Data comparison system and method of target range test basic platform

Abstract

The invention provides a data comparison system and method for a target range test basic platform, and the system comprises a data transfer module which is used for connecting each simulation platform, a knowledge base and a database, and carrying out the data type conversion of data needing to be distributed according to a protocol rule; the traffic analysis module is used for analyzing the captured traffic characteristic data; the behavior analysis module is used for extracting and analyzing terminal behaviors; the correlation analysis module is used for analyzing space and time correlation of traffic and behaviors; the deep learning module is used for clustering and learning comparison results generated by the flow analysis module, the behavior analysis module and the correlation analysis module; and the visualization module is used for displaying each comparison result. According to the invention, a complex intelligent automobile network simulation result is analyzed and mined through a data comparison mode, so that the network security of the intelligent automobile is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of automobile network range, and in particular to a data comparison system and a comparison method for a range test basic platform. Background Art

[0002] As an important supporting technology in the process of automobile product development, CAE technology plays a vital role in ensuring the comprehensive performance of automobiles, shortening the automobile development cycle, and saving costs. Before entering the era of intelligent connected vehicles, automobile simulation mainly focused on hardware reliability and performance such as acceleration, sliding, and braking. With the development of automobile intelligence, user privacy and digital security have received more and more attention, and may even become the core competitiveness of automobiles in the future.

[0003] The network range is a virtual simulation technology that simulates and reproduces the operating status and operating environment of network architecture, system equipment, and business processes in real cyberspace. It can conduct attack and defense drills and verify the security, stability, and effectiveness of smart devices. The range test basic platform is used to test the information transmission of automobiles in the Internet of Vehicles and the security and reliability of smart networked devices. The range test basic platform includes multiple systems such as data management, data comparison, data search, and knowledge base. Among them, data comparison includes (1) verification comparison between simulation data and actual data to determine the authenticity and effectiveness of simulation results; (2) comparison between simulation results of multiple nodes to explore the correlation in complex network systems.

[0004] The intelligent vehicle network (IOV) is a complex network structure, including multiple interactions between smart cars, between on-board smart devices and other devices, and between mobile devices and transportation facilities. Each network node will move and interact with the network constantly. After simulating this complex situation, a data comparison method is also needed to analyze the simulation results.

[0005] Based on this, the present application proposes a data comparison system and comparison method for a range test basic platform for automobile network range tests. Summary of the invention

[0006] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a data comparison system and comparison method for a basic platform for a range test. This is achieved specifically through the following technical solutions:

[0007] A data comparison system for a range test basic platform, comprising:

[0008] Data transfer module: used to connect various simulation platforms, knowledge bases, and databases, and convert the data types of the data to be distributed according to the protocol regulations;

[0009] Traffic analysis module, used to analyze the captured traffic characteristic data;

[0010] Behavior analysis module, used to extract and analyze terminal behavior;

[0011] Correlation analysis module, used to analyze the spatial and temporal correlation of traffic and behavior;

[0012] The deep learning module clusters and learns the comparison results generated by the traffic analysis module, behavior analysis module, and association analysis module;

[0013] Visualization module, used to display the comparison results.

[0014] Optionally or preferably, the data transfer module includes the following submodules:

[0015] Data distribution interaction module, which performs data distribution interaction according to the protocol;

[0016] Network module, used to configure traffic and bandwidth for each simulation platform, knowledge base, and database;

[0017] The data switch provides a physical interface for data interaction between each module.

[0018] Optionally or preferably, the traffic characteristic data includes but is not limited to IP address, port number, protocol type, data packet size, and transmission speed; the traffic analysis module compares the traffic characteristic data captured in real time with the rules in the knowledge base, and when the traffic characteristic data matches any abnormal or attack behavior rule, it can be considered that abnormal traffic or attack behavior has been detected.

[0019] Optionally or preferably, the behavior analysis module parses the log information, extracts the terminal behavior, and determines whether there is a security threat; the terminal behavior includes but is not limited to login behavior, file operations, and process activities.

[0020] Optionally or preferably, the deep learning module includes the following sub-modules:

[0021] Data processing module, pre-processing the data;

[0022] Learning network models, performing training processes through convolutional neural networks or recurrent neural networks, and gradually optimizing the learning model;

[0023] Report generation module: used to generate a simulation analysis report; the simulation analysis report includes detailed information on abnormal events and attack behaviors, and analysis results of the traffic analysis module, behavior analysis module, and correlation analysis module.

[0024] The present invention also provides a data comparison method for a shooting range test basic platform, based on the data comparison system of the shooting range test basic platform, comprising the following steps:

[0025] S1. Data collection: Collect data generated during the attack and defense competition and exercises in the network range

[0026] S2, data processing: standardize the data collected in step S1;

[0027] S3, data verification: check whether the deviation between the simulation results of the sample data and the actual measurement of the system is within the expected threshold;

[0028] S4, data distribution: distribute the standardized data to the traffic analysis module and the behavior analysis module;

[0029] S5, traffic and behavior comparison: the traffic analysis module receives data, extracts traffic feature data from the data, instructs the data transfer module to call the knowledge base, matches the traffic feature data with the rules in the knowledge base, and stores the traffic feature data matching the rules as abnormal traffic data in the traffic analysis module; the behavior analysis module receives data, extracts terminal behavior from the data, instructs the data transfer module to call the knowledge base, matches the terminal behavior with the rules in the knowledge base, and stores the terminal behavior matching the rules as abnormal behavior data in the behavior analysis module;

[0030] S6. Association comparison, including:

[0031] Time correlation analysis:

[0032] The indication data transfer module calls the abnormal traffic data in the traffic analysis module, and according to the timestamp of the abnormal traffic data, the indication data transfer module sequentially calls the terminal behavior in the simulation platform, and analyzes the time correlation between the abnormal traffic and the behavior based on the correlation;

[0033] The instruction data transfer module calls the abnormal behavior data in the behavior analysis module, and according to the timestamp of the abnormal behavior data, the instruction data transfer module sequentially calls the terminal flow data in the simulation platform, and analyzes the time correlation between the abnormal behavior and the flow based on the correlation;

[0034] Spatial correlation analysis:

[0035] According to the network node where the abnormal traffic data is located, the data transfer module is instructed to call the traffic characteristic data of the adjacent network nodes one by one, and the spatial correlation of the abnormal traffic data is analyzed by the spatial correlation analysis method;

[0036] According to the network node where the abnormal behavior data is located, the data transfer module is instructed to call the terminal behavior of the adjacent network nodes one by one, and the spatial correlation of the terminal behavior is analyzed by the spatial correlation analysis method;

[0037] S7, the data transfer module imports the analysis results of the traffic analysis module, the behavior analysis module and the association analysis module into the deep learning module and the visualization module;

[0038] S8. The deep learning module executes the learning task, generates a simulation report, and displays the simulation report in the visualization module.

[0039] Based on the above technical solution, the data comparison system of a shooting range test basic platform provided by the present invention can produce the following technical effects:

[0040] 1. The data comparison system of a shooting range test basic platform provided by the present invention has high versatility and expansibility. As a rapidly developing field, shooting range test has various simulation platforms and software that are constantly being updated. The system interacts with the simulation platform through a data transfer module, and each simulation platform is independent of each other and will not be affected by each other.

[0041] 2. By setting up traffic analysis modules, behavior analysis modules and correlation analysis modules, attack events and abnormal situations can be mined and analyzed from multiple angles, which helps to discover potential risks in complex Internet of Vehicles, thereby improving the network security of smart cars.

[0042] The data comparison method of a shooting range test basic platform provided by the present invention can produce the following technical effects:

[0043] 1. Provide strong support for the network security assessment of automotive intelligent devices and provide a reliable decision-making basis for security deployment;

[0044] 2. It can analyze the simulation results of complex vehicle-connected networks and explore the possible mutual influence relationships between multiple network nodes, thus helping to build a dot matrix protection network. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0046] Figure 1 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0047] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Embodiment 1:

[0050] The present invention provides a data comparison system for a shooting range test basic platform, comprising:

[0051] Data transfer module: used to connect various simulation platforms, knowledge bases, and databases, and convert the data types of the data to be distributed according to the protocol regulations;

[0052] Traffic analysis module, used to analyze the captured traffic characteristic data;

[0053] Behavior analysis module, used to extract and analyze terminal behavior;

[0054] Correlation analysis module, used to analyze the spatial and temporal correlation of traffic and behavior;

[0055] The deep learning module clusters and learns the comparison results generated by the traffic analysis module, behavior analysis module, and association analysis module;

[0056] Visualization module, used to display the comparison results.

[0057] In this embodiment, the data transfer module includes the following submodules:

[0058] Data distribution interaction module, which performs data distribution interaction according to the protocol;

[0059] Network module, used to configure traffic and bandwidth for each simulation platform, knowledge base, and database;

[0060] The data switch provides a physical interface for data interaction between each module.

[0061] In this embodiment, the traffic characteristic data includes but is not limited to IP address, port number, protocol type, data packet size, and transmission speed; the traffic analysis module compares the traffic characteristic data captured in real time with the rules in the knowledge base. When the traffic characteristic data matches any abnormal or attack behavior rule, it can be considered that abnormal traffic or attack behavior has been detected.

[0062] In this embodiment, the behavior analysis module parses the log information, extracts the terminal behavior, and determines whether there is a security threat; the terminal behavior includes but is not limited to login behavior, file operation, and process activity.

[0063] In this embodiment, the association analysis module includes time association and space association; the time association is to perform association analysis on the traffic feature data and terminal behavior at different time points to find out the abnormal time series and patterns; the space association analyzes the network topology in the target range to find out the association relationship between different network nodes and network terminals.

[0064] In this embodiment, the deep learning module includes the following sub-modules:

[0065] The data processing module pre-processes the data, including cleaning, detecting and deleting duplicate items, filling missing values, and reducing the dimension of the data, so as to improve the efficiency of data processing;

[0066] Learning network models, performing training processes through convolutional neural networks or recurrent neural networks, and gradually optimizing the learning model;

[0067] Report generation module: used to generate simulation analysis reports; the simulation analysis reports include detailed information on abnormal events and attack behaviors, analysis results of the traffic analysis module, behavior analysis module and correlation analysis module; the reports can provide strong support for the security protection of the network target range and help analysts quickly respond to and handle security incidents.

[0068] This embodiment also provides a data comparison method for a shooting range test basic platform, based on the data comparison system of the shooting range test basic platform, comprising the following steps:

[0069] S1. Data collection: Collect data generated during the attack and defense competition and exercises in the network range

[0070] S2, data processing: standardizing the data collected in step S1; the standardization processing includes but is not limited to cleaning, deleting duplications, filling missing values ​​and data dimensionality reduction, so as to improve the efficiency of data processing;

[0071] S3, data verification: check whether the deviation between the simulation results of the sample data and the actual measurement of the system is within the expected threshold;

[0072] S4, data distribution: distribute the standardized data to the traffic analysis module and the behavior analysis module;

[0073] S5, traffic and behavior comparison: the traffic analysis module receives data, extracts traffic feature data from the data, instructs the data transfer module to call the knowledge base, matches the traffic feature data with the rules in the knowledge base, and stores the traffic feature data matching the rules as abnormal traffic data in the traffic analysis module; the behavior analysis module receives data, extracts terminal behavior from the data, instructs the data transfer module to call the knowledge base, matches the terminal behavior with the rules in the knowledge base, and stores the terminal behavior matching the rules as abnormal behavior data in the behavior analysis module;

[0074] S6. Association comparison, including:

[0075] Time correlation analysis:

[0076] The indication data transfer module calls the abnormal traffic data in the traffic analysis module, and according to the timestamp of the abnormal traffic data, the indication data transfer module sequentially calls the terminal behavior in the simulation platform, and analyzes the time correlation between the abnormal traffic and the behavior based on the correlation;

[0077] The instruction data transfer module calls the abnormal behavior data in the behavior analysis module, and according to the timestamp of the abnormal behavior data, the instruction data transfer module sequentially calls the terminal flow data in the simulation platform, and analyzes the time correlation between the abnormal behavior and the flow based on the correlation;

[0078] Spatial correlation analysis:

[0079] According to the network node where the abnormal traffic data is located, the data transfer module is instructed to call the traffic characteristic data of the adjacent network nodes one by one, and the spatial correlation of the abnormal traffic data is analyzed by the spatial correlation analysis method;

[0080] According to the network node where the abnormal behavior data is located, the data transfer module is instructed to call the terminal behavior of the adjacent network nodes one by one, and the spatial correlation of the terminal behavior is analyzed by the spatial correlation analysis method;

[0081] S7, the data transfer module imports the analysis results of the traffic analysis module, the behavior analysis module and the association analysis module into the deep learning module and the visualization module;

[0082] S8. The deep learning module executes the learning task, generates a simulation report, and displays the simulation report in the visualization module.

[0083] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A data comparison system for a range test basic platform, characterized in that: include: Data transfer module: used to connect various simulation platforms, knowledge bases, and databases, and convert the data types of the data to be distributed according to the protocol regulations; Traffic analysis module, used to analyze the captured traffic characteristic data; Behavior analysis module, used to extract and analyze terminal behavior; Correlation analysis module, used to analyze the spatial and temporal correlation of traffic and behavior; The deep learning module clusters and learns the comparison results generated by the traffic analysis module, behavior analysis module, and association analysis module; Visualization module, used to display the comparison results.

2. The data comparison system of a shooting range test basic platform according to claim 1, characterized in that: The data transfer module includes the following submodules: Data distribution interaction module, which performs data distribution interaction according to the protocol; Network module, used to configure traffic and bandwidth for each simulation platform, knowledge base, and database; The data switch provides a physical interface for data interaction between each module.

3. The data comparison system of a shooting range test basic platform according to claim 1, characterized in that: The traffic characteristic data includes but is not limited to IP address, port number, protocol type, data packet size, and transmission speed; the traffic analysis module compares the traffic characteristic data captured in real time with the rules in the knowledge base. When the traffic characteristic data matches any abnormal or attack behavior rule, it can be considered that abnormal traffic or attack behavior has been detected.

4. The data comparison system of a shooting range test basic platform according to claim 1, characterized in that: The behavior analysis module parses the log information, extracts the terminal behavior, and determines whether there is a security threat; the terminal behavior includes but is not limited to login behavior, file operation, and process activity.

5. The data comparison system of a shooting range test basic platform according to claim 1, characterized in that: The correlation analysis module includes time correlation and space correlation; the time correlation is to correlate the traffic feature data and terminal behavior at different time points to find out the abnormal time series and rules; the space correlation is to find out the correlation relationship between different network nodes and network terminals by analyzing the network topology structure in the target range.

6. The data comparison system of a shooting range test basic platform according to claim 1, characterized in that: The deep learning module includes the following sub-modules: Data processing module, pre-processing the data; Learning network models, performing training processes through convolutional neural networks or recurrent neural networks, and gradually optimizing the learning network models; Report generation module: used to generate a simulation analysis report; the simulation analysis report includes detailed information on abnormal events and attack behaviors, and analysis results of the traffic analysis module, behavior analysis module, and correlation analysis module.

7. A data comparison method for a shooting range test basic platform, based on the data comparison system for a shooting range test basic platform as claimed in any one of claims 1 to 6, characterized in that: The following steps are involved: S1. Data collection: Collect data generated during the attack and defense competition and exercises in the network range S2, data processing: standardizing the data collected in step S1; S3, data verification: check whether the deviation between the simulation results of the sample data and the actual measurement of the system is within the expected threshold; S4, data distribution: distribute the standardized data to the traffic analysis module and the behavior analysis module; S5, traffic and behavior comparison: the traffic analysis module receives the data, extracts the traffic feature data in the data, instructs the data transfer module to call the knowledge base, matches the traffic feature data with the rules in the knowledge base, and stores the traffic feature data matching the rules as abnormal traffic data in the traffic analysis module; The behavior analysis module receives data, extracts terminal behaviors from the data, instructs the data transfer module to call the knowledge base, matches the terminal behaviors with the rules in the knowledge base, and stores the terminal behaviors that match the rules as abnormal behavior data in the behavior analysis module; S6. Association comparison, including: Time correlation analysis: The indication data transfer module calls the abnormal traffic data in the traffic analysis module, and according to the timestamp of the abnormal traffic data, the indication data transfer module sequentially calls the terminal behavior in the simulation platform, and analyzes the time correlation between the abnormal traffic and the behavior based on the correlation; The instruction data transfer module calls the abnormal behavior data in the behavior analysis module, and according to the timestamp of the abnormal behavior data, the instruction data transfer module sequentially calls the terminal flow data in the simulation platform, and analyzes the time correlation between the abnormal behavior and the flow based on the correlation; Spatial correlation analysis: According to the network node where the abnormal traffic data is located, the data transfer module is instructed to call the traffic characteristic data of the adjacent network nodes one by one, and the spatial correlation of the abnormal traffic data is analyzed by the spatial correlation analysis method; According to the network node where the abnormal behavior data is located, the data transfer module is instructed to call the terminal behavior of the adjacent network nodes one by one, and the spatial correlation of the terminal behavior is analyzed by the spatial correlation analysis method; S7, the data transfer module imports the analysis results of the traffic analysis module, the behavior analysis module and the association analysis module into the deep learning module and the visualization module; S8. The deep learning module executes the learning task, generates a simulation report, and displays the simulation report in the visualization module.

8. The data comparison method of a shooting range test basic platform according to claim 7, characterized in that: When comparing the flow and behavior in step S4, the flow analysis module and the behavior analysis module can be performed simultaneously or in a distributed manner.

9. The data comparison method of a shooting range test basic platform according to claim 7, characterized in that: The spatial association analysis method is one of spatial autocorrelation analysis, spatial clustering analysis, and spatial interpolation analysis.

10. The data comparison method of a shooting range test basic platform according to claim 7, characterized in that: It also includes accuracy checks, specifically: Compare the status of the actual system and the status of the simulated system, and evaluate the authenticity of the simulation environment by checking the differences in the system status; the system status includes but is not limited to system resource usage, process status, and network configuration.

Images