Vehicle-mounted vulnerability clustering method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of vehicle networking security, in particular to a vehicle-mounted vulnerability clustering method and device, electronic equipment and a storage medium, and the method comprises the steps: determining a to-be-clustered vulnerability list, and obtaining a quintuple description of each to-be-clustered vulnerability, the quintuple description of each to-be-clustered vulnerability comprising a plurality of elements; constructing a generalization hierarchical structure for each element in the quintuple description of each to-be-clustered vulnerability to obtain the generalization hierarchical structure of each element; and on the basis of a preset K-Modes clustering algorithm, according to the generalization hierarchical structure of each element, clustering each vulnerability to be clustered to obtain a target clustering result. Therefore, the problems that the key information of the vehicle-mounted vulnerabilities cannot be comprehensively and accurately described and the clustering efficiency is low in the background technology are solved, and efficient classification management and accurate analysis of the vehicle-mounted vulnerabilities are realized.

Description

Technical Field

[0001] This application relates to the technical field of vehicle networking security, and particularly to a method, device, electronic device, and storage medium for clustering vehicle-mounted vulnerabilities. Background Art

[0002] The research on vehicle networking security is an essential key technology in intelligent transportation systems. The research on vehicle networking security issues is the only way to improve road traffic safety and realize intelligent transportation systems. At the same time, since vehicle networking systems use wireless communication technologies, various devices and communication protocols in the system have exploitable vulnerabilities. Therefore, it is urgent to consider the impact of network attacks in related vehicle networking research.

[0003] In related technologies, vulnerability descriptions mostly use single-dimensional methods such as CVSS (Common Vulnerability Scoring System) and Attack Pattern, which are difficult to comprehensively describe key features such as vulnerability triggering conditions, attack techniques and tactics, tool dependencies, and associated impacts, resulting in fragmented vulnerability information and a lack of structured integration. In addition, traditional clustering algorithms (such as hierarchical clustering, density-based clustering algorithms, etc.) mainly target numerical data and are insufficiently adaptable to the discrete characteristics of vehicle-mounted vulnerabilities, making it difficult to efficiently identify potential associations between vulnerabilities and unable to meet the dynamic management requirements of large-scale vulnerability data, which urgently needs to be solved. Summary of the Invention

[0004] This application provides a method, device, electronic device, and storage medium for clustering vehicle-mounted vulnerabilities to solve the problems in the background art that the key information of vehicle-mounted vulnerabilities cannot be comprehensively and accurately described and the clustering efficiency is low, and realizes efficient classification management and precise analysis of vehicle-mounted vulnerabilities.

[0005] The first aspect of the embodiments of this application provides a method for clustering vehicle-mounted vulnerabilities, including the following steps:

[0006] Determine a list of vulnerabilities to be clustered, and obtain the five-tuple description of each vulnerability to be clustered, where the five-tuple description of each vulnerability to be clustered includes multiple elements;

[0007] Construct a generalization hierarchy for each element in the five-tuple description of each vulnerability to be clustered to obtain the generalization hierarchy of each element;

[0008] Based on the preset K-Modes clustering algorithm, cluster each vulnerability to be clustered according to the generalization hierarchy of each element to obtain the target clustering result.

[0009] According to an embodiment of the present application, based on a preset K-Modes clustering algorithm, according to the generalization hierarchy of each element, clustering each vulnerability to be clustered to obtain a target clustering result, including:

[0010] Based on a preset heuristic function, calculate the distance from the generalization hierarchy of each element to the corresponding clustering center, and obtain the generalization attributes of each vulnerability to be clustered according to the calculation results;

[0011] Cluster the vulnerabilities to be clustered that meet the preset clustering conditions according to the distance from the generalization hierarchy of each element to the corresponding clustering center and the generalization attributes of each vulnerability to be clustered, and end the clustering and output the target clustering result until the preset clustering end condition is met.

[0012] According to an embodiment of the present application, the preset heuristic function is:

[0013] fi(v):=SELECT sum(count)FROM T WHERE Ai=a;

[0014] Fi∶=max{fi(v)|v∈Dom(Ai)};

[0015] Wherein, fi(v) is the number of vulnerabilities classified based on a certain five-tuple attribute value among all vulnerabilities, count is the number of vulnerabilities in the currently clustering vulnerability list, T is the temporary vulnerability list, Ai is a certain five-tuple attribute, a is a specific value of a certain five-tuple attribute, Fi is the five-tuple attribute with the largest count, v is the vulnerability composed of five-tuple attributes, and Dom(Ai) is the constructed vulnerability library.

[0016] According to an embodiment of the present application, determining the vulnerability list to be clustered includes:

[0017] Obtain the original description information of multiple vulnerabilities;

[0018] Parse the original description information of the multiple vulnerabilities to obtain multiple target elements of each vulnerability;

[0019] Store each vulnerability based on a preset five-tuple form according to the multiple target elements of each vulnerability to obtain the vulnerability list to be clustered.

[0020] According to an embodiment of the present application, the five-tuple description of each vulnerability to be clustered includes a trigger condition element, a technique and tactic element, an attack tool element, an attack target element, and an attack result element, and the generalization hierarchy is a directed acyclic graph.

[0021] According to the vehicle-mounted vulnerability clustering method of the embodiments of the present application, a list of vulnerabilities to be clustered is determined, and a generalization hierarchy is constructed for each element in the five-tuple description of each vulnerability to be clustered; based on the preset K-Modes clustering algorithm, each vulnerability to be clustered is clustered according to the generalization hierarchy of each element to obtain a target clustering result. Thus, the problems that the key information of vehicle-mounted vulnerabilities cannot be comprehensively and accurately described and the clustering efficiency is low in the background technology are solved, and the efficient classification management and accurate analysis of vehicle-mounted vulnerabilities are realized.

[0022] The second aspect of the embodiments of the present application provides a vehicle-mounted vulnerability clustering device, including:

[0023] An acquisition module, configured to determine a list of vulnerabilities to be clustered and acquire the five-tuple description of each vulnerability to be clustered, where the five-tuple description of each vulnerability to be clustered includes multiple elements;

[0024] A construction module, configured to construct a generalization hierarchy for each element in the five-tuple description of each vulnerability to be clustered to obtain the generalization hierarchy of each element;

[0025] A clustering module, configured to cluster each vulnerability to be clustered based on the preset K-Modes clustering algorithm according to the generalization hierarchy of each element to obtain a target clustering result.

[0026] According to an embodiment of the present application, the clustering module is configured to:

[0027] Based on a preset heuristic function, calculate the distance from the generalization hierarchy of each element to the corresponding clustering center, and obtain the generalization attribute of each vulnerability to be clustered according to the calculation result;

[0028] Cluster the vulnerabilities to be clustered that meet the preset clustering conditions according to the distance from the generalization hierarchy of each element to the corresponding clustering center and the generalization attribute of each vulnerability to be clustered, and end the clustering and output the target clustering result until the preset clustering end condition is met.

[0029] According to an embodiment of the present application, the preset heuristic function is:

[0030] fi(v):=SELECT sum(count)FROM T WHERE Ai=a;

[0031] Fi∶=max{fi(v)|v∈Dom(Ai)};

[0032] Among them, fi(v) is the number of vulnerabilities classified based on a certain five-tuple attribute value among all vulnerabilities, count is the number of vulnerabilities in the currently clustering vulnerability list, T is the temporary vulnerability list, Ai is a certain five-tuple attribute, a is the specific value of a certain five-tuple attribute, Fi is the five-tuple attribute with the largest count, v is the vulnerability composed of five-tuple attributes, and Dom(Ai) is the constructed vulnerability database.

[0033] According to an embodiment of the present application, the obtaining module is used for:

[0034] Obtain the original description information of multiple vulnerabilities;

[0035] Parse the original description information of the multiple vulnerabilities to obtain multiple target elements of each vulnerability;

[0036] Based on the multiple target elements of each vulnerability, store each vulnerability in the form of a preset five-tuple to obtain the list of vulnerabilities to be clustered.

[0037] According to an embodiment of the present application, the five-tuple description of each vulnerability to be clustered includes a trigger condition element, a technique and tactic element, an attack tool element, an attack target element, and an attack result element, and the generalization hierarchy is a directed acyclic graph.

[0038] The vehicle-mounted vulnerability clustering device according to the embodiment of the present application determines a list of vulnerabilities to be clustered, and constructs a generalization hierarchy for each element in the five-tuple description of each vulnerability to be clustered; based on the preset K-Modes clustering algorithm, cluster each vulnerability to be clustered according to the generalization hierarchy of each element to obtain a target clustering result. Thus, the problems that the background technology cannot comprehensively and accurately describe the key information of vehicle-mounted vulnerabilities and the clustering efficiency is low are solved, and the efficient classification management and accurate analysis of vehicle-mounted vulnerabilities are realized.

[0039] An embodiment of the third aspect of the present application provides an electronic device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor executes the program to implement the vehicle-mounted vulnerability clustering method as described in the above embodiment.

[0040] An embodiment of the fourth aspect of the present application provides a computer-readable storage medium, on which a computer program is stored, and the program is executed by a processor to be used to implement the vehicle-mounted vulnerability clustering method as described in the above embodiment.

[0041] Additional aspects and advantages of the present application will be given in part in the following description, become apparent in part from the following description, or be learned through the practice of the present application. Description of the Drawings

[0042] The above and / or additional aspects and advantages of the present application will become apparent and be readily understood from the following description of embodiments in conjunction with the accompanying drawings, where:

[0043] Figure 1 FIG. is a flowchart of a vehicle-mounted vulnerability clustering method provided according to an embodiment of the present application;

[0044] Figure 2 FIG. is a schematic diagram of the crawling process of Tech according to an embodiment of the present application;

[0045] Figure 3 FIG. is a schematic diagram of the generalization relationship of Tool according to an embodiment of the present application;

[0046] Figure 4 FIG. is a block diagram of the generalization relationship of Tool according to an embodiment of the present application;

[0047] Figure 5 FIG. is a flowchart of a vulnerability clustering algorithm based on a generalization hierarchy according to an embodiment of the present application;

[0048] Figure 6 FIG. is a flowchart of building a vulnerability knowledge base and clustering vulnerabilities according to an embodiment of the present application;

[0049] Figure 7 FIG. is an architecture diagram of a vehicle-mounted vulnerability clustering system according to an embodiment of the present application;

[0050] Figure 8 FIG. is a block diagram of a vehicle-mounted vulnerability clustering device according to an embodiment of the present application;

[0051] Figure 9 FIG. is a schematic structural diagram of an electronic device according to an embodiment of the present application. Detailed Embodiments

[0052] The embodiments of the present application will be described in detail below. The examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals denote the same or similar elements or elements with the same or similar functions from beginning to end. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the present application, but should not be construed as limiting the present application.

[0053] The vehicle-mounted vulnerability clustering method, device, electronic device, and storage medium according to the embodiments of the present application will be described below with reference to the accompanying drawings.

[0054] Before introducing the vehicle-mounted vulnerability clustering method according to the embodiments of the present application, the vulnerability formal description method and vulnerability clustering method in the related art will be introduced first.

[0055] In the related art, the main steps of building a vulnerability knowledge base are to formally describe vulnerabilities. Currently, the mainstream methods for formally describing vulnerabilities include the following:

[0056] (1) CVSS: Provides a standardized method to evaluate the severity of vulnerabilities, including factors such as access vector, access complexity, and user interaction.

[0057] (2) Attack Pattern: A description of the strategies, techniques, and procedures that an attacker may use.

[0058] (3) VDL (Vulnerability Description Language): A formal language used to describe the characteristics and behaviors of vulnerabilities, which can include vulnerability trigger conditions, scope of influence, and potential impacts.

[0059] (4) Graph-Based Representation: Utilizes graph theory to represent vulnerabilities, where nodes represent vulnerability-related entities and edges represent the relationships between entities.

[0060] (5) Automata Theory: Uses automata theory, such as finite state machines (FSMs) or regular expressions, to describe the behavioral patterns of vulnerabilities.

[0061] Currently, the mainstream vulnerability clustering methods are as follows:

[0062] (1) Hierarchical clustering algorithm: It depends on the hierarchical structure of the attributes in the given dataset. If the attributes in the given dataset do not have a hierarchical structure, this clustering algorithm cannot be used. There are mainly two strategies for hierarchical clustering algorithms, namely the "bottom-up" strategy and the "top-down" strategy. Classic hierarchical clustering algorithms mainly include the CURE (Clustering Using Representatives) algorithm, the ROCK (RObust Clustering using linKs) algorithm, the BIRCH (Balanced Iterative Reducing and Clustering using Hierarchies) algorithm, etc. The clustering process of the CURE algorithm is mainly divided into four steps. First, samples are randomly selected from the sample set, then the samples are divided into multiple different regions, then local clustering is performed within each region, and finally overall clustering is performed on all samples. The ROCK algorithm is similar to the CURE algorithm and adopts a random sampling strategy. At the same time, the influence of surrounding objects on points is introduced to calculate the distance between points. The BIRCH algorithm performs clustering based on the clustering feature tree. The clustering result depends on the order in which data nodes are inserted into the tree. In each iteration, similar clusters are merged and outliers are removed.

[0063] (2) Density-based clustering algorithm: It is necessary to determine the density of a point set in a region. When the density is greater than a certain threshold, the points in the region are considered as a cluster, and the region can have different shapes. Classic density clustering algorithms include DBSCAN (Density-Based Spatial Clustering of Applications with Noise), GDBSCAN (Generalized Density-Based Spatial Clustering of Applications with Noise), and OPTICS (Ordering Points To Identify the Clustering Structure). The DBSCAN algorithm first finds an arbitrary point in a given data set, and searches for nearby points from this point. If the density of points in a given range can meet the index, the points in this range can be classified into one class. The GDBSCAN algorithm is an improvement on the DBSCAN algorithm. It further abstracts the concept of neighborhood in the DBSCAN algorithm. This method can better adapt to the characteristics of spatial objects. The OPTICS algorithm is also an improvement on the DBSCAN algorithm. By setting different parameters, clustering results that meet user needs can be obtained.

[0064] Although the above methods have achieved certain results in vulnerability description and clustering, the existing vulnerability description methods are mostly single-dimensional and cannot fully and accurately characterize the complex characteristics of vehicle-mounted vulnerabilities. With the increase in the complexity of vehicle-mounted systems, the number of detected vulnerabilities has increased dramatically. Existing methods are difficult to efficiently manage and analyze large-scale vulnerability data, which brings huge challenges to subsequent vulnerability analysis and management. In addition, the existing clustering algorithms are inefficient when processing categorical data, and cannot effectively identify and manage different types of vehicle-mounted vulnerabilities, making it difficult to meet the real-time and accuracy requirements of vehicle-mounted system security protection. In the study of vehicle-mounted system security, how to effectively establish and manage a vehicle-mounted vulnerability database is a key issue that needs to be solved urgently.

[0065] In response to the above problems, this application proposes a vehicle-mounted vulnerability clustering method to solve the problem that the background technology cannot comprehensively and accurately describe the key information of vehicle-mounted vulnerabilities and the clustering efficiency is low, thereby realizing efficient classification management and accurate analysis of vehicle-mounted vulnerabilities.

[0066] Specifically, Figure 1 A flowchart of a vehicle-mounted vulnerability clustering method provided in an embodiment of the present application.

[0067] As shown Figure 1 in the figure, the vehicle-borne vulnerability clustering method includes the following steps:

[0068] In step S101, a list of vulnerabilities to be clustered is determined, and a five-tuple description of each vulnerability to be clustered is obtained, where the five-tuple description of each vulnerability to be clustered includes multiple elements.

[0069] Further, in some embodiments, determining the list of vulnerabilities to be clustered includes: obtaining the original description information of multiple vulnerabilities; parsing the original description information of multiple vulnerabilities to obtain multiple target elements of each vulnerability; and storing each vulnerability based on a preset five-tuple form according to the multiple target elements of each vulnerability to obtain the list of vulnerabilities to be clustered.

[0070] Specifically, the embodiments of the present application can obtain the original formal description information of vehicle-borne system-related vulnerabilities from a publicly available authoritative vulnerability database (such as the CVE (Common Vulnerabilities & Exposures) vulnerability database, etc.), and the description information contains key information such as the exploitation method and attack consequences of the vulnerabilities.

[0071] Further, a natural language analysis method is used to deeply analyze the above original description information. Specifically, four elements in the five-tuple are extracted according to keywords, including trigger conditions (conditions), attack tools (tool), attack targets (target), and attack results (results). For example, the keyword "base on" corresponds to the condition element, the keyword "utilize" corresponds to the tool element, "against" corresponds to the target element, and "gain" corresponds to the result element.

[0072] Further, on the basis of obtaining the above four five-tuple elements, the embodiments of the present application further use natural language processing technology to obtain the technique and tactics information matching the vulnerability from the Mitre public website as the tech element in the five-tuple. The description method of the vulnerability to be clustered stored in the five-tuple form is as follows:

[0073]

[0074] where V t represents that exploiting a certain vulnerability (atomic attack) requires under the condition, implementing the λ tactic, using the δ tool, attacking σ, and the subsequent result finally obtained is λ ∈ Tech, where Tech is the set of network attack techniques and tactics in the ATT&CK framework. δ ∈ Tool, where Tool is the set of penetration tools that an attacker may use or the network attack weapon library. σ ∈ Tar, where Tar is the set of targets that can be attacked in the system. is the prerequisite for exploiting vulnerabilities are the consequences after exploiting vulnerabilities (atomic attacks).

[0075] Meanwhile, in order to automatically generate other attributes of the five-tuple, the following steps need to be executed: (1) Identify target information. (2) Clause and word segmentation. (3) Keyword screening. (4) Semantic analysis. (5) Information extraction. (6) Final formatted output.

[0076] Furthermore, based on the preset five-tuple format, organize vulnerabilities and build a vulnerability knowledge base. The five-tuple includes the trigger conditions conditions, attack techniques and tactics tech, attack tools tool, attack results results, and attack targets target, and the output is a list of vulnerabilities to be clustered.

[0077] Thus, the embodiment of the present application proposes a five-tuple-based vehicle-mounted vulnerability information modeling method, which can more comprehensively and meticulously capture and depict the key feature information of vehicle-mounted vulnerabilities, including trigger conditions, exploitation techniques, attack tools, attack targets, and their results, etc. Compared with the traditional single-dimensional description, this structured five-tuple model can more accurately reflect the actual situation of vehicle-mounted vulnerabilities and provide a solid data foundation for subsequent vulnerability analysis and management.

[0078] In step S102, construct a generalization hierarchy for each element in the five-tuple description of each vulnerability to be clustered, and obtain the generalization hierarchy of each element.

[0079] Among them, in some embodiments, the five-tuple description of each vulnerability to be clustered includes a trigger condition element, a technique and tactics element, an attack tool element, an attack target element, and an attack result element, and the generalization hierarchy is a directed acyclic graph.

[0080] Specifically, construct a generalization hierarchy of the vulnerability library to hierarchically abstract the vehicle-mounted system vulnerability information. This generalization hierarchy presents a data structure of a directed acyclic graph, which can hierarchically express the vulnerability five-tuple information from specific to abstract. In this structure, the root node represents the overall abstraction of the entire vulnerability set, and the lower-level nodes represent more specific vulnerability information. This hierarchical structure is conducive to more refined management and analysis of vulnerabilities. When there is only one node for the abstraction of each data, it constitutes a generalization hierarchy tree.

[0081] According to the vulnerability description method to be clustered proposed by the embodiment of the present application A vulnerability to be clustered has 5 attributes: trigger conditions, attack techniques and tactics (tech), attack tools (tool), attack results (results), and attack targets (target). Each attribute can take different values, which are discrete and come from 4 different sets, namely the Tech set, the Tool set, the Target set, and the attr set. For these 4 sets, their respective generalization hierarchies can be constructed and the corresponding generalization hierarchy files can be written. Each generalization hierarchy helps to better organize and understand the hierarchical relationships between these elements and ensure the identification of potential similarities during clustering.

[0082] For λ ∈ Tech, the known ATT&CK cyber-attack model framework is a matrix and already has a logical hierarchical structure. Through web crawler technology, the latest ATT&CK cyber-attack model framework matrix can be directly obtained, and the Tech set can be obtained while generating the corresponding generalization hierarchy.

[0083] Specifically, as Figure 2 shown, for the crawling process of Tech, first, the web content of the specified URL (e.g., `https: / / attack.mitre.org`) is obtained by sending a network request. Then, the obtained HTML content is parsed using the `BeautifulSoup` library. After parsing, the nested `` tag information in the HTML code is recursively extracted through the defined `extract_data(soup)` function, and each nested `` tag corresponds to a level. Finally, the extracted information is saved to a file named `attNck.xml`. The whole process realizes the automatic extraction of structured data from the web page and saves it in XML format for subsequent data processing and analysis.

[0084] For δ ∈ Tool, the file stores the generalization hierarchy of the relationships between the exploited attack weapons. To obtain this content, it is first necessary to have a sufficient understanding of the attack weapons on the attacker's machine.

[0085] For σ ∈ Target, the file stores the generalization hierarchy of the targets that can be attacked. This structure is relatively simple and is mainly a tree diagram formed by the network topologies of the attacked parties.

[0086] For c ∈ attr, the file stores the generalization hierarchy composed of all the attack conditions and attack results of this vulnerability. The attack results (results) caused by an attack on a certain vulnerability may serve as the pre-trigger conditions (conditions) for triggering another vulnerability. Therefore, the trigger conditions (conditions) and attack results (results) can be generalized together.

[0087] For δ ∈ Tool, σ ∈ Target, and c ∈ attr, the construction of these three generalization levels requires collecting various types of information for each vulnerability to be clustered. Then, through certain manual operations, the abstract-concrete relationships of each element are analyzed, and the generalization level structure in each file is analyzed. Taking Tool as an example, the final generated generalization relationships are as follows Figure 3 and Figure 4 as shown. As Figure 3 shown Figure 3 shows the generalization relationship level of the Tool construction in an embodiment of the present application. By deeply analyzing the relationships between elements at the abstract and concrete levels, the Tool of <level_1> technical and tactical instances contains two components at the <level_2> level, namely Command and Fireware; under each <level_2> level, specific technical and tactical instances are further subdivided, that is, <level_3>. Figure 4 An intuitive tree structure (directed acyclic graph (DAG)) vividly reveals this generalization level relationship. The arrow direction points from the abstract node (parent node) to the concrete node (child node) to ensure no circular dependencies. With the help of the hierarchical structure, the internal relationships between elements are organized and understood more effectively, thereby capturing and identifying potential similarities during the clustering process.

[0088] In step S103, based on the preset K-Modes clustering algorithm, each vulnerability to be clustered is clustered according to the generalization level structure of each element to obtain the target clustering result.

[0089] Furthermore, in some embodiments, based on the preset K-Modes clustering algorithm, each vulnerability to be clustered is clustered according to the generalization level structure of each element to obtain the target clustering result, including: calculating the distance from the generalization level structure of each element to the corresponding clustering center based on a preset heuristic function, and obtaining the generalization attribute of each vulnerability to be clustered according to the calculation result; clustering the vulnerabilities to be clustered that meet the preset clustering conditions according to the distance from the generalization level structure of each element to the corresponding clustering center and the generalization attribute of each vulnerability to be clustered, and ending the clustering and outputting the target clustering result until the preset clustering end condition is met.

[0090] Specifically, based on the previously constructed five-tuple vulnerability description model, the embodiments of the present application adopt an improved K-Modes clustering algorithm to effectively cluster similar in-vehicle system vulnerabilities. Different from the traditional K-Means algorithm that can only process numerical data, the K-Modes algorithm can process discrete feature data formalized in natural language, and realizes clustering by calculating the matching similarity between different vulnerabilities. This algorithm continuously iteratively optimizes the initial grouping and finally obtains the vulnerability clustering result that meets the conditions.

[0091] Thus, the constructed vehicle-borne vulnerability information library is effectively classified by adopting the k-modes clustering algorithm. The k-modes algorithm can efficiently cluster categorical data and is applicable to the analysis and classification of vehicle-borne vulnerability information in the form of quintuples. Through cluster analysis, different types of vehicle-borne vulnerabilities can be identified and managed, providing an important basis for subsequent targeted protection measures.

[0092] Furthermore, the embodiment of the present application designs a preset heuristic function to guide each step of the generalization decision of the clustering algorithm. The preset heuristic function is used to select the attribute with the highest degree of generalization for clustering, that is, among all the vulnerabilities to be clustered, the attribute with the most occurrences of a certain attribute value. Through this preset heuristic function, the clustering algorithm can classify as many vulnerabilities to be clustered into the same category as possible at each step.

[0093] Furthermore, run the above clustering algorithm to obtain the final vulnerability clustering result. Since the generalization hierarchy Gi may not be a tree structure, the algorithm randomly selects a parent node for generalization. Each vulnerability object will save a set coverlist, which means that each vulnerability initially only represents itself in a generalized way. At the same time, a preset heuristic function is used to select one of the i as A i and replace the A i value of all vulnerabilities in L with the parent value of A i in its generalization hierarchy G

[0094] If A i is or then generalize each attribute value in the set, and judge whether there is an inclusion relationship between the attributes in the set at each step. If there is an inclusion relationship, merge the two attributes. Scan all the vulnerabilities at this time. If the attributes of two vulnerabilities are exactly the same, add the coverlist of the second vulnerability to the coverlist of the first vulnerability and delete the second vulnerability from the vulnerability formal description table.

[0095] Repeat the above steps. When the preset coverage rate threshold is reached, the algorithm terminates and outputs the final clustering result. This method can effectively classify and manage the vehicle-borne system vulnerabilities, providing valuable reference for subsequent security protection.

[0096] Specifically, the vulnerability clustering method based on the preset k-modes algorithm proposed in the embodiments of the present application clusters vulnerabilities mainly based on the generalization hierarchy and the heuristic function during the clustering process. Set the parameter minimum coverage ratio p, which means that it is not necessary for all classes to reach the minimum coverage before ending the clustering. When the number of vulnerabilities in some classes reaches the index, the clustering can be stopped. At the same time, set the minimum number of covered vulnerabilities ms0 as the min_size value initially entered by the user. Then, in the worst case, the clustering ends after only O(log(ms0)) iterations.

[0097] As Figure 5 shown, the algorithm represented by this flowchart is a vulnerability clustering algorithm based on the generalization hierarchy, aiming to merge similar vulnerabilities through the generalization hierarchy and finally output a set of generalized vulnerabilities that meet the minimum coverage rate condition.

[0098] Specifically, copy the list L of vulnerabilities to be clustered to T, where T is a temporary vulnerability list used to store the vulnerabilities in the clustering. For each vulnerability v to be clustered in T, initialize the coverage count v[count]:=1.

[0099] Further, start generalization. When the number of vulnerabilities with a coverage count v[count] greater than min_size and the ratio of the coverage count v[count] to the temporary vulnerability list T is less than the minimum coverage ratio p, the loop continues, where p is the minimum coverage rate ratio, that is, the ratio of the number of vulnerabilities required to be covered when the algorithm terminates to the total number of vulnerabilities. In each loop, use the heuristic method to select an attribute A that is the closest i . Among them, the auxiliary function of the preset heuristic function used by the algorithm is as follows:

[0100] fi(v):=SELECT sum(count)FROM T WHERE Ai=a;

[0101] Fi:=max{fi(v)|v∈Dom(Ai)};

[0102] Among them, fi(v) is the number of vulnerabilities that use a certain five-tuple attribute value as the classification basis among all vulnerabilities, count is the number of vulnerabilities in the current vulnerability list being clustered, T is the temporary vulnerability list, Ai is a certain five-tuple attribute, a is a specific value of a certain five-tuple attribute, Fi is the five-tuple attribute with the largest count, v is the vulnerability composed of five-tuple attributes, and Dom(Ai) is the constructed vulnerability library.

[0103] Further, fi(v) is used to count the number of vulnerabilities with the value a on the attribute Ai among all vulnerabilities, and Fi is used to calculate the maximum fi(v) on the attribute Ai. The purpose of the preset heuristic function in the embodiments of the present application is to select the Ai with the largest Fi value for generalization. This heuristic function guides which attribute should be selected for generalization in each iteration. Through this preset heuristic function, as many vulnerabilities as possible can be classified into the same category in each step.

[0104] Further, for each vulnerability v to be clustered in T, its attribute A i is generalized to its random parent node in Gi, that is:

[0105] v[A i = a random father of v[A i in G i .

[0106] Further, find all vulnerabilities v and v′ that are the same after generalizing the attributes, and merge them, where v′ is another vulnerability in the temporary vulnerability list T and belongs to the same category as v after the generalization operation. After merging, update the coverage count: v[count] = v[count] + v′[count], and then delete v′ from T.

[0107] Further, output all the generalized vulnerabilities v in T whose coverage counts are greater than min_size. The algorithm finally outputs a set of generalized vulnerabilities with a higher coverage degree by continuously generalizing and merging vulnerabilities. This method helps to reduce the redundancy of vulnerability data and provides a simplified input for further attack chain construction.

[0108] Thus, the embodiments of the present application propose a method for modeling vehicle - mounted vulnerability information based on a five - tuple, which can describe the key features of vehicle - mounted vulnerabilities more structurally and granularly. After constructing the vehicle - mounted vulnerability information library, the present application further uses a preset k - modes clustering algorithm to classify vulnerabilities to effectively identify and manage different types of vehicle - mounted vulnerabilities. It can not only improve the description ability of vehicle - mounted vulnerability information, but also directly provide an available and classified vehicle - mounted vulnerability database for vehicle - mounted security detection personnel in combination with the results of cluster analysis, greatly simplifying the complexity of vehicle - mounted vulnerability analysis and significantly improving the work efficiency of security detection. Through the application of the above - mentioned innovative method, the present application can effectively address the key issues in the research on the security of vehicle - mounted systems and provide important support for the security protection of vehicle - mounted systems.

[0109] To facilitate those skilled in the art to more clearly and intuitively understand the vehicle - mounted vulnerability clustering method proposed by the present application, the following is combined with Figure 6 for detailed description.

[0110] Specifically, asFigure 6 As shown, the process of constructing a vulnerability knowledge base and clustering vulnerabilities provided by this embodiment includes the following steps:

[0111] In S601, organize vulnerabilities in quintuple format and construct a vulnerability knowledge base. The quintuple includes conditions, tech, tool, results, target, etc. of the vulnerability, and the output is a vulnerability list;

[0112] In S602, automatically obtain relevant technique and tactic information from the MITRE ATT&CK framework through web crawler technology, and construct a tech generalization hierarchy;

[0113] In S603, continue to sort out other elements in the quintuple, including tool, results, condition, and target, and construct a corresponding generalization hierarchy for each element. Each generalization hierarchy helps to better organize and understand the hierarchical relationship between these elements, ensuring that potential similarities can be identified during clustering.

[0114] In S604, jointly form the input data with the vulnerability list and generalization hierarchy constructed in the previous steps for the subsequent vulnerability clustering process.

[0115] In S605, calculate the distance from each generalization hierarchy to the clustering center through a heuristic function. The calculation of this distance is to group as similar vulnerabilities as possible. During the calculation process, the algorithm starts from the leaf nodes of the generalization hierarchy and gradually compares the similarity between the vulnerabilities to be clustered and the clustering center;

[0116] In S606, the algorithm continues to compare generalization attributes, gradually generalizing upward, and successively comparing parent nodes and grandparent nodes. If two vulnerabilities are the same at a certain level, they can be grouped into one category. Compare the relationship between the next vulnerability to be clustered and the clustering center one by one, and determine whether they can be grouped into the same category according to the generalization hierarchy;

[0117] In S607, according to the distance, cluster vulnerabilities with the same attribute values into the same group. At this time, the algorithm will also reselect the vulnerability with the smallest ID in the current group as the new clustering center and repeat the above clustering process until all vulnerabilities are classified;

[0118] In S608, when the vulnerability list to be compared is empty, the clustering process ends, and the algorithm outputs the final clustering result. The output result at this time will include several clustering groups, and the vulnerabilities within each group have high similarities in terms of technical characteristics, attack paths, or influence scopes.

[0119] Accordingly, in view of the key issues in the research on the security of in-vehicle systems, the embodiments of this application propose an effective method for modeling and managing in-vehicle vulnerability information. First, it realizes the structured description of vulnerability information. Modeling in-vehicle vulnerabilities using a five-tuple can more comprehensively and meticulously describe the key features of in-vehicle vulnerabilities, such as trigger conditions, exploitation techniques, attack tools, target systems, and damage results, providing an accurate basis for in-vehicle vulnerability data and laying a solid foundation for subsequent analysis and management work. Second, it realizes efficient clustering to identify vulnerability types. Automatically classifying in-vehicle vulnerabilities using the preset K-Modes clustering algorithm can effectively identify and manage different types of in-vehicle vulnerabilities and greatly simplify the complexity of in-vehicle vulnerability analysis, providing a directly usable vulnerability database for security detection personnel. Finally, through the innovative methods of structured description and efficient clustering, the present invention effectively addresses the key issues in the research on the security of in-vehicle systems, provides important support for the security protection of in-vehicle systems, and has important technical and application values.

[0120] The following introduces the overall architecture of a system for constructing and clustering vulnerabilities in a vehicle networking network designed in this application, as Figure 7 shown. This architecture systematically describes the complete process from collecting vulnerability information to generating clustering results, mainly including constructing a vulnerability knowledge base 11, a vulnerability list and generalization hierarchy 12, vulnerability clustering 13, and a vulnerability clustering result 14.

[0121] Specifically, the vulnerability knowledge base 11 is constructed based on information from public technology websites such as CVE, classifying and organizing the collected vulnerability data in the form of a five-tuple to generate a vulnerability list and generalization hierarchy 12. The vulnerability list summarizes all the collected vulnerability information, while the generalization hierarchy classifies and organizes different types of vulnerabilities through a hierarchical structure. On this basis, the obtained vulnerability list and generalization hierarchy 12 serve as the input for vulnerability clustering 13.

[0122] Meanwhile, the vulnerability clustering 13 uses this input data and, according to specific similarity measurement criteria, clusters vulnerabilities with similar features into the same cluster. The goal of this step is to identify groups of vulnerabilities that share commonalities in attack patterns or defense methods, thus simplifying and classifying complex vulnerability information. The output result of the clustering process is called the vulnerability clustering result 14. This result is usually one or more clustering groups, and the vulnerabilities within each group exhibit high similarity in terms of technical implementation, attack routes, or impact levels. These clustering results can provide an important basis for formulating subsequent security protection strategies and contribute important value to enhancing the overall security performance of in-vehicle systems.

[0123] According to the vehicle-mounted vulnerability clustering method of the embodiments of the present application, a list of vulnerabilities to be clustered is determined, and a generalization hierarchy is constructed for each element in the five-tuple description of each vulnerability to be clustered; based on the preset K-Modes clustering algorithm, each vulnerability to be clustered is clustered according to the generalization hierarchy of each element to obtain a target clustering result. Thus, the problems that the background technology cannot comprehensively and accurately describe the key information of vehicle-mounted vulnerabilities and the clustering efficiency is low are solved, and the efficient classification management and accurate analysis of vehicle-mounted vulnerabilities are realized.

[0124] Next, a vehicle-mounted vulnerability clustering device according to an embodiment of the present application will be described with reference to the accompanying drawings.

[0125] Figure 8 It is a block diagram of the vehicle-mounted vulnerability clustering device according to an embodiment of the present application.

[0126] As Figure 8 shown, the vehicle-mounted vulnerability clustering device 10 includes: an acquisition module 100, a construction module 200, and a clustering module 300.

[0127] Among them, the acquisition module 100 is used to determine a list of vulnerabilities to be clustered and obtain the five-tuple description of each vulnerability to be clustered, where the five-tuple description of each vulnerability to be clustered includes multiple elements; the construction module 200 is used to construct a generalization hierarchy for each element in the five-tuple description of each vulnerability to be clustered to obtain the generalization hierarchy of each element; the clustering module 300 is used to cluster each vulnerability to be clustered based on the preset K-Modes clustering algorithm according to the generalization hierarchy of each element to obtain a target clustering result.

[0128] Further, in some embodiments, the clustering module 300 is used to: calculate the distance from the generalization hierarchy of each element to the corresponding clustering center based on a preset heuristic function, and obtain the generalization attribute of each vulnerability to be clustered according to the calculation result; cluster the vulnerabilities to be clustered that meet the preset clustering conditions according to the distance from the generalization hierarchy of each element to the corresponding clustering center and the generalization attribute of each vulnerability to be clustered, and end the clustering and output the target clustering result until the preset clustering end condition is met.

[0129] Further, in some embodiments, the preset heuristic function is:

[0130] fi(v):=SELECT sum(count)FROM T WHERE Ai=a;

[0131] Fi∶=max{fi(v)|v∈Dom(Ai)};

[0132] Among them, fi(v) is the number of vulnerabilities classified based on a certain five-tuple attribute value among all vulnerabilities, count is the number of vulnerabilities in the vulnerability list currently being clustered, T is the temporary vulnerability list, Ai is a certain five-tuple attribute, a is the specific value of a certain five-tuple attribute, Fi is the five-tuple attribute with the largest count, v is the vulnerability composed of five-tuple attributes, and Dom(Ai) is the constructed vulnerability database.

[0133] Further, in some embodiments, the acquisition module 100 is configured to: acquire the original description information of multiple vulnerabilities; parse the original description information of the multiple vulnerabilities to obtain multiple target elements of each vulnerability; and store each vulnerability based on a preset five-tuple form according to the multiple target elements of each vulnerability to obtain a vulnerability list to be clustered.

[0134] Further, in some embodiments, the five-tuple description of each vulnerability to be clustered includes a trigger condition element, a technique and tactic element, an attack tool element, an attack target element, and an attack result element, and the generalization hierarchy is a directed acyclic graph.

[0135] It should be noted that the foregoing explanation of the embodiments of the vehicle-mounted vulnerability clustering method also applies to the vehicle-mounted vulnerability clustering device of this embodiment, and will not be elaborated here.

[0136] According to the vehicle-mounted vulnerability clustering device of the embodiment of the present application, a vulnerability list to be clustered is determined, and a generalization hierarchy is constructed for each element in the five-tuple description of each vulnerability to be clustered; based on a preset K-Modes clustering algorithm, each vulnerability to be clustered is clustered according to the generalization hierarchy of each element to obtain a target clustering result. Thus, the problems that the background technology cannot comprehensively and accurately describe the key information of vehicle-mounted vulnerabilities and the clustering efficiency is low are solved, and the efficient classification management and accurate analysis of vehicle-mounted vulnerabilities are realized.

[0137] Figure 9 The structural schematic diagram of the electronic device provided by the embodiment of the present application. The electronic device may include:

[0138] A memory 901, a processor 902, and a computer program stored on the memory 901 and executable on the processor 902.

[0139] When the processor 902 executes the program, it implements the vehicle-mounted vulnerability clustering method provided in the above embodiment.

[0140] Further, the electronic device further includes:

[0141] A communication interface 903 for communication between the memory 901 and the processor 902.

[0142] A memory 901 for storing a computer program that can run on a processor 902.

[0143] The memory 901 may include a high-speed RAM memory and may also include non-volatile memory, such as at least one disk memory.

[0144] If the memory 901, the processor 902, and the communication interface 903 are implemented independently, the communication interface 903, the memory 901, and the processor 902 can be interconnected through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, Figure 9 only a thick line is used to represent it in the figure, but it does not mean that there is only one bus or one type of bus.

[0145] Optionally, in a specific implementation, if the memory 901, the processor 902, and the communication interface 903 are integrated on a chip, the memory 901, the processor 902, and the communication interface 903 can communicate with each other through an internal interface.

[0146] The processor 902 may be a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0147] The embodiments of the present application also provide a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the vehicle-mounted vulnerability clustering method as described above is implemented.

[0148] In the description of this specification, the description referring to terms such as "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of this application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or N embodiments or examples. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0149] In addition, the terms "first" and "second" are used only for descriptive purposes and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include at least one of such features. In the description of this application, "a plurality" means at least two, such as two, three, etc., unless otherwise specifically and clearly defined.

[0150] Although the embodiments of this application have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting this application. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A vehicle-mounted vulnerability clustering method, characterized in that, Including the following steps: Determine the list of vulnerabilities to be clustered, and obtain the five-tuple description of each vulnerability to be clustered. Among them, the five-tuple description of each vulnerability to be clustered includes multiple elements; Construct a generalization hierarchy for each element in the five-tuple description of each vulnerability to be clustered, and obtain the generalization hierarchy of each element; Based on the preset K-Modes clustering algorithm, cluster each vulnerability to be clustered according to the generalization hierarchy of each element, and obtain the target clustering result.

2. The method according to claim 1, wherein The step of clustering each vulnerability to be clustered according to the generalization hierarchy of each element based on the preset K-Modes clustering algorithm to obtain the target clustering result includes: Based on the preset heuristic function, calculate the distance from the generalization hierarchy of each element to the corresponding clustering center, and obtain the generalization attributes of each vulnerability to be clustered according to the calculation result; Cluster the vulnerabilities to be clustered that meet the preset clustering conditions according to the distance from the generalization hierarchy of each element to the corresponding clustering center and the generalization attributes of each vulnerability to be clustered. When the preset clustering end condition is met, end the clustering and output the target clustering result.

3. The method according to claim 1, wherein The preset heuristic function is: fi(v):=SELECT sum(count)FROM TWHERE Ai=a; Fi∶=max{fi(v)|v∈Dom(Ai)}; Where fi(v) is the number of vulnerabilities that use a certain five-tuple attribute value as the classification basis among all vulnerabilities, count is the number of vulnerabilities in the vulnerability list currently being clustered, T is the temporary vulnerability list, Ai is a certain five-tuple attribute, a is a specific value of a certain five-tuple attribute, Fi is the five-tuple attribute with the largest count, v is the vulnerability composed of five-tuple attributes, and Dom(Ai) is the constructed vulnerability library.

4. The method according to claim 1, wherein The step of determining the list of vulnerabilities to be clustered includes: Obtain the original description information of multiple vulnerabilities; Parse the original description information of the multiple vulnerabilities to obtain multiple target elements of each vulnerability; Based on the multiple target elements of each vulnerability, store each vulnerability in the preset five-tuple form to obtain the list of vulnerabilities to be clustered.

5. The method according to claim 1, characterized in that, The five-tuple description of each vulnerability to be clustered includes a trigger condition element, a technique and tactic element, an attack tool element, an attack target element, and an attack result element, and the generalization hierarchy is a directed acyclic graph.

6. A vehicle-mounted vulnerability clustering device, characterized in that, Including: An acquisition module, configured to determine the list of vulnerabilities to be clustered, and obtain the five-tuple description of each vulnerability to be clustered. Among them, the five-tuple description of each vulnerability to be clustered includes multiple elements; A construction module, configured to construct a generalization hierarchy for each element in the five-tuple description of each vulnerability to be clustered, and obtain the generalization hierarchy of each element; A clustering module, configured to cluster each vulnerability to be clustered according to the generalization hierarchy of each element based on the preset K-Modes clustering algorithm, and obtain the target clustering result.

7. The device according to claim 6, characterized in that, The clustering module is configured to: Based on a preset heuristic function, calculate the distance from the generalization hierarchy of each element to the corresponding cluster center, and obtain the generalization attributes of each vulnerability to be clustered according to the calculation results. Cluster the vulnerabilities to be clustered that meet the preset clustering conditions according to the distance from the generalization hierarchy of each element to the corresponding cluster center and the generalization attributes of each vulnerability to be clustered. When the preset clustering end condition is met, end the clustering and output the target clustering result.

8. The device according to claim 6, characterized in that, The preset heuristic function is: fi(v):=SELECT sum(count)FROM T WHERE Ai=a; Fi∶=max{fi(v)|v∈Dom(Ai)}; Where fi(v) is the number of vulnerabilities classified according to a certain five-tuple attribute value among all vulnerabilities, count is the number of vulnerabilities in the currently clustering vulnerability list, T is the temporary vulnerability list, Ai is a certain five-tuple attribute, a is a specific value of a certain five-tuple attribute, Fi is the five-tuple attribute with the largest count, v is the vulnerability composed of five-tuple attributes, and Dom(Ai) is the constructed vulnerability database.

9. An electronic device, characterized in that, Including: A memory, a processor, and a computer program stored on the memory and executable on the processor. The processor executes the computer program to implement the vehicle-mounted vulnerability clustering method according to any one of claims 1-5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program is executed by the processor to be used to implement the vehicle-mounted vulnerability clustering method according to any one of claims 1-5.

Images