Security data fusion method and device for intelligent networked automobile and electronic equipment

Abstract

The invention discloses a safety data fusion method and device for an intelligent network connection automobile and electronic equipment, and the method comprises the steps: obtaining safety event data uploaded by a plurality of intrusion detection defense systems, and extracting target information in the safety event data; performing preliminary fusion on the target information, so that the target information is classified according to a first preset rule, and obtaining data layer fusion data; and fusing the data layer fusion data into feature layer fusion data according to a second preset rule, and uploading the feature layer fusion data and the data layer fusion data to a background operation system. According to the invention, the data acquired by various intrusion detection systems are fused, so that the data have multidimensionality, background operation personnel can be helped to quickly and accurately position the cause of the security event, the operation efficiency is greatly improved, and the number of security analysis events is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the field of data fusion, and in particular to a method, device and electronic equipment for secure data fusion of intelligent networked vehicles. Background Art

[0002] With the continuous development of automobile intelligence and networking, today's smart cars have many advanced functions and applications such as autonomous driving, OTA upgrades, and voice recognition. At the same time, the attack surface of automotive network security has become more extensive. Currently, the most vulnerable modules of intelligent connected cars include: infotainment system (IVI), vehicle networking communication terminal (T-BOX), vehicle gateway (Gateway), unified diagnostic service (UDS), on-board diagnostics (OBD), advanced driver assistance (ADAS), charging network system (Charing system), etc.

[0003] When an attack occurs, each defense system detects the attack and uploads the security incident to the backend. The operator then analyzes the security incident received on the cloud and formulates defense strategies. However, the common security defense systems on the market are relatively independent of each other. Backend operators need to view and analyze various security incidents separately in the backend, which requires backend operators to spend a lot of time to handle a large number of information security incidents, and the analysis efficiency is not high. Summary of the invention

[0004] In response to the above technical problems, the present invention provides a security data fusion method, device and electronic equipment for intelligent connected vehicles, which can reduce the number of security incidents analyzed by background operations and improve operational efficiency.

[0005] A first aspect of the present invention provides a security data fusion method for intelligent connected vehicles, comprising: obtaining security event data uploaded by multiple intrusion detection and defense systems, and extracting target information in the security event data; preliminarily fusing the target information so that the target information is classified according to a first preset rule to obtain data layer fusion data; fusing the data layer fusion data into feature layer fusion data according to a second preset rule, and uploading the feature layer fusion data and the data layer fusion data to a background operation system.

[0006] In a possible implementation, preliminarily fusing the target information so that the target information is classified according to a first preset rule to obtain data layer fusion data includes: The target information with timestamps within a preset range is preliminarily fused to obtain time domain fusion data; and / or the target information with consistent attack targets is preliminarily fused to obtain target domain fusion data.

[0007] In a possible implementation, the data layer fusion data is fused into feature layer fusion data according to a second preset rule, including: fusing the data determined to belong to the same intrusion scene in the time domain fusion data into the feature layer fusion data according to the intrusion behavior; and fusing the target domain fusion data of the attack targets with an associated relationship into the feature layer fusion data.

[0008] In a possible implementation, fusing the data layer fusion data into feature layer fusion data according to a second preset rule includes: combining according to data input relationships of the data layer fusion data, and fusing the data layer fusion data having a combination relationship into feature layer fusion data.

[0009] In a possible implementation, the data layer fusion data are combined according to the data input relationship, and the data layer fusion data with the combination relationship are fused into feature layer fusion data, including: if the data input relationship of the data layer fusion data is complementary, then the data layer fusion data with the complementary input relationship is fused into the first feature layer fusion data; if the data input relationship of the data layer fusion data is redundant, then the data layer fusion data with the redundant input relationship is fused into the second feature layer fusion data.

[0010] In a possible implementation, if the data input relationship of the data layer fusion data is complementary, the data layer fusion data with a complementary input relationship is fused into first feature layer fusion data, including: if the data layer fusion data includes the DOS attack data output by HIDPS and the DOS attack data output by NIDPS, the DOS attack data output by HIDPS and the DOS attack data output by NIDPS are fused into first feature layer fusion data; or if the data layer fusion data includes the update failure data output by OTA and the VSMC output data, the OTA output update failure data and the VSMC output data are fused into first feature layer fusion data.

[0011] In a possible implementation, if the data input relationship of the data layer fusion data is redundant, the data layer fusion data with redundant input relationship is fused into second feature layer fusion data, including: if the data layer fusion data includes login attack data output by HIDPS and login attack data output by NIDPS, the login attack data output by HIDPS and the login attack data output by NIDPS are fused into second feature layer fusion data; or if the data layer fusion data includes message attack data output by CANIDPS and message attack data output by SecOC, the message attack data output by CANIDS and the message attack data output by SecOC are fused into first feature layer fusion data.

[0012] The second aspect of the present invention provides a security data fusion device for an intelligent connected vehicle, comprising: a data acquisition module, used to acquire security event data uploaded by multiple intrusion detection and defense systems, and extract target information in the security event data; a first data fusion module, used to preliminarily fuse the target information, so that the target information is classified according to a first preset rule to obtain data layer fusion data; a second data fusion module, used to fuse the data layer fusion data into feature layer fusion data according to a second preset rule, and upload the feature layer fusion data and the data layer fusion data to a background operation system.

[0013] According to a third aspect of the present invention, there is provided an electronic device, comprising: At least one processor; and at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the safety data fusion method for intelligent connected vehicles as described in the first aspect of the embodiment of the present invention.

[0014] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a computer, the method for secure data fusion for intelligent connected vehicles as described in the first aspect of the embodiment of the present invention is executed.

[0015] The present invention integrates the data obtained by various intrusion detection systems to make the data multi-dimensional, which can help back-end operation personnel quickly and accurately locate the cause of security incidents, greatly improve operational efficiency, and effectively reduce the number of security analysis events. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The present invention is a flowchart of a method for fusion of safety data for intelligent connected vehicles in an embodiment of the present invention.

[0017] Figure 2 The figure is a flow chart of another method for fusion of safety data for intelligent connected vehicles in an embodiment of the present invention.

[0018] Figure 3 The figure is a flow chart of another method for fusion of safety data for intelligent connected vehicles in an embodiment of the present invention.

[0019] Figure 4 The present invention is a block diagram of a safety data fusion device for an intelligent connected vehicle in an embodiment of the present invention.

[0020] Figure 5 FIG. 1 is a schematic structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0022] It should be understood that the terms "first", "second", and "third" etc. in the claims, specifications, and drawings of the present disclosure are used to distinguish different objects rather than to describe a specific order. The terms "include" and "comprise" used in the specification and claims of the present disclosure indicate the presence of the described features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or their collections. It should also be understood that the terms used in this disclosure specification are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure.

[0023] In the prior art, common attack methods for the most vulnerable modules include the following: (1) Maliciously logging into the component system through the USB port or ADB debugging port, downloading malware or applications, illegally elevating or degrading the process, and tampering with the content of key files; (2) Replay attacks on bus communications through OBD or UDS, tampering with communication data, and then controlling the controller to perform operations such as braking or turning on and off warning lights; (3) Through Wi-Fi, hotspots, Ethernet, etc., conduct DOS attacks, Flood attacks, malformed message attacks, firewall attacks, malicious domain name access, system service detection, etc. Currently, vehicle component systems such as T-Box, Gateway, ADS, IVI, etc. are likely to be attacked in this way; (4) Some important parts of intelligent connected vehicles are equipped with security keys or store sensitive data. These security keys are used to implement signature, signature verification, key distribution, update, symmetric or asymmetric encryption and decryption functions. Accordingly, there are risks of key leakage, key tampering, and sensitive information leakage. (5) Attacking sensors through lidar interference, camera spoofing, GPS spoofing, sensor data leakage, etc. Such attacks usually occur on sensor-equipped systems, such as gateways, ADAS, etc. (6) Intelligent connected vehicles support OTA functions, which means that for all parts that support OTA functions, there are possible attacks such as key tampering, upgrade failure, and upgrade package leakage.

[0024] Corresponding to the above attacks, common detection and defense systems include the following: (1) HIDPS (Host Intrusion Detection and Prevention System), which is often deployed in core components to detect possible intrusions and attacks on the host. It can effectively detect attacks such as malicious login to the Adb serial port, process privilege escalation and demotion, and file tampering. (2) CANIDPS (Bus Intrusion Detection and Prevention System) / SecOC (Secure Communication), both of which are mainly used to detect anomalies caused by some attacks on the bus, such as data tampering, replay attacks, etc.; (3) NIDPS (Network Intrusion Detection and Prevention System), which is mainly used for network-related intrusion detection and prevention. It can detect various network-related attacks such as DOS attacks, flood attacks, malformed message attacks, firewall attacks, etc. (4) VSMC (Security Master Control System), which is mainly used for the generation, storage, update, and distribution of security keys. It can also be used to store important sensitive information of components. It can prevent risks such as key tampering, key leakage, and sensitive information leakage. (5) SIDPS (Sensor Intrusion Detection and Prevention System), which is mainly used for intrusion detection and prevention on sensors and can effectively detect attacks such as GPS spoofing, camera spoofing, sensor leakage, etc. (6) FOTA Master. In the OTA system, the FOTA Master can receive the OTA upgrade results of each FOTA slave, such as upgrade success, signature verification failure, and other information, and pass it to the background.

[0025] Since the above-mentioned security defense systems are relatively independent, the cloud receives various information security incidents reported by multiple intrusion defense systems of multiple parts on multiple vehicle models every day. Correspondingly, the back-end operators need to view and analyze various security incidents in the background. Considering that the back-end operators are responsible for the operation and maintenance of all vehicle models, they need to spend a lot of time to handle a large number of information security incidents. Back-end operators need to view the information security incidents uploaded by each type of security defense system under different vehicle models, analyze the effective information, identify the real malicious attacks from a large number of security incidents, and then formulate and take corresponding defense measures. There is no doubt that this means a huge workload for operators.

[0026] In response to the above problem, the present invention proposes to effectively integrate the data of various information security events on the entire vehicle, thereby helping back-end operators to efficiently identify real malicious attacks, achieve the purpose of optimizing intrusion detection, and significantly improve the efficiency of back-end security operations.

[0027] See also Figure 1 The present invention provides a security data fusion method for an intelligent connected vehicle, comprising the following steps.

[0028] Step 100: Acquire security event data uploaded by multiple intrusion detection and prevention systems, and extract target information from the security event data.

[0029] In the above detection and defense strategy, when an intrusion is detected, a variety of data related to security events will be detected, and then key information in the security events will be extracted. The data that can be extracted from different types of security events have their own characteristics. The following target information can be obtained through security event classification.

[0030] The key data of security events detected by HIDPS include timestamp, system resource information (system CPU usage, memory usage), process name, process resource information (process CPU usage, memory usage), login IP, Port, and file checksum.

[0031] The key data of security events detected by CANIDPS and SecOC include timestamp, CANID, message cycle, signal value and other information.

[0032] The key data of security incidents detected by NIDPS mainly include timestamp, attack source IP, port, attack target IP, port, protocol type and other information.

[0033] The key data related to VSMC mainly includes the master key, derived key, etc. When attacks such as key tampering occur, the corresponding error code is also the key information that needs to be extracted.

[0034] The timestamp, network card traffic, IP, port, etc. in the security events detected by SIDPS are all key information.

[0035] If an upgrade fails during the OTA upgrade process, the OTA Master will return error codes, status information, and other key information.

[0036] Step 200: Preliminarily fuse the target information so that the target information is classified according to a first preset rule to obtain data layer fusion data.

[0037] In this step, the target information can be preliminarily classified and data domain fusion can be performed. In an embodiment of the present invention, data fusion can be performed through the time dimension and the target dimension. The first preset rule mainly includes two dimensions: time and attack target, and the above target information is fused by setting the time range and the target name.

[0038] For example, the target information with timestamps within a preset range is preliminarily fused to obtain time domain fusion data; and / or the target information with consistent attack targets is preliminarily fused to obtain target domain fusion data.

[0039] There are two main factors to consider when merging data in the time dimension. First, for the same attack behavior initiated by an attacker, different defense detection systems may detect security incidents and upload them. Second, the attacker's attack behavior is usually not just a single attack behavior, but often a series of continuous behaviors. Therefore, fusing data within a period of time is more helpful to identify malicious attacks and detect the attacker's attack purpose. Therefore, after obtaining a large amount of key data, preliminary fusion can be performed based on the timestamp. For example, the timestamp information in the key data is obtained periodically, and the data with timestamps within a certain range is initially fused, and the data outside the range is not involved in the fusion.

[0040] Data fusion for the attack target dimension of the data, since a series of attack behaviors may be attacks on a certain part. Therefore, after obtaining a large amount of data, the security data can be screened based on the attack target, and the security data for the same attack target can be initially fused.

[0041] In other embodiments, data fusion can also be performed based on the dimension of attack behavior, for example, the target information can be classified based on the attack behavior identified by the above detection and defense systems. Usually, each detection and defense system also identifies the attack behavior based on the timestamp and the attack target; attack behavior identification strategies can also be formulated based on prior knowledge to complete the identification of attack behavior, such as using prior knowledge of known attack behaviors to formulate identification strategies.

[0042] Step 300: Fusing the data layer fusion data into feature layer fusion data according to a second preset rule, and uploading the feature layer fusion data and the data layer fusion data to a background operation system.

[0043] In this step, the second preset rule is a preset input relationship, and the input relationship of the data layer can be constructed according to the known intrusion knowledge. Then, the data layer fusion data with the combination relationship is combined into the feature layer fusion data according to the data input relationship.

[0044] In some embodiments, the data input relationship includes complementary and redundant types. Complementary data refers to the information of the input data representing different parts of the same scene and can be used to obtain more complete global information; redundant data refers to two or more sources of input data providing information on the same target and can be fused to enhance credibility.

[0045] In other embodiments, the data input relationship also includes a collaborative type, and collaborative data means that multiple input data can form information that is far more complex than the original information.

[0046] It should be understood that the present invention presets the input relationship between each data, and after obtaining the data layer fusion data, performs data fusion according to the input relationship between multiple data in the data layer fusion data, so as to meet the needs of the back-end operation personnel when performing data analysis. The back-end operation personnel can analyze the intrusion event and formulate corresponding response strategies after reading the data based on their work experience. That is, the input relationship can be customized according to the needs of the back-end operation personnel.

[0047] The present invention can effectively integrate various types of information security event data without making changes to various detection systems. It has certain scalability and is compatible with other intrusion detection systems that may be added in the future. It can also reduce the number of security events analyzed by background operations and improve operational efficiency, thereby more quickly and accurately identifying real malicious attacks and taking corresponding measures in a timely manner to protect vehicle safety.

[0048] For further information, see Figure 2 As shown, in the above step 300, the data layer fusion data is fused into feature layer fusion data according to a second preset rule, including the following steps.

[0049] Step 310: According to the intrusion behavior, the data determined to belong to the same intrusion scene in the time domain fusion data are fused into the feature layer fusion data.

[0050] For example, for the intrusion behavior of T-BOX, the time domain fusion data associated with the DOS attack intrusion scenario, Flood attack intrusion scenario, deformed message attack intrusion scenario, firewall attack intrusion scenario, and malicious domain name access intrusion scenario in the intrusion of T-BOX are fused.

[0051] Step 320: Fusing the target domain fusion data of the attack targets having an associated relationship into the feature layer fusion data.

[0052] For example, the data of the sensor as the attack target is fused. For example, the data of laser radar interference, the data of camera spoofing, the data of GPS spoofing, and the data of sensor data leakage are fused to obtain the feature layer fusion data.

[0053] Furthermore, the present invention can be understood in conjunction with the following specific application scenarios.

[0054] See also Figure 3As shown, in the above step 300, combining according to the data input relationship of the data layer fusion data, fusing the data layer fusion data with the combination relationship into feature layer fusion data includes the following steps.

[0055] Step 330: If the data input relationship of the data layer fusion data is complementary, the data layer fusion data with complementary input relationship is fused into the first feature layer fusion data.

[0056] For example, on parts where NIDPS and HIDPS are deployed, when a malicious DOS attack occurs, NIDPS can usually identify the DOS attack and upload a security event. The security event information includes the source IP, source port, destination IP, destination port, and protocol of the DOS attack. However, when the network environment of the parts is unstable or the communication between vehicle parts is abnormal, a large number of data packets will be generated. NIDPS will also identify them as DOS attack events and report them. Therefore, from the actual situation of mass-produced models, it is difficult for back-end operators to directly identify whether the DOS attack is a real malicious attack based solely on the data from NIDPS. HIDPS can complement NIDPS.

[0057] In one embodiment, if the data layer fusion data includes the DOS attack data output by the HIDPS and the DOS attack data output by the NIDPS, the DOS attack data output by the HIDPS and the DOS attack data output by the NIDPS are fused into the first feature layer fusion data.

[0058] For example, the key data extracted by NIDPS includes source IP, port, destination IP, and port. First, analyze whether it is an attack on the intranet based on the IP data; if so, determine whether the port is currently being used by an application based on the protocol and port. If so, obtain the process number of the current port in use. Based on the process number of the current port, HIDPS obtains the process information using the port, including the process name, and process resource usage (such as CPU usage, memory usage, etc.). In addition, DOS attacks usually mean a large number of data packets. In this case, the system resource usage may also be different from usual. HIDPS provides information about system resource usage in a very complementary way, including system CPU usage, memory usage, disk usage, and other information. Based on this information, the backend operator can directly locate the attacked process and clearly know the damage caused by the attack to the parts, so as to formulate a response strategy in time.

[0059] In another embodiment, if the data layer fusion data includes the update failure data output by OTA and the VSMC output data, the update failure data output by OTA and the VSMC output data are fused into the first feature layer fusion data.

[0060] For example, for key data obtained through NIDPS, if the IP is not an intranet IP, or there is no process in the current system using the attacked port, it can be identified as a non-malicious attack. In this way, back-end operators do not need to analyze such events, thereby improving back-end operation efficiency.

[0061] If OTA upgrades and VSMC systems are deployed on the parts. When the OTA upgrade fails, the key data provided by the OTA master includes the error code at this time, and the status information: the status is update failure, and the error code corresponds to the error of signature verification failure. Based only on the information returned by the OTA master, the backend operator can obtain preliminary information, namely: the OTA upgrade failed, and the reason for the failure is signature verification failure. However, if we analyze the reasons for the signature verification failure in detail, there may be many reasons, and we need to spend more time to analyze and troubleshoot. If there is a security incident in the VSMC system at this time, the key data of the VSMC system can be used to support the analysis of the reasons for the failure of the OTA upgrade. If the VSMC system also reports a security incident in the same or adjacent time domain, and the key data obtained contains the error code of the key change, then it can help the backend operator quickly locate the possible cause: the key leakage caused the OTA upgrade to fail.

[0062] Step 340: If the data input relationship of the data layer fusion data is redundant, the data layer fusion data with redundant input relationship is fused into the second feature layer fusion data.

[0063] In one embodiment, if the data layer fusion data includes login attack data output by HIDPS and login attack data output by NIDPS, the login attack data output by HIDPS and the login attack data output by NIDPS are fused into the second feature layer fusion data.

[0064] For example, in a component system where NIDPS and HIDPS have been deployed, when there is an SSH (remote connection tool) login or Telnet login (remote login), HIDPS will detect the login event and record and upload the security event. The key data that HIDPS can obtain includes the login IP and port. Generally speaking, events such as SSH login and Telnet login are usually one-time behaviors, which means that HIDPS may only detect and report a security event once at most. Then such an event alone is relatively single information for back-end operators. NDIPS will also detect and report security events for SSH login or Telnet login. Therefore, if in the same time domain, if the HIDPS side obtains abnormal login IP and port, and also obtains abnormal login events from the NIDPS side. The security events of the two defense systems can be merged to enhance the credibility of security events.

[0065] In another embodiment, if the data layer fusion data includes the message attack data output by CANIDPS and the message attack data output by SecOC, the message attack data output by CANIDS and the message attack data output by SecOC are fused into the first feature layer fusion data.

[0066] For example, for parts that have deployed CANIDPS and SecOC, for security messages, when there is a replay attack or data tampering against the security message, SecOC will detect the attack and upload the security event. The extracted key data includes CANID, cycle, data value, etc. When the message is sent unexpectedly or lost, CANIDPS will also quickly detect the message loss and other phenomena and immediately report the security event. The security data provided includes CANID, cycle, data value, bus load, etc. Therefore, in the same period of time, SecOC's security data can also be integrated with CANIDPS security data items to enhance the feasibility of the event.

[0067] The present invention integrates the data obtained by various intrusion detection systems to make the data multi-dimensional, which can help back-end operation personnel quickly and accurately locate the cause of security incidents, greatly improve operational efficiency, and effectively reduce the number of security analysis events.

[0068] like Figure 4 As shown, the present invention also provides a safety data fusion device for an intelligent networked vehicle, comprising: a data acquisition module 41, a first data fusion module 42, a second data fusion module 43, The data acquisition module 41 is used to acquire security event data uploaded by multiple intrusion detection and prevention systems, and extract target information from the security event data; A first data fusion module 42 is used to preliminarily fuse the target information so that the target information is classified according to a first preset rule to obtain data layer fusion data; The second data fusion module 43 is used to fuse the data layer fusion data into feature layer fusion data according to a second preset rule, and upload the feature layer fusion data and the data layer fusion data to the background operation system.

[0069] For the description of the safety data fusion device for intelligent connected vehicles, please refer to the corresponding method mentioned above and will not be repeated here.

[0070] like Figure 5 As shown, an embodiment of the present invention further discloses an electronic device, including: At least one processor; and at least one memory in communication with the processor, wherein: the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the steps of a safety data fusion method for an intelligent connected vehicle as described in any one of the above embodiments.

[0071] The embodiment of the present invention also discloses a readable storage medium.

[0072] A readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a safety data fusion method for an intelligent connected vehicle as described in any one of the above embodiments.

[0073] It can be understood that computer-readable storage media may include: any entity or device capable of carrying a computer program, recording media, USB flash drives, mobile hard disks, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc. A computer program includes computer program code. The computer program code may be in source code form, object code form, executable file, or some intermediate form, etc. A computer-readable storage medium may include: any entity or device capable of carrying a computer program code, recording media, USB flash drives, mobile hard disks, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0074] In certain embodiments of the present invention, the electronic device may include a controller or a processor, and the controller is a single-chip microcomputer chip that integrates a processor, a memory, a communication module, etc. The processor may refer to a processor included in the controller. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.

[0075] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present invention belong.

[0076] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0077] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A security data fusion method for intelligent connected vehicles, characterized in that: include: Obtain security event data uploaded by multiple intrusion detection and prevention systems, and extract target information from the security event data; Preliminarily fusing the target information so that the target information is classified according to a first preset rule to obtain data layer fusion data; The data layer fusion data is fused into feature layer fusion data according to a second preset rule, and the feature layer fusion data and the data layer fusion data are uploaded to a background operation system.

2. The method for secure data fusion for intelligent connected vehicles according to claim 1, characterized in that: The preliminarily fusing the target information so that the target information is classified according to a first preset rule to obtain data layer fusion data includes: The target information with timestamps within a preset range is preliminarily fused to obtain time domain fusion data; and / or the target information with consistent attack targets is preliminarily fused to obtain target domain fusion data.

3. The method for secure data fusion for intelligent connected vehicles according to claim 2, characterized in that: The step of fusing the data layer fusion data into feature layer fusion data according to a second preset rule includes: According to the intrusion behavior, the data determined to belong to the same intrusion scene in the time domain fusion data are fused into the feature layer fusion data; The target domain fusion data of the attack targets having an associated relationship are fused into the feature layer fusion data.

4. The method for secure data fusion for intelligent connected vehicles according to claim 1 or 2, characterized in that: The step of fusing the data layer fusion data into feature layer fusion data according to a second preset rule includes: The data layer fusion data are combined according to the data input relationship, and the data layer fusion data having the combination relationship are fused into feature layer fusion data.

5. The method for secure data fusion for intelligent connected vehicles according to claim 4, characterized in that: The combining according to the data input relationship of the data layer fusion data to fuse the data layer fusion data having the combination relationship into feature layer fusion data includes: If the data input relationship of the data layer fusion data is complementary, the data layer fusion data with complementary input relationship is fused into the first feature layer fusion data; If the data input relationship of the data layer fusion data is redundant, the data layer fusion data with redundant input relationship is fused into the second feature layer fusion data.

6. The method for secure data fusion for intelligent connected vehicles according to claim 5, characterized in that: If the data input relationship of the data layer fusion data is complementary, fusing the data layer fusion data with complementary input relationship into first feature layer fusion data, including: If the data layer fusion data includes the DOS attack data output by the HIDPS and the DOS attack data output by the NIDPS, the DOS attack data output by the HIDPS and the DOS attack data output by the NIDPS are fused into the first feature layer fusion data; Alternatively, if the data layer fusion data includes the update failure data output by OTA and the VSMC output data, the update failure data output by OTA and the VSMC output data are fused into the first feature layer fusion data.

7. The method for secure data fusion for intelligent connected vehicles according to claim 5, characterized in that: If the data input relationship of the data layer fusion data is redundant, fusing the data layer fusion data with redundant input relationship into second feature layer fusion data, including: If the data layer fusion data includes the login attack data output by the HIDPS and the login attack data output by the NIDPS, the login attack data output by the HIDPS and the login attack data output by the NIDPS are fused into the second feature layer fusion data; Or if the data layer fusion data includes the message attack data output by CANIDPS and the message attack data output by SecOC, the message attack data output by CANIDS and the message attack data output by SecOC are fused into the first feature layer fusion data.

8. A safety data fusion device for intelligent connected vehicles, characterized in that: include: A data acquisition module is used to acquire security event data uploaded by multiple intrusion detection and prevention systems, and extract target information from the security event data; A first data fusion module is used to preliminarily fuse the target information so that the target information is classified according to a first preset rule to obtain data layer fusion data; The second data fusion module is used to fuse the data layer fusion data into feature layer fusion data according to a second preset rule, and upload the feature layer fusion data and the data layer fusion data to a background operation system.

9. An electronic device, characterized in that: include: at least one processor; And at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the safety data fusion method for intelligent connected vehicles as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is run by a computer, the safety data fusion method for an intelligent connected vehicle as described in any one of claims 1 to 7 is executed.

Images