Distributed cooperative detection method and system and storage medium
Through model collaborative learning between vehicles and edge servers, the problem of difficulty in data collaboration between multiple vehicles is solved, and higher detection accuracy and flexibility is achieved, real-time response is ensured, and overall detection capabilities are improved.
Patent Information
- Application Number
- CN202510049364.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-13
- Publication Date
- 2025-04-25
AI Technical Summary
The prior art cannot cooperate data between multiple vehicles and cannot perform distributed traffic collaborative detection conveniently and accurately, making it difficult to effectively deal with network security threats.
The vehicle determines the candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and preset traffic detection models, obtains model parameters and sends them to the edge server. The edge server updates the global detection model and sends the updated model back to the vehicle, realizing distributed collaborative learning between the vehicle and the model in the edge server.
Real-time learning and continuous optimization of models in vehicles and edge servers is realized, detection accuracy and flexibility are improved, real-time response in different network environments is ensured, and the vehicle's privacy data is retained, threat detection experience is shared, and overall detection capabilities are improved.
Smart Images
Figure CN119892458A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of data processing technology, and in particular to a distributed collaborative detection method, system and storage medium. Background Art
[0002] With the rapid development of Intelligent Connected Vehicle (ICV) technology, vehicles have gradually evolved into highly interconnected mobile smart terminals. The application of vehicle networking technology enables seamless connection between vehicles and the external environment (such as the cloud, user smart devices, other vehicles and road infrastructure). This high degree of connectivity has brought about improvements in information mobility and functional convenience, enabling intelligent connected vehicles to provide more advanced autonomous driving, in-vehicle entertainment, fleet management and other services. However, the highly networked nature of vehicles also exposes them to a wider range of cyber attacks. Cyber attackers can invade vehicle systems in a variety of ways (such as wireless networks, vehicle buses, external interfaces), threatening the safety and functionality of the vehicle. Therefore, how to ensure the network security of intelligent connected vehicles has become a key issue in the development of the industry.
[0003] At present, intrusion detection system (IDS) has become an important protective measure for the network security issues of intelligent connected vehicles. Traditional IDS are mostly based on rule detection and machine learning models. Although rule detection can quickly identify known threats, it is difficult to deal with complex and unknown attack behaviors, and IDS with simple rules has a high false alarm rate; detection systems based on machine learning have higher flexibility, but often require a lot of computing resources and data processing, and it is difficult to operate efficiently in resource-constrained vehicle environments. At the same time, most of the current detection systems run independently in a single vehicle and cannot perform data collaboration between multiple vehicles. In addition, with the continuous evolution of attack technology, the existing system needs to constantly manually update rules and models, and the maintenance cost is high. In order to improve the detection effect, the existing system usually transmits a large amount of raw data to the cloud for centralized processing. This not only increases bandwidth and communication costs, but also poses the risk of data privacy leakage. Therefore, how to conveniently and accurately perform distributed collaborative detection of traffic has become an urgent problem to be solved. Summary of the invention
[0004] The present invention provides a distributed collaborative detection method, system and storage medium to solve the problem in the prior art that data collaboration between multiple vehicles cannot be carried out and distributed collaborative traffic detection cannot be carried out conveniently and accurately.
[0005] According to one aspect of the present invention, a distributed collaborative detection method is provided, wherein the method is applied to a distributed collaborative detection system, the distributed collaborative detection system comprising: an edge server and at least two vehicles, the method comprising:
[0006] Determine candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and a preset traffic detection model by the vehicle, obtain model parameters of the preset traffic detection model, and send the candidate normal traffic, the abnormal traffic and the model parameters to the edge server;
[0007] Updating the global detection model according to the model parameters by the edge server, determining the first abnormal traffic in the candidate normal traffic based on the updated global detection model, and taking the abnormal traffic and the first abnormal traffic as target abnormal traffic;
[0008] The updated global detection model is sent to each of the vehicles through the edge server, so that the vehicle uses the updated global detection model as the preset traffic detection model to continue to perform the operation of determining candidate normal traffic and abnormal traffic in real-time network traffic.
[0009] According to another aspect of the present invention, a distributed collaborative detection system is provided, wherein the distributed collaborative detection system comprises: an edge server and at least two vehicles;
[0010] The vehicle is used to determine candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and a preset traffic detection model, obtain model parameters of the preset traffic detection model, and send the candidate normal traffic, the abnormal traffic and the model parameters to the edge server;
[0011] The edge server is configured to update the global detection model according to the model parameters, determine the first abnormal traffic in the candidate normal traffic based on the updated global detection model, and use the abnormal traffic and the first abnormal traffic as target abnormal traffic;
[0012] The edge server is used to send the updated global detection model to each of the vehicles, so that the vehicle uses the updated global detection model as the preset traffic detection model to continue to perform the operation of determining candidate normal traffic and abnormal traffic in real-time network traffic.
[0013] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the distributed collaborative detection method described in any embodiment of the present invention when executed.
[0014] The technical solution of the embodiment of the present invention is to determine the candidate normal traffic and abnormal traffic in the real-time network traffic based on the historical filtered traffic and the preset traffic detection model by the vehicle, obtain the model parameters of the preset traffic detection model, send the candidate normal traffic, abnormal traffic and model parameters to the edge server, update the global detection model according to the model parameters by the edge server, determine the first abnormal traffic in the candidate normal traffic based on the updated global detection model, use the abnormal traffic and the first abnormal traffic as the target abnormal traffic, and send the updated global detection model to each vehicle through the edge server, so that the vehicle uses the updated global detection model as the preset traffic detection model to continue to perform the operation of determining the candidate normal traffic and abnormal traffic in the real-time network traffic, realize the distributed collaborative learning of the model in the vehicle and the edge server, learn in real time and continuously optimize the preset traffic detection model, achieve higher detection accuracy and flexibility, and ensure real-time response in different network environments; at the same time, only the model parameters are sent, the privacy data of each vehicle is retained, and the threat detection experience of all vehicles can be shared, thereby improving the overall detection capability.
[0015] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0017] Figure 1 is a flow chart of a distributed collaborative detection method provided according to Embodiment 1 of the present invention;
[0018] Figure 2 is a flow chart of a distributed collaborative detection method provided according to Embodiment 2 of the present invention;
[0019] Figure 3 is a schematic diagram of the structure of a distributed collaborative detection system provided according to Embodiment 3 of the present invention;
[0020] Figure 4 is a schematic diagram of the structure of another distributed collaborative detection system provided according to Embodiment 3 of the present invention;
[0021] Figure 5 It is a structural diagram of a distributed collaborative detection system provided according to Embodiment 4 of the present invention. DETAILED DESCRIPTION
[0022] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0024] Embodiment 1
[0025] Figure 1 This is a flow chart of a distributed collaborative detection method provided according to the first embodiment of the present invention. This embodiment can be applied to collaborate with a preset traffic detection model to determine the abnormal traffic in real-time network traffic. The method can be executed by a distributed collaborative detection system. The distributed collaborative detection system can be implemented in the form of hardware and / or software. The distributed collaborative detection system includes: an edge server and at least two vehicles. Figure 1 As shown, the method includes:
[0026] S110, determine the candidate normal traffic and abnormal traffic in the real-time network traffic based on the historical filtered traffic and the preset traffic detection model through the vehicle, obtain the model parameters of the preset traffic detection model, and send the candidate normal traffic, abnormal traffic and model parameters to the edge server.
[0027] Among them, historical filtered traffic can be understood as abnormal network data traffic screened in the past period of time. In the actual operation process, historical filtered traffic is stored based on a preset Bloom filter. In one embodiment, historical filtered traffic can also be filtering field information of abnormal network data traffic, such as traffic source, port number, and Internet Protocol (Internet Protocol), etc. Real-time network traffic refers to the network traffic received by the current vehicle in real time. Exemplarily, real-time network traffic may include but is not limited to network traffic generated by data interaction between various components inside the vehicle, network traffic generated by data interaction between the vehicle and the user's smart device, network traffic generated by the vehicle and road infrastructure equipment, and network traffic generated by data interaction between the vehicle and the cloud server. In general, the vehicle can perform detection tasks and sending tasks based on the vehicle's electronic control unit (ECU).
[0028] Candidate normal traffic can be understood as network traffic without abnormalities that has passed the preliminary screening of the vehicle; abnormal traffic can be understood as network traffic with abnormalities. The preset traffic detection model can be understood as a pre-trained model for detecting whether there is abnormal traffic in real-time network traffic. Generally speaking, the preset traffic detection model can be a machine learning model. The preset traffic detection model can be deployed in the vehicle, and each vehicle can train the deployed preset traffic detection model separately. Model parameters refer to the key variables learned in the preset traffic detection model during the training process. For example, the model parameters may include filter coefficients, weights, and intercepts. An edge server refers to a server located at the edge of the network. For example, an edge server may include but is not limited to a road side unit (RSU).
[0029] In an embodiment, the vehicle can filter the traffic belonging to the historical filtered traffic in the real-time network traffic based on the historical filtered traffic as abnormal traffic, and input the remaining real-time network traffic that does not belong to the historical filtered traffic into a preset traffic detection model, determine the candidate normal traffic and abnormal traffic in the remaining real-time network traffic, extract the model parameters in the current preset traffic detection model, and send the candidate normal traffic, abnormal traffic and model parameters to the edge server.
[0030] S120. Update the global detection model according to the model parameters through the edge server, determine the first abnormal flow in the candidate normal flow based on the updated global detection model, and use the abnormal flow and the first abnormal flow as the target abnormal flow.
[0031] The global detection model can be understood as a model deployed in the edge server for detecting whether there is abnormal traffic in the network traffic, and the global detection model can be a machine learning model. The first abnormal traffic can be understood as the abnormal traffic in the candidate normal traffic determined by the updated global detection model. The target abnormal traffic refers to all abnormal traffic in the real-time network traffic.
[0032] In an embodiment, the edge server can update the global detection model according to the model parameters, and input the candidate normal traffic into the updated global detection model to determine the abnormal traffic in the candidate normal traffic as the first abnormal traffic, and use the abnormal traffic and the first abnormal traffic as the target abnormal traffic. In the actual operation process, the model parameters can be aggregated, and the aggregated model parameters can be used to update the global detection model. Exemplarily, the model parameters can be simply averaged; or, a weighted average can be performed according to the number of abnormal traffic in the candidate normal traffic sent by each vehicle.
[0033] S130. Send the updated global detection model to each vehicle through the edge server, so that the vehicle uses the updated global detection model as a preset traffic detection model to continue to perform operations of determining candidate normal traffic and abnormal traffic in real-time network traffic.
[0034] In an embodiment, the updated global detection model can be sent to each vehicle through the edge server, and the vehicle can use the updated global detection model as the preset traffic detection model, continue to determine the candidate normal traffic and abnormal traffic in the real-time network traffic based on the historical filtered traffic and the preset traffic detection model, obtain the model parameters of the preset traffic detection model, and send the candidate normal traffic, abnormal traffic and model parameters to the edge server to achieve collaborative learning of the preset traffic detection model. In the actual operation process, the edge server can send the updated global detection model to each vehicle through the Over-The-Air (OTA) technology.
[0035] In an embodiment of the present invention, a vehicle determines candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and a preset traffic detection model, obtains model parameters of the preset traffic detection model, sends candidate normal traffic, abnormal traffic and model parameters to an edge server, updates a global detection model according to the model parameters through the edge server, determines a first abnormal traffic in candidate normal traffic based on the updated global detection model, uses the abnormal traffic and the first abnormal traffic as target abnormal traffic, and sends the updated global detection model to each vehicle through the edge server, so that the vehicle uses the updated global detection model as the preset traffic detection model to continue to perform the operation of determining candidate normal traffic and abnormal traffic in real-time network traffic, realizes distributed collaborative learning of models in vehicles and edge servers, learns in real time and continuously optimizes the preset traffic detection model, realizes higher detection accuracy and flexibility, and ensures real-time response in different network environments; at the same time, only the model parameters are sent, the privacy data of each vehicle is retained, and the threat detection experience of all vehicles can be shared, thereby improving the overall detection capability.
[0036] In one embodiment, the distributed collaborative detection system further includes a cloud server, and correspondingly, the distributed collaborative detection method further includes:
[0037] Obtain candidate normal traffic and target abnormal traffic through a cloud server, and determine normal traffic according to the candidate normal traffic and target abnormal traffic;
[0038] The cloud server aggregates normal traffic and target abnormal traffic to build global threat intelligence;
[0039] Generate a global security policy based on the target abnormal traffic through the cloud server, and synchronize the global security policy to the vehicle and edge server.
[0040] Among them, global threat intelligence can be understood as the summary intelligence of the entire regional traffic.
[0041] In an embodiment, candidate normal traffic and target abnormal traffic can be obtained through a cloud server, and the candidate normal traffic excluding the target abnormal traffic is used as normal traffic, and the normal traffic and the target abnormal traffic are summarized as global threat intelligence. In the actual operation process, the global threat intelligence can be stored in the database. Then generate a security defense strategy according to each target abnormal traffic, use all security defense strategies as global security strategies, and synchronize the global security strategy to the vehicle and edge server, so that the protection strategy can be quickly implemented when the vehicle or edge server detects abnormal traffic. In the actual operation process, the global security strategy may include, but is not limited to, ignoring when there are repeated abnormal traffic in the local vehicle; when the abnormal traffic comes from other vehicles, sending alarm signals to other vehicles, etc., to achieve rapid linkage protection.
[0042] In one embodiment, after updating the global detection model according to the model parameters by the edge server and determining the first abnormal traffic in the candidate normal traffic based on the updated global detection model, the method further includes:
[0043] Performing a regional threat analysis on the first abnormal traffic through the edge server to determine an impact range of the first abnormal traffic;
[0044] The edge server determines the vehicles within the affected range and sends abnormal warnings to the vehicles.
[0045] In an embodiment, after the edge server determines the first abnormal traffic among the candidate normal traffic, it can analyze the threat impact area of the first abnormal traffic, determine the impact range of the first abnormal traffic, and determine the vehicles within the impact range, and send an abnormal warning to the vehicle to ensure timely protection of the vehicle.
[0046] In one embodiment, after determining the candidate normal traffic and abnormal traffic in the real-time network traffic based on the historical filtered traffic and the preset traffic detection model by the vehicle, the method further includes:
[0047] The abnormal traffic is stored as historical filtered traffic; wherein the historical filtered traffic is stored based on a preset Bloom filter.
[0048] In an embodiment, after the vehicle determines the candidate normal traffic and abnormal traffic in the real-time network traffic based on the historical filtered traffic and the preset traffic detection model, the abnormal traffic can be stored as the historical filtered traffic, so as to facilitate the timely screening of the abnormal traffic in the next traffic detection process and improve the detection efficiency of the abnormal traffic.
[0049] Embodiment 2
[0050] Figure 2 1 is a flow chart of a distributed collaborative detection method provided according to Embodiment 2 of the present invention. This embodiment is further optimized and expanded based on the above embodiment and can be combined with various optional technical solutions in the above embodiment. Figure 2 As shown, the method includes:
[0051] S210. Receive real-time network traffic through the vehicle based on a preset vehicle network interface.
[0052] The preset vehicle network interface refers to a pre-set interface for the vehicle to obtain real-time network traffic. In actual operation, the preset vehicle network interface may be a Controller Area Network Interface (CAN) interface.
[0053] In an embodiment, the vehicle may capture network traffic in real time through a preset vehicle network interface, and use the network traffic captured in real time as real-time network traffic.
[0054] S220. Determine, through the vehicle, whether the real-time network traffic belongs to the historical filtered traffic.
[0055] In an embodiment, the real-time network traffic may be compared with the historical filtered traffic by the vehicle to determine whether the real-time network traffic contains the historical filtered traffic.
[0056] S230: If it is determined through the vehicle that the real-time network traffic belongs to the historical filtered traffic, the real-time network traffic is determined as abnormal traffic.
[0057] In an embodiment, when it is determined by a vehicle that there is historical filtered traffic in real-time network traffic, the corresponding real-time network traffic may be determined as abnormal traffic.
[0058] S240: If it is determined through the vehicle that the real-time network traffic does not belong to the historical filtered traffic, the real-time network traffic is input into a preset traffic detection model, and abnormal traffic and candidate normal traffic in the real-time network traffic are determined based on the preset traffic detection model.
[0059] In an embodiment, when it is determined by a vehicle that there is real-time network traffic that does not belong to historical filtered traffic, the real-time network traffic can be input into a preset traffic detection model, and the preset traffic detection model can be used to determine the presence of abnormal traffic in the real-time network traffic as abnormal traffic, and the absence of abnormal traffic as candidate normal traffic.
[0060] S250, extracting model parameters of a preset traffic detection model through the vehicle, and sending candidate normal traffic, abnormal traffic and model parameters to the edge server.
[0061] In an embodiment, the model parameters such as filter coefficients, weights, and intercepts in a preset traffic detection model can be determined by the vehicle, and the candidate normal traffic, abnormal traffic, and model parameters can be sent to the edge server through the vehicle communication module (Telematics BOX, T-BOX).
[0062] S260. Receive model parameters sent by each vehicle through the edge server.
[0063] S270. Aggregate the model parameters through the edge server to obtain target model parameters, and update the global detection model according to the target model parameters.
[0064] In an embodiment, the model parameters may be aggregated by the edge server to obtain the target model parameters, for example, simple average or weighted average. The target model parameters are used as parameters of the global detection model to update the global detection model. In the actual operation process, the proportion of abnormal traffic in the candidate normal traffic sent by each vehicle may be determined, the weight of the model parameter corresponding to each vehicle may be determined according to the proportion, and the target model parameters may be obtained by weighted average of the model parameters.
[0065] S280. Input the candidate normal traffic into the updated global detection model through the edge server, determine the first abnormal traffic in the candidate normal traffic, and use the abnormal traffic and the first abnormal traffic as target abnormal traffic.
[0066] In an embodiment, the candidate normal traffic can be input into the updated global detection model through the edge server, and the global detection model determines that the abnormal traffic in the candidate normal traffic is the first abnormal traffic, and the abnormal traffic and the first abnormal traffic are used as the target abnormal traffic.
[0067] S290. Send the updated global detection model to each vehicle through the edge server via over-the-air download technology.
[0068] In an embodiment of the present invention, a vehicle receives real-time network traffic based on a preset vehicle network interface, determines whether the real-time network traffic belongs to historical filtered traffic, and if it is determined that the real-time network traffic belongs to historical filtered traffic, determines the real-time network traffic as abnormal traffic; if it is determined that the real-time network traffic does not belong to historical filtered traffic, inputs the real-time network traffic into a preset traffic detection model, determines abnormal traffic and candidate normal traffic in the real-time network traffic based on the preset traffic detection model, extracts model parameters of the preset traffic detection model, and sends the candidate normal traffic, abnormal traffic and model parameters to an edge server, thereby realizing fast and low-latency intrusion detection at the local layer of the vehicle; receives model parameters sent by each vehicle through an edge server, aggregates the model parameters to obtain target model parameters, updates the global detection model according to the target model parameters, inputs the candidate normal traffic into the updated global detection model, determines the first abnormal traffic in the candidate normal traffic, uses the abnormal traffic and the first abnormal traffic as the target abnormal traffic, and sends the updated global detection model to each vehicle through an over-the-air download technology, thereby realizing collaborative learning of the detection model and maintaining the real-time and effectiveness of the model.
[0069] Embodiment 3
[0070] Figure 3 Schematic diagram of a distributed collaborative detection system provided according to Embodiment 3 of the present invention. Figure 3 As shown, the distributed collaborative detection system includes: an edge server 31 and at least two vehicles 32.
[0071] Among them, vehicle 31 is used to determine candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and a preset traffic detection model, obtain model parameters of the preset traffic detection model, and send the candidate normal traffic, abnormal traffic and model parameters to the edge server;
[0072] The edge server 32 is used to update the global detection model according to the model parameters, determine the first abnormal flow in the candidate normal flow based on the updated global detection model, and use the abnormal flow and the first abnormal flow as the target abnormal flow;
[0073] The edge server 32 is used to send the updated global detection model to each vehicle, so that the vehicle uses the updated global detection model as a preset traffic detection model to continue to perform operations to determine candidate normal traffic and abnormal traffic in real-time network traffic.
[0074] In an embodiment of the present invention, a vehicle determines candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and a preset traffic detection model, obtains model parameters of the preset traffic detection model, sends candidate normal traffic, abnormal traffic and model parameters to an edge server, updates a global detection model according to the model parameters through the edge server, determines a first abnormal traffic in candidate normal traffic based on the updated global detection model, uses the abnormal traffic and the first abnormal traffic as target abnormal traffic, and sends the updated global detection model to each vehicle through the edge server, so that the vehicle uses the updated global detection model as the preset traffic detection model to continue to perform the operation of determining candidate normal traffic and abnormal traffic in real-time network traffic, realizes distributed collaborative learning of models in vehicles and edge servers, learns in real time and continuously optimizes the preset traffic detection model, realizes higher detection accuracy and flexibility, and ensures real-time response in different network environments; at the same time, only the model parameters are sent, the privacy data of each vehicle is retained, and the threat detection experience of all vehicles can be shared, thereby improving the overall detection capability.
[0075] In one embodiment, the vehicle is further configured to:
[0076] receiving real-time network traffic based on a preset vehicle network interface;
[0077] Determine whether real-time network traffic belongs to historical filtered traffic;
[0078] If it is determined that the real-time network traffic belongs to the historical filtered traffic, the real-time network traffic is determined as abnormal traffic;
[0079] If it is determined that the real-time network traffic does not belong to the historical filtered traffic, the real-time network traffic is input into a preset traffic detection model, and abnormal traffic and candidate normal traffic in the real-time network traffic are determined based on the preset traffic detection model;
[0080] The model parameters of the preset traffic detection model are extracted, and the candidate normal traffic, abnormal traffic and model parameters are sent to the edge server.
[0081] In one embodiment, the edge server is further configured to:
[0082] Receive model parameters sent by each vehicle;
[0083] Aggregate the model parameters to obtain the target model parameters, and update the global detection model according to the target model parameters;
[0084] The candidate normal traffic is input into the updated global detection model, the first abnormal traffic in the candidate normal traffic is determined, and the abnormal traffic and the first abnormal traffic are used as target abnormal traffic.
[0085] In one embodiment, the edge server is further configured to:
[0086] The updated global detection model is sent to each vehicle via over-the-air download technology.
[0087] In one embodiment, the edge server is further configured to:
[0088] Performing a regional threat analysis on the first abnormal traffic flow to determine an impact range of the first abnormal traffic flow;
[0089] Identify the vehicles within the impact range and send abnormal warnings to the vehicles.
[0090] In one embodiment, the edge server is further configured to:
[0091] The abnormal traffic is stored as historical filtered traffic; wherein the historical filtered traffic is stored based on a preset Bloom filter.
[0092] In one embodiment, Figure 4 3 is a schematic diagram of the structure of another distributed collaborative detection system provided according to Embodiment 3 of the present invention. It is characterized in that the distributed collaborative detection system further includes: a cloud server 33.
[0093] The cloud server 33 is used to obtain candidate normal traffic and target abnormal traffic, and determine the normal traffic according to the candidate normal traffic and the target abnormal traffic;
[0094] The cloud server 33 is also used to aggregate normal traffic and target abnormal traffic to build global threat intelligence;
[0095] The cloud server 33 is also used to generate a global security policy according to the target abnormal traffic and synchronize the global security policy to the vehicle and the edge server.
[0096] The distributed collaborative detection system provided in the embodiment of the present invention can execute the distributed collaborative detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
[0097] Embodiment 4
[0098] Figure 5 is a schematic diagram of the structure of a distributed collaborative detection system provided according to Embodiment 4 of the present invention. In this embodiment, a vehicle control unit (ECU) at a local layer performs a vehicle detection function, an edge server serves as an edge layer, and a cloud server serves as a cloud layer. Figure 5 As shown, the distributed collaborative detection system includes: an edge layer 41, at least two local layers 42 and a cloud layer.
[0099] Among them, the local layer (vehicle control unit - ECU) 42, the ECU of each vehicle is responsible for real-time capture and analysis of the vehicle's network traffic data. Local detection is performed through a machine learning model (preset traffic detection model), and the results and model parameter updates are sent to the edge server (edge layer 41), ensuring data privacy while improving detection efficiency.
[0100] In one embodiment, the vehicle control unit may include multiple categories, such as network ECU, power ECU and body ECU. These ECUs are responsible for controlling different functional modules of the vehicle (such as communication, power system and body control). Each ECU collects the network traffic data of the vehicle in real time and performs local preliminary detection. By coordinating with T-Box, these network traffic data can be used for model updating and optimization.
[0101] Among them, T-Box integrates an intrusion detection system (IDS) to analyze and identify potential threats in real time locally in the vehicle. T-Box connects to multiple ECUs through the CAN interface, and responds quickly and implements protection strategies when anomalies are detected. At the same time, it also regularly sends model update parameters to the edge server and the cloud. T-Box acts as an edge node, coordinating data from multiple vehicles to perform regional-level threat analysis.
[0102] The CAN interface connects the various ECUs of the vehicle, ensuring that data flows seamlessly between different control units within the vehicle. By monitoring the data traffic from the CAN bus, IDS can identify and detect possible network attacks or abnormal behaviors.
[0103] In one embodiment, an in-vehicle infotainment system (IVI) may also be installed in the vehicle, which is responsible for displaying vehicle information and alarms related to the user. When a threat is detected, IVI can send a warning to the driver in a timely manner to remind the driver of potential safety risks. IVI also exchanges data with T-Box to ensure that information can be transmitted and responded to in a timely manner.
[0104] The edge layer (edge server - RSU or roadside unit) 41 acts as a data collection center. The edge server (edge layer 41) receives model updates and detection results from multiple vehicles and updates the global detection model using collaborative learning technology. In addition, the edge server (edge layer 41) performs data fusion and comprehensive analysis based on the vehicle information in the receiving area to identify and respond to complex network attacks in real time.
[0105] Cloud layer 43 (cloud server): further analyzes and models the data of edge layer 41, identifies more advanced cross-regional attacks, and generates global security policies and intelligence, which are uniformly deployed to edge servers and vehicle control units.
[0106] In one embodiment, the cloud layer 43 not only stores and analyzes detection data from different vehicles and regions, but also optimizes models and sends security policies to vehicles and T-Boxes. Through the collaboration between the cloud and edge servers, the system can achieve more advanced cross-regional threat detection and response to ensure global security.
[0107] In one embodiment, the collaborative learning process includes local training and parameter uploading, as well as edge aggregation and model optimization.
[0108] Local training and parameter uploading perform local data training for each vehicle while it is driving, and regularly upload model parameters (rather than original data) to the edge server to ensure vehicle data privacy.
[0109] Edge aggregation and model optimization aggregate and optimize the uploaded model parameters for the edge server to generate a more powerful global model and send the optimized model back to each vehicle.
[0110] In one embodiment, the system can adjust the model synchronization frequency according to changes in the region and network environment. Model updates are automatically pushed through OTA technology (Over-The-Air) to achieve seamless real-time protection. The edge server analyzes vehicle traffic in the area in real time, identifies concentrated or new attacks, and immediately distributes protection strategies to all vehicles in the area to achieve rapid linkage protection.
[0111] In an embodiment of the present invention, the edge server receives and integrates data from multiple vehicles, updates the optimized global model, and sends the updated model to each vehicle through OTA technology to achieve dynamic adaptation and rapid response. Through an efficient matching mechanism that combines Bloom filters and machine learning technology, the system can achieve fast and low-latency intrusion detection at the local vehicle level. At the same time, through regional threat analysis, the edge server can quickly issue an early warning to all vehicles in the area when an abnormal situation is detected, and synchronously update the protection strategy to achieve a rapid linkage response. At the same time, through distributed collaborative learning technology, the system can dynamically update the detection model to achieve continuous optimization and real-time learning of the model.
[0112] Embodiment 5
[0113] Embodiment 5 of the present invention further provides a storage medium including computer executable instructions, and when the computer executable instructions are executed by a computer processor, they are used to execute a distributed collaborative detection method, the method comprising:
[0114] Determine candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and preset traffic detection models through vehicles, obtain model parameters of preset traffic detection models, and send candidate normal traffic, abnormal traffic and model parameters to edge servers;
[0115] The edge server updates the global detection model according to the model parameters, determines the first abnormal flow in the candidate normal flow based on the updated global detection model, and uses the abnormal flow and the first abnormal flow as the target abnormal flow;
[0116] The updated global detection model is sent to each vehicle through the edge server, so that the vehicle uses the updated global detection model as a preset traffic detection model to continue to perform operations to determine candidate normal traffic and abnormal traffic in real-time network traffic.
[0117] Of course, the storage medium containing computer executable instructions provided by an embodiment of the present invention, whose computer executable instructions are not limited to the above method operations, can also execute related operations in a distributed collaborative detection method provided by any embodiment of the present invention.
[0118] Through the above description of the implementation methods, technicians in the relevant field can clearly understand that the present invention can be implemented with the help of software and necessary general-purpose hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform a distributed collaborative detection method of each embodiment of the present invention.
[0119] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.
[0120] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A distributed collaborative detection method, characterized in that: Applied to a distributed collaborative detection system, the distributed collaborative detection system includes: an edge server and at least two vehicles, the method includes: Determine candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and a preset traffic detection model by the vehicle, obtain model parameters of the preset traffic detection model, and send the candidate normal traffic, the abnormal traffic and the model parameters to the edge server; Updating the global detection model according to the model parameters by the edge server, determining the first abnormal traffic in the candidate normal traffic based on the updated global detection model, and taking the abnormal traffic and the first abnormal traffic as target abnormal traffic; The updated global detection model is sent to each of the vehicles through the edge server, so that the vehicle uses the updated global detection model as the preset traffic detection model to continue to perform the operation of determining candidate normal traffic and abnormal traffic in real-time network traffic.
2. The method according to claim 1, characterized in that The distributed collaborative detection system further includes a cloud server. Accordingly, the method further includes: Acquire candidate normal traffic and target abnormal traffic through the cloud server, and determine normal traffic according to the candidate normal traffic and target abnormal traffic; The normal traffic and the target abnormal traffic are aggregated by the cloud server to construct global threat intelligence; A global security policy is generated by the cloud server according to the target abnormal traffic, and the global security policy is synchronized to the vehicle and the edge server.
3. The method according to claim 1, characterized in that The method of determining candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and a preset traffic detection model by the vehicle, obtaining model parameters of the preset traffic detection model, and sending the candidate normal traffic, the abnormal traffic, and the model parameters to the edge server includes: receiving real-time network traffic through the vehicle based on a preset vehicle network interface; determining, by the vehicle, whether the real-time network traffic belongs to the historical filtered traffic; If it is determined through the vehicle that the real-time network traffic belongs to the historical filtered traffic, determining the real-time network traffic as abnormal traffic; If it is determined by the vehicle that the real-time network traffic does not belong to the historical filtered traffic, the real-time network traffic is input into a preset traffic detection model, and abnormal traffic and candidate normal traffic in the real-time network traffic are determined based on the preset traffic detection model; The model parameters of the preset traffic detection model are extracted through the vehicle, and the candidate normal traffic, the abnormal traffic and the model parameters are sent to the edge server.
4. The method according to claim 1, characterized in that: The updating of the global detection model according to the model parameters by the edge server, determining the first abnormal traffic in the candidate normal traffic based on the updated global detection model, and taking the abnormal traffic and the first abnormal traffic as target abnormal traffic, comprises: Receiving, by the edge server, the model parameters sent by each of the vehicles; Aggregating the model parameters through the edge server to obtain target model parameters, and updating the global detection model according to the target model parameters; The candidate normal traffic is input into the updated global detection model through the edge server, the first abnormal traffic in the candidate normal traffic is determined, and the abnormal traffic and the first abnormal traffic are used as target abnormal traffic.
5. The method according to claim 1, characterized in that The step of sending the updated global detection model to each of the vehicles through the edge server includes: The updated global detection model is sent to each of the vehicles through the edge server via over-the-air download technology.
6. The method according to claim 1, characterized in that After the edge server updates the global detection model according to the model parameters and determines the first abnormal traffic in the candidate normal traffic based on the updated global detection model, the method further includes: Performing a regional threat analysis on the first abnormal traffic through the edge server to determine an impact scope of the first abnormal traffic; The edge server determines the vehicles within the affected range and sends abnormal warnings to the vehicles.
7. The method according to claim 1, characterized in that After determining the candidate normal traffic and abnormal traffic in the real-time network traffic based on the historical filtering traffic and the preset traffic detection model by the vehicle, the method further includes: The abnormal traffic is stored as historical filtered traffic through the edge server; wherein the historical filtered traffic is stored based on a preset Bloom filter.
8. A distributed collaborative detection system, characterized in that: The distributed collaborative detection system comprises: an edge server and at least two vehicles; The vehicle is used to determine candidate normal traffic and abnormal traffic in real-time network traffic based on historical filtered traffic and a preset traffic detection model, obtain model parameters of the preset traffic detection model, and send the candidate normal traffic, the abnormal traffic and the model parameters to the edge server; The edge server is configured to update the global detection model according to the model parameters, determine the first abnormal traffic in the candidate normal traffic based on the updated global detection model, and use the abnormal traffic and the first abnormal traffic as target abnormal traffic; The edge server is used to send the updated global detection model to each of the vehicles, so that the vehicle uses the updated global detection model as the preset traffic detection model to continue to perform the operation of determining candidate normal traffic and abnormal traffic in real-time network traffic.
9. The system according to claim 8, characterized in that The distributed collaborative detection system further includes: a cloud server; The cloud server is used to obtain candidate normal traffic and target abnormal traffic, and determine normal traffic according to the candidate normal traffic and target abnormal traffic; The cloud server is used to aggregate the normal traffic and the target abnormal traffic to construct global threat intelligence; The cloud server is used to generate a global security policy according to the target abnormal traffic, and synchronize the global security policy to the vehicle and the edge server.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the distributed collaborative detection method according to any one of claims 1 to 7 when executed.