion alert log in the local database.

[0109] In the embodiments of the present application, generating a corresponding intrusion alert log according to the event data includes the following steps D1-D3:

[0110] Step D1, analyze the event data to obtain the correlation between multiple attack behaviors and the attack link.

[0111] Specifically, the event data contains multiple independent attack behaviors, which are inherently related. When analyzing, the characteristics of the attack behaviors, such as different types of attack attempts at different times (such as port scanning followed by malicious access to specific services), are analyzed to determine the correlation (causal or logical relationship) by analyzing the order of attack behaviors, source and destination addresses, ports, etc. and then obtain the attack link from the initial attack point to the final target.

[0112] Step D2, based on the correlation and attack link, build the attack scene.

[0113] Specifically, after determining the correlation and attack link of the attack behavior, the attack scene is built, which can better evaluate the attack nature and impact. The attack behaviors are combined according to the logical order and mutual relationship to build the scene, such as the attack link is external network scanning internal border firewall port, exploiting open port to intrude internal server and then expanding horizontally, the built scene contains elements such as attacker, firewall, server, expansion target, etc., which can clearly present the attack path, target and means.

[0114] Step D3, judge the risk level of the attack scene, and generate the corresponding intrusion alarm log according to the risk level.

[0115] Specifically, first, the risk level of the attack scene is judged based on multiple factors (attack type, target, progress degree, etc.), such as the risk of password brute force cracking is low, the risk of exploiting zero-day vulnerabilities is high; the risk of attacking key business servers is higher than that of ordinary servers; the risk of data acquisition intrusion is higher than that of probing attack. Then, according to the risk level, the intrusion alarm log is generated, the log of high risk is more detailed and contains urgent prompt and response suggestion, the log of low risk is relatively simple, and the focus is on recording attack behavior for statistical analysis.

[0116] As an example, as shown in Figure 2 , first, the in-out stack data (including multiple protocol type traffic data) flows into the firewall four-table five-chain for detection, the detection basis is the iptables detection rule (first rule) of NetFilter to judge whether the header feature is abnormal. If abnormal, based on eBPF+pcap, the traffic data is copied to the user space, the snort rule (second rule) is applied in the user space for deep detection of the data part and generation of detection alarm log; if not abnormal, NFlog is generated. Finally, the log management module uploads or archives according to the strategy.

[0117] The method provided by the embodiment of the application first detects traffic data from an external device of the in-vehicle network, detects in different spaces using different rules, increases the level and dimension of detection, and improves the detection accuracy. When the traffic data is transmitted to the firewall in the kernel space, the first rule configured in advance is used to detect the header abnormal situation, so that the potential abnormal traffic source can be found in time. If there is no header abnormal situation, the traffic data is copied to the user space, and the second rule configured in advance is used for further detection. This detection method in multiple stages and spaces greatly improves the comprehensiveness and accuracy of detection. Secondly, the attack behavior is no longer a single processing method. After detecting the abnormal traffic data, the application generates the corresponding intrusion alert log according to the generated event data, and stores it in the local database, which provides a basis for subsequent analysis and processing, and enriches the processing method of the attack behavior. Finally, for encrypted data, the application does not directly process the encrypted data itself, but analyzes the behavior mode of the traffic from the aspects of the header abnormal situation of the traffic data and the rule detection in multiple spaces. Even if the data is encrypted, abnormal traffic can be found to a certain extent, so that the detection difficulty caused by encrypted data can be effectively handled.

[0118] Figure 3 is a structural schematic diagram of an intrusion detection system of an in-vehicle network according to the embodiment of the application, as shown in Figure 3 , the system comprises a vehicle end 100, a pipe end 200 and a cloud end 300.

[0119] The vehicle end 100 is configured to execute an intrusion detection method of the in-vehicle network, which comprises detecting traffic data from an external device of the in-vehicle network, transmitting the traffic data to a firewall in the kernel space, using the first rule configured in advance in the firewall to detect whether there is a header abnormal situation in the traffic data, copying the traffic data to the user space if there is no header abnormal situation and using the second rule configured in advance in the user space to detect the traffic data to obtain event data, generating the corresponding intrusion alert log according to the event data and storing the intrusion alert log in the local database, generating abnormal information if there is a header abnormal situation and outputting the abnormal information to the kernel space, using a preset listener in the kernel space to read the abnormal information to the user space and generating the corresponding intrusion alert log according to the abnormal information in the user space, and the like.

[0120] The pipe end 200 is configured to communicate with the vehicle end 100 and the cloud end 300, manage the data transmission between the vehicle end 100 and the cloud end 300, for example, preliminarily screen and arrange the data uploaded by the vehicle end 100, forward the intrusion alert log and other related data of the vehicle end 100 to the cloud end 300, and issue the related configuration information, update rules and the like of the cloud end 300 to the vehicle end 100.

[0121] The cloud 300 is configured to store and analyze data such as intrusion alert logs from the vehicle terminals 100, mine potential network security threat trends through big data analysis and other techniques, provide support such as rule updates and security policy optimization for the vehicle terminals 100, and remotely monitor and manage the network security status of the vehicle terminals 100.

[0122] Specifically, as shown in FIG. 1, the vehicle terminal 100 includes a system initialization module 101, a configuration management module 102, a rule module 103, and a log management module 104. Figure 4

[0123] The system initialization module 101 is configured to initialize the hardware and software environment required by the vehicle network intrusion detection system when the vehicle terminal 100 is started, such as loading network drivers, initializing memory space, starting related processes, and the like, to ensure that the system can operate normally and perform subsequent intrusion detection work.

[0124] The configuration management module 102 is configured to manage various configuration information of the vehicle terminal 100, including configuration parameters of the firewall first rule and the user space second rule, related parameters for communication with external devices, and configuration parameters required for the operation of each module in the intrusion detection system, and can update and adjust these configuration information as needed.

[0125] The rule module 103 is configured to formulate and store the first rule and the second rule for intrusion detection.

[0126] The log management module 104 is configured to receive and manage security logs during the intrusion detection process.

[0127] Specifically, the rule module 103 includes a first rule (IPtables rule based on L3 and L4 layers of seven-layer protocol) and a second rule (self-defined snort rule based on deep packet inspection of L5 and L7 layers of seven-layer protocol), wherein the seven-layer protocol includes L1 physical layer, L2 data link layer, L3 network layer, L4 transport layer, L5 session layer, L6 presentation layer, and L7 application layer.

[0128] The first rule is configured to detect traffic data in the firewall, specifically including parsing the traffic data to obtain target data corresponding to a preset layer protocol (L3 and L4 layers), identifying the data source of the target data to determine whether it is an authorized device, if it is an unauthorized device, intercepting the target data to determine that the traffic data has a header abnormality, detecting whether there is a preset type of attack behavior in the target data, if there is, performing an interception operation on the attack behavior based on a defense mechanism and determining that the traffic data has a header abnormality.

[0129] ​The second rule is used for detecting the decrypted original data in the user space, specifically including parsing the original data to obtain a plurality of data packets and a protocol type (L5, L7 layer) corresponding to each data packet, obtaining an attack keyword in the second rule and a preset behavior mode corresponding to the protocol type, detecting whether the attack keyword exists in the data packet and whether the behavior mode of the data packet matches the preset behavior mode, and regarding the data packet as event data if the attack keyword exists or the behavior mode matches.

[0130] Specifically, the log management module 104 includes a system log archiving manager, an Iptables log listener, and a snort detection log manager.

[0131] The system log archiving manager is used for archiving management of system logs in the running process of the vehicle end 100, including log storage, classification, backup, and the like, to ensure the integrity and queryability of the system logs, so as to analyze and troubleshoot the system running status subsequently.

[0132] The Iptables log listener is used for listening to log information generated by the firewall (based on the IPtables rule) when detecting traffic data, and acquiring relevant log content in time when it is detected that traffic data triggers the firewall rule, so as to analyze subsequently or interact with other modules.

[0133] The snort detection log manager is used for managing logs generated based on snort rule detection, including recording detailed information in the detection process, such as event data detected, detection time, and data packets involved, and analyzing and arranging these logs to generate an intrusion alert log and the like.

[0134] In the embodiment, a vehicle network intrusion detection device is also provided, which is used to implement the above-described embodiments and preferred embodiments, and details are not repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware is also possible and is contemplated.

[0135] The embodiment provides a vehicle network intrusion detection device, which is applied to a vehicle end, as shown in the following figure, and includes: Figure 5

[0136] The detection module 51 is used for detecting traffic data from an external device of the vehicle network.

[0137] The transmission module 52 is used for transmitting the traffic data to the firewall in the kernel space, and detecting whether there is a header abnormality in the traffic data by using the first rule preconfigured in the firewall. ​

[0138] copying module 53, configured to copy the traffic data to the user space if the traffic data does not have the header abnormality, and detecting the traffic data by using the second rule preconfigured in the user space to obtain event data;

[0139] generating module 54, configured to generate an intrusion alert log corresponding to the event data, and storing the intrusion alert log in a local database.

[0140] In an optional embodiment of the present application, the transmission module 52 is configured to parse the traffic data to obtain target data corresponding to a preset level protocol, identify a data source of the target data, and determine whether the data source is an authorized device. If the data source is an unauthorized device, the transmission module 52 is configured to perform an interception operation on the target data, and determine that the traffic data has the header abnormality. The transmission module 52 is further configured to detect whether the target data has a preset type of attack behavior, and perform an interception operation on the attack behavior based on a defense mechanism if the target data has the preset type of attack behavior, and determine that the traffic data has the header abnormality.

[0141] In an optional embodiment of the present application, the transmission module 52 is configured to adjust a receiving frequency of a current service interface to a preset frequency if the attack behavior belongs to a denial of service attack type. The transmission module 52 is further configured to set a request quantity threshold, and perform a clearing operation on a Ping request in the target data that exceeds the request quantity threshold if the attack behavior belongs to a Ping flooding attack type. The transmission module 52 is further configured to set a resource link condition between an external device and the vehicle end as that the external device is an authorized device and a handshake number between the external device and the vehicle end reaches a preset number if the attack behavior belongs to a SYN flooding attack type. The transmission module 52 is further configured to identify a TCP packet with a specific flag bit in the target data if the attack behavior belongs to an XMAS attack type, and perform an interception operation on the TCP packet with the specific flag bit.

[0142] In an optional embodiment of the present application, the device further includes a reading module configured to generate abnormality information if the traffic data has the header abnormality, output the abnormality information to a kernel space of the vehicle end, read the abnormality information to a user space by using a preset listener in the kernel space, and generate an intrusion alert log corresponding to the abnormality information in the user space.

[0143] In an optional embodiment of the present application, the copying module 53 is configured to identify encrypted data in the traffic data and an encryption type of the encrypted data, query a target decryption algorithm associated with the encryption type in a preset algorithm database, and decrypt the encrypted data by using the target decryption algorithm to obtain original data. The copying module 53 is further configured to detect the original data by using a second rule preconfigured in the user space to obtain event data.

[0144] In an optional embodiment of the present application, the copy module 53 is used to parse the original data to obtain multiple data packets and the protocol type corresponding to each data packet; obtain the attack keyword in the second rule and the preset behavior pattern corresponding to the protocol type; detect whether there is an attack keyword in the data packet, and detect whether the behavior pattern of the data packet matches the preset behavior pattern; if there is an attack keyword in the data packet, or whether the behavior pattern of the data packet matches the preset behavior pattern, then the data packet is used as event data.

[0145] In an optional embodiment of the present application, a generation module 54 is used to analyze event data to obtain correlation relationships and attack links between multiple attack behaviors; construct attack scenarios based on the correlation relationships and attack links; determine the risk level of the attack scenario, and generate corresponding intrusion alarm logs based on the risk level.

[0146] See also Figure 6 , Figure 6 is a structural diagram of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of a GUI on an external input / output device (such as, a display device coupled to an interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system).

[0147] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0148] The memory 20 stores instructions that can be executed by at least one processor 10, so as to enable at least one processor 10 to execute the method shown in the above embodiment.

[0149] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system and applications required by at least one function. The data storage area can store data created by the computer device according to the presentation of a small program landing page, and the like. In addition, the memory 20 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some optional embodiments, the memory 20 can optionally include a memory disposed remotely relative to the processor 10, and these remote memories can be connected to the computer device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0150] The memory 20 can include a volatile memory, such as a random access memory, and can also include a non-volatile memory, such as a flash memory, a hard disk, or a solid-state disk. The memory 20 can also include a combination of the above-mentioned kinds of memories.

[0151] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0152] The embodiments of the present application also provide a computer readable storage medium. The above-mentioned method according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or stored in a remote storage medium or a non-transitory machine readable storage medium and downloaded to a local storage medium through network downloading, so that the method described herein can be processed by such software on a storage medium using a general-purpose computer, a special-purpose processor, or programmable or special-purpose hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid-state disk, and the like. Further, the storage medium can also include a combination of the above-mentioned kinds of memories. It can be understood that the computer, the processor, the microprocessor controller, or the programmable hardware includes a storage component that can store or receive software or computer code, and when the software or computer code is accessed and executed by the computer, the processor, or the hardware, the method shown in the above embodiments is implemented.

[0153] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A vehicle network intrusion detection method, characterized in that: Applied to the vehicle side, the method includes: Detect traffic data from external devices in the vehicle network; Transmitting the traffic data to a firewall in a kernel space, and detecting whether there is a header anomaly in the traffic data using a first rule pre-configured in the firewall; If the traffic data does not have a header anomaly, copying the traffic data to a user space, and detecting the traffic data using a second rule pre-configured in the user space to obtain event data; Generate a corresponding intrusion alarm log according to the event data, and store the intrusion alarm log in a local database; The use of the first rule pre-configured in the firewall to detect whether there is a header anomaly in the traffic data includes: parsing the traffic data to obtain target data corresponding to a preset layer protocol; identifying the data source of the target data and determining whether the data source is an authorized device; if the data source is an unauthorized device, performing an interception operation on the target data and determining whether there is a header anomaly in the traffic data; detecting whether there is a preset type of attack behavior in the target data; if there is a preset type of attack behavior, performing an interception operation on the attack behavior based on a defense mechanism and determining whether there is a header anomaly in the traffic data; The detecting the traffic data using the second rule pre-configured in the user space to obtain event data includes: identifying encrypted data in the traffic data and the encryption type of the encrypted data; querying a preset algorithm database for a target decryption algorithm associated with the encryption type, and decrypting the encrypted data using the target decryption algorithm to obtain original data; detecting the original data according to the pre-configured second rule to obtain event data; Among them, the detecting the original data according to the pre-configured second rule to obtain event data includes: parsing the original data to obtain multiple data packets and the protocol type corresponding to each of the data packets; obtaining the attack keywords in the second rule and the preset behavior pattern corresponding to the protocol type; detecting whether the attack keywords exist in the data packet, and detecting whether the behavior pattern of the data packet matches the preset behavior pattern; if the attack keywords exist in the data packet, or the behavior pattern of the data packet matches the preset behavior pattern, then using the data packet as the event data.

2. The method according to claim 1, characterized in that The intercepting operation on the attack behavior based on the defense mechanism includes: If the attack behavior is a denial of service attack, the receiving frequency of the current service interface is adjusted to the preset frequency; If the attack behavior is a Ping flood attack type, a request quantity threshold is set, and a Ping request exceeding the request quantity threshold in the target data is cleared; If the attack behavior belongs to the SYN flood attack type, the resource link condition between the external device and the vehicle end is set to that the external device is an authorized device and the number of handshakes with the vehicle end reaches a preset number; If the attack behavior belongs to the XMAS attack type, the TCP data packet with a specific flag bit in the target data is identified, and an interception operation is performed on the TCP data packet with the specific flag bit, wherein the specific flag bit includes: FIN, URG, PSH.

3. The method according to claim 1, characterized in that The method further comprises: If there is an abnormality in the header of the traffic data, abnormal information is generated; Outputting the abnormal information to the kernel space of the vehicle end; In the kernel space, a preset listener is used to read the abnormal information into the user space, and a corresponding intrusion alarm log is generated in the user space according to the abnormal information.

4. The method according to claim 1, wherein Generating a corresponding intrusion alarm log according to the event data includes: Analyze the event data to obtain correlations between multiple attack behaviors and attack links; Constructing an attack scenario based on the association relationship and the attack link; Determine the risk level of the attack scenario and generate a corresponding intrusion alarm log based on the risk level.

5. An intrusion detection device for an in-vehicle network, applied to a vehicle, characterized in that: The device comprises: A detection module, used to detect traffic data from external devices on the vehicle network; a transmission module, configured to transmit the traffic data to a firewall in a kernel space, and detect whether there is a header anomaly in the traffic data using a first rule pre-configured in the firewall; a copy module, configured to copy the traffic data to a user space if there is no abnormal header condition in the traffic data, and detect the traffic data using a second rule pre-configured in the user space to obtain event data; A generating module, configured to generate a corresponding intrusion alarm log according to the event data, and store the intrusion alarm log in a local database; The transmission module is used to parse the traffic data to obtain target data corresponding to a preset layer protocol; identify the data source of the target data and determine whether the data source is an authorized device. If the data source is an unauthorized device, intercept the target data and determine whether there is a header anomaly in the traffic data; detect whether there is a preset type of attack behavior in the target data. If there is a preset type of attack behavior, intercept the attack behavior based on a defense mechanism and determine whether there is a header anomaly in the traffic data; The copy module is configured to identify encrypted data in the traffic data and an encryption type of the encrypted data; query a preset algorithm database for a target decryption algorithm associated with the encryption type, and decrypt the encrypted data using the target decryption algorithm to obtain original data; and detect the original data according to the pre-configured second rule to obtain event data; The copy module is used to parse the original data to obtain multiple data packets and the protocol type corresponding to each data packet; obtain the attack keyword in the second rule and the preset behavior pattern corresponding to the protocol type; detect whether the attack keyword exists in the data packet, and detect whether the behavior pattern of the data packet matches the preset behavior pattern; if the attack keyword exists in the data packet, or the behavior pattern of the data packet matches the preset behavior pattern, then use the data packet as the event data.

6. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 4 by executing the computer instructions.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 4.

Images