Unknown vulnerability detection method, device and system, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an unknown vulnerability detection method, device and system, electronic equipment and a storage medium, and relates to the technical field of vehicle data security. The method comprises the following steps: acquiring vehicle-mounted data; performing dynamic feature extraction based on the vehicle-mounted data to obtain a feature vector; performing threat level evaluation according to the feature vector to obtain an evaluation result; and performing hierarchical response based on the evaluation result. According to the method, dynamic feature extraction is performed on the unknown vulnerability, and the evaluation result is processed by using a hierarchical response mechanism, so that the processing efficiency is improved, and the problems that the unknown vulnerability cannot be detected and the processing efficiency is low in the existing method are solved.

Description

Technical Field

[0001] The present application relates to the field of vehicle data security technology, and more specifically, to a method, device, system, electronic device, and storage medium for detecting unknown vulnerabilities. Background Art

[0002] Existing vulnerability detection methods, such as matching known vulnerabilities through predefined rules, cannot detect unknown vulnerabilities. In addition, the complex vulnerability detection algorithm is executed on the vehicle side, resulting in large resource consumption of the vehicle CPU and low processing efficiency. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide a method, device, system, electronic device and storage medium for detecting unknown vulnerabilities, dynamically extract features of unknown vulnerabilities, and use a layered response mechanism to process the evaluation results to improve processing efficiency, thereby solving the problem that existing methods cannot detect unknown vulnerabilities and have low processing efficiency.

[0004] In the first aspect, the present application provides an unknown vulnerability detection method, which is applied to an edge server. The method includes: obtaining vehicle-mounted data; performing dynamic feature extraction based on the vehicle-mounted data to obtain a feature vector; performing threat level assessment based on the feature vector to obtain an assessment result; and performing a layered response based on the assessment result.

[0005] In the technical solution of the embodiment of the present application, dynamic feature extraction is performed on the vehicle data to achieve feature extraction of unknown vulnerabilities, thereby responding to unknown attacks; a layered response is performed based on the evaluation results, and processing tasks can be dynamically allocated between the edge server and the cloud. A layered response mechanism is adopted to solve the problem of low processing efficiency caused by large resource consumption.

[0006] In some embodiments, dynamic feature extraction based on the vehicle data to obtain a feature vector includes: performing low-dimensional compression and reconstruction on the vehicle data to obtain a reconstruction result; performing feature extraction on the vehicle data to obtain a term frequency-inverse document frequency matrix; and obtaining a feature vector based on the reconstruction result and the term frequency-inverse document frequency matrix. Unknown features can be extracted using TF-IDF (Term Frequency-Inverse Document Frequency) in combination with an autoencoder.

[0007] In some embodiments, low-dimensional compression and reconstruction are performed on the vehicle data to obtain a reconstruction result, including: during decoding, nonlinearly amplifying feature dimensions whose reconstruction error exceeds a first threshold. Features whose reconstruction error exceeds the threshold are considered abnormal features. By amplifying abnormal features, the sensitivity of detecting new attacks can be increased, thereby improving the accuracy of detection results.

[0008] In some embodiments, performing a threat level assessment based on the feature vector to obtain an assessment result includes: obtaining an abnormal entropy value, a behavioral deviation value, and an attack entropy value of the feature vector; and performing a threat level assessment on the feature vector based on the abnormal entropy value, the behavioral deviation value, and the attack entropy value. Using the three assessment indicators of abnormal entropy value, behavioral deviation value, and attack entropy value to assess the threat level implements a multi-dimensional indicator assessment, improves the accuracy of the assessment results, and thereby reduces the false alarm rate.

[0009] In some embodiments, obtaining the abnormal entropy value, behavior deviation, and attack entropy value of the feature vector includes: the formula of the abnormal entropy value is: ;in, Represents eigenvalues The probability distribution of n represents the number of attacks; the formula for the behavior deviation is: ;in, represents the current eigenvalue, represents the mean of normal behavior characteristics, N Represents the number of attacks; the formula for the attack entropy value is: ;in, F represents the support vector machine classification result of the feature vector, Represents the prior probability of the attack type. The above formula can be used to calculate the abnormal entropy value, behavior deviation, and attack entropy value of the feature vector, thus achieving quantitative evaluation of the feature vector.

[0010] In some embodiments, the threat level of the feature vector is assessed based on the abnormal entropy value, behavioral deviation, and attack entropy value, including: performing a fuzzy operation based on the abnormal entropy value, behavioral deviation, and attack entropy value to obtain a threat risk level. By assessing the threat risk level through the fusion of multi-dimensional indicators, the false alarm rate is reduced.

[0011] In some embodiments, a fuzzy operation is performed based on the magnitude of the abnormal entropy value, the behavioral deviation, and the attack entropy value to obtain a threat risk level, including: determining the threat risk level based on the high, medium, and low values ​​of the abnormal entropy value, the behavioral deviation, and the attack entropy value, wherein the high, medium, and low values ​​of the abnormal entropy value, the behavioral deviation, and the attack entropy value are respectively determined by set range thresholds, and the threat risk level includes high risk, medium risk, and low risk. According to the high, medium, and low values ​​of the evaluation indicators, the high, medium, and low values ​​of the threat risk level are determined by fuzzy fusion of multi-dimensional indicators, thereby reducing the false alarm rate of the threat risk level results and thus reducing maintenance costs.

[0012] In some embodiments, the determining of the threat risk level based on the high, medium, and low of the abnormal entropy value, the behavior deviation, and the attack entropy value includes: if the abnormal entropy value, the behavior deviation, and the attack entropy value are all high, determining the threat risk level to be high risk; if any two of the abnormal entropy value, the behavior deviation, and the attack entropy value are high, determining the threat risk level to be high risk; if any one of the abnormal entropy value, the behavior deviation, and the attack entropy value is high, determining the threat risk level to be medium risk; if the abnormal entropy value, the behavior deviation, and the attack entropy value are all medium, determining the threat risk level to be medium risk; if any two of the abnormal entropy value, the behavior deviation, and the attack entropy value are medium and the other is low, determining the threat risk level to be medium risk; if any one of the abnormal entropy value, the behavior deviation, and the attack entropy value is medium and the other two are low, determining the threat risk level to be low risk; if the abnormal entropy value, the behavior deviation, and the attack entropy value are high and the attack entropy value are all low, determining the threat risk level to be low risk. The process of determining the threat risk level through three evaluation indicators is given, and the threat risk level is comprehensively evaluated using the three evaluation indicators. The accuracy of the evaluation results is improved through multi-dimensional fusion.

[0013] In some embodiments, a tiered response is implemented based on the assessment results, including: if the assessment result is high risk, local blocking is performed; if the assessment result is medium risk, the feature vector is sent to the cloud server for verification and the feature library is dynamically updated based on threat intelligence; if the assessment result is low risk, normal communication is carried out. Computing tasks are dynamically allocated between the vehicle terminal and the cloud server, and local blocking or cloud-based in-depth analysis is performed based on the risk level, avoiding the problem of high resource consumption of the vehicle terminal.

[0014] In some embodiments, the method further includes: obtaining a confidence level of the feature vector; and if the confidence level is greater than a predetermined second threshold, adding the feature vector to the feature library. Updating the feature library in the cloud can utilize the dynamically updated feature library to optimize the detection capabilities of the edge server, improving the efficiency of detecting unknown vulnerabilities.

[0015] Secondly, the present application provides an unknown vulnerability detection device for use with an edge server. The device comprises: a data acquisition module for acquiring vehicle-mounted data; a feature extraction module for dynamically extracting features based on the vehicle-mounted data to obtain feature vectors; a threat assessment module for assessing the threat level based on the feature vectors to obtain assessment results; and a response module for providing a hierarchical response based on the assessment results. By assessing the risk level of unknown vulnerabilities through dynamic feature extraction and adopting a hierarchical response based on the assessment results, the problem of high resource consumption caused by processing all tasks on the vehicle terminal is avoided.

[0016] Thirdly, this application provides an unknown vulnerability detection system, including the aforementioned edge server and cloud server. Dynamic feature extraction and threat level assessment are performed on the edge server, and based on the assessment results, processing tasks are dynamically allocated between the cloud server and edge server to improve processing efficiency.

[0017] In a fourth aspect, the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the above-mentioned unknown vulnerability detection method.

[0018] In a fifth aspect, the present application provides a readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the above-mentioned unknown vulnerability detection method is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A flowchart of an unknown vulnerability detection method provided in an embodiment of the present application; Figure 2 A flow chart of dynamic feature extraction provided in an embodiment of the present application; Figure 3 A flowchart of threat level assessment provided in an embodiment of the present application; Figure 4 A flowchart of updating a feature library based on confidence provided in an embodiment of the present application; Figure 5 A flowchart of a specific implementation of the unknown vulnerability detection method provided in an embodiment of the present application; Figure 6 A structural block diagram of an unknown vulnerability detection device provided in an embodiment of the present application; Figure 7 This is a schematic diagram of the interaction of the unknown vulnerability detection system provided in an embodiment of the present application.

[0021] icon: 110 - data acquisition module; 120 - feature extraction module; 130 - threat assessment module; 140 - response module; 150 - feature library update module. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0023] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0024] Existing vulnerability detection cannot detect unknown vulnerabilities, and detection is performed on the vehicle side through complex algorithms, resulting in long-term high utilization of the vehicle's CPU (Central Processing Unit). This not only affects vehicle performance, but also leads to high resource consumption and low detection efficiency.

[0025] In response to the above technical problems, an embodiment of the present application provides a method for detecting unknown vulnerabilities. The method dynamically extracts features from unknown vulnerabilities to obtain feature vectors, realizes unknown vulnerability feature extraction, and uses feature vectors to perform threat level assessment, determines the threat level of the unknown vulnerability, and performs a layered response based on the assessment results. This method dynamically allocates processing tasks between the vehicle terminal and the cloud server according to different threat levels, improves processing efficiency, and thus avoids the problem of high resource consumption.

[0026] Please see Figure 1 , Figure 1 A flowchart of an unknown vulnerability detection method provided in an embodiment of the present application is applied to an edge server. The method includes the following steps: S110: Acquiring vehicle data; S120: extract dynamic features based on vehicle-mounted data to obtain feature vectors; S130: Perform threat level assessment based on the feature vector to obtain an assessment result; S140: Perform a tiered response based on the evaluation results.

[0027] For example, the edge server can be set up on the vehicle terminal, and can obtain vehicle data from the vehicle terminal in real time for dynamic feature extraction; through dynamic feature extraction, unknown vulnerability features can be generated in real time, which are used to assess the threat level of unknown vulnerabilities such as zero-day vulnerabilities; and a layered response is performed based on the assessment results. The so-called layered response means sending the data to different processing ends for processing based on different assessment results, rather than processing it only on the vehicle terminal.

[0028] A hierarchical response is performed based on the evaluation results, so that processing tasks are dynamically allocated between the vehicle terminal and the cloud server according to different evaluation results, reducing the resource consumption of the vehicle terminal and improving processing efficiency.

[0029] In addition, for example, vehicle-mounted data may include CAN (Controller Area Network) bus data (ID, DLC, Data), ECU (Electronic Control Unit) operation log (module status, error code), and network traffic (IP, port, protocol). This can cover the entire attack surface of the vehicle-mounted system and realize multi-source data collection, avoiding the problem of inaccurate detection results caused by a single data source having blind spots.

[0030] Specifically: CAN bus data: ,in, ID Indicates the message identifier. DLC Indicates the data length (0-8 bytes), Data Represents the payload, Timestamp Indicates the acquisition timestamp. For example, the Vector CANoe tool can be used to acquire bus data.

[0031] ECU operation log: , where Module is the ECU module name (e.g., BMS, MCU), EventType is the event type (e.g., startup, fault), Parameter is the event parameter (e.g., temperature, voltage), and Status is the module status (normal / abnormal). For example, you can obtain ECU logs through the Linux system log module.

[0032] Network traffic: SrcIP is the source IP address, DstIP is the destination IP address, Port is the port number, Protocol is the protocol type (TCP / UDP / HTTP), and Payload is the data payload. For example, you can use the Tcpdump tool to capture network traffic.

[0033] Preprocess the acquired vehicle data: , where Normalize means normalizing the data into floating-point numbers in the range [-1,1], and Anonymize means hashing sensitive information such as VIN (Vehicle Identification Number) and IMEI (International Mobile Equipment Identity).

[0034] Please see Figure 2 , Figure 2 This is a flow chart of dynamic feature extraction. In some embodiments, dynamic feature extraction is performed on vehicle-mounted data to obtain a feature vector, including: S121: Perform low-dimensional compression and reconstruction based on the vehicle data to obtain a reconstruction result; S122: Perform feature extraction based on the vehicle data to obtain a word frequency-inverse document frequency matrix; S123: Obtain a feature vector based on the reconstruction result and the term frequency-inverse document frequency matrix.

[0035] The TF-IDF algorithm and the AutoEncoder are combined to extract the features of unknown vulnerabilities. The feature vector generation can be expressed as: The reconstruction result and the word frequency-inverse document frequency matrix are subjected to feature fusion to obtain a feature vector. For the specific feature fusion method, the np.hstack function can be used.

[0036] For example, the autoencoder uses 1024-dimensional raw data as the input layer, 256-dimensional bottleneck features as the encoding layer, and the decoding layer to reconstruct the raw data. The loss function can be the mean squared error (MSE). As a dynamic feature compressor, it can reduce the dimensionality of the input vehicle data and extract the deep semantic features of the data.

[0037] Among them, the TF-IDF algorithm formula is: ;in, tf ( t , d ) indicates a term t In the documentation d The frequency in idf ( t ) indicates that the term is included t As a static feature extractor, it converts raw CAN bus data (such as OBD-II protocol frames and sensor data streams) into a term frequency-inverse document frequency matrix, addressing data sparsity. The TF-IDF algorithm uses IDF weights to highlight rare but critical fields (such as the frequency of a specific fault code).

[0038] The TF-IDF algorithm and autoencoder are combined to realize dynamic feature extraction of unknown vulnerabilities, so that the unknown vulnerability feature vector can be obtained in real time, which facilitates the subsequent response to attacks of unknown vulnerabilities without relying on known vulnerabilities.

[0039] In some embodiments, low-dimensional compression and reconstruction are performed based on the vehicle-mounted data to obtain a reconstruction result, including: nonlinearly amplifying the feature dimension whose reconstruction error exceeds a first threshold during decoding.

[0040] An abnormal feature amplification module is implemented at the decoder end of the autoencoder to nonlinearly amplify feature dimensions whose reconstruction error exceeds a first threshold. Reconstruction error is a measure of the difference between the original and reconstructed features when the autoencoder reconstructs the input data. Specifically, it is the error generated when the decoder attempts to restore the original data after the autoencoder compresses the input data into a low-dimensional representation. By amplifying abnormal features, the sensitivity to detecting new attacks is increased, thereby improving the accuracy of detection results.

[0041] Please see Figure 3 , Figure 3 FIG. 1 is a flowchart of a threat level assessment. In some embodiments, performing a threat level assessment based on a feature vector to obtain an assessment result includes: S131: Obtaining the abnormal entropy value, behavior deviation, and attack entropy value of the feature vector; S132: Evaluate the threat level of the feature vector based on the abnormal entropy value, the behavior deviation, and the attack entropy value.

[0042] Calculate the evaluation indicators of the feature vector: abnormal entropy value, behavior deviation and attack entropy value, integrate the three evaluation indicators, and comprehensively evaluate the threat level of the feature vector.

[0043] The threat level of feature vectors is evaluated from multiple dimensions, which improves the accuracy of the evaluation results and solves the problem of high false alarm rate.

[0044] In some embodiments, obtaining the abnormal entropy value, behavior deviation, and attack entropy value of the feature vector includes: the formula for the abnormal entropy value is: ;in, Represents eigenvalues The probability distribution of n Indicates the number of attacks; The formula for behavioral deviation is: ;in, represents the current eigenvalue, represents the mean of normal behavior characteristics, N Indicates the number of attacks; The formula for attack entropy is: ; in, F represents the support vector machine classification result of the feature vector, Represents the prior probability of attack type.

[0045] The difference between the current feature and the normal feature is obtained by calculating the abnormal entropy value, behavior deviation and attack entropy value of the feature vector.

[0046] By calculating the abnormal entropy value, behavior deviation and attack entropy value, the characteristic vector evaluation index is quantified, the multi-dimensional evaluation of the characteristic vector is achieved, and the accuracy of the detection results is improved, thereby solving the problem of high false alarm rate.

[0047] In some embodiments, the threat level of the feature vector is evaluated based on the abnormal entropy value, the behavior deviation and the attack entropy value, including: performing fuzzy operation based on the abnormal entropy value, the behavior deviation and the attack entropy value to obtain the threat risk level.

[0048] Fuzzy operation can be expressed as: , where the threat risk levels include high risk, medium risk and low risk. R The values ​​are divided into three ranges, corresponding to the threat risk levels of high risk, medium risk and low risk. R The value triggers different response strategies to achieve layered response.

[0049] In some embodiments, fuzzy operations are performed based on the abnormal entropy value, behavioral deviation and attack entropy value, and the threat risk level is obtained based on the operation results, including: determining the threat risk level based on the high, medium and low abnormal entropy value, behavioral deviation and attack entropy value, wherein the high, medium and low abnormal entropy value, behavioral deviation and attack entropy value are respectively determined by the set range thresholds, and the threat risk level includes high risk, medium risk and low risk.

[0050] The calculated results of the anomaly entropy, behavior deviation, and attack entropy are determined as high, medium, or low based on the corresponding range thresholds. The threat risk level is then determined based on the high, medium, or low values ​​of the anomaly entropy, behavior deviation, and attack entropy. The range threshold is used to classify the anomaly entropy, behavior deviation, and attack entropy values ​​as high, medium, or low. There is no limit on the range threshold.

[0051] By calculating the three evaluation indicators and integrating the calculation results of the three evaluation indicators to obtain the threat level assessment result, the accuracy of the assessment result is improved compared with using a single indicator.

[0052] In some embodiments, the threat risk level is determined based on the high, medium, and low values ​​of the abnormal entropy value, the behavior deviation value, and the attack entropy value, including: if the abnormal entropy value, the behavior deviation value, and the attack entropy value are all high, the threat risk level is determined to be high risk; if any two of the abnormal entropy value, the behavior deviation value, and the attack entropy value are high, the threat risk level is determined to be high risk; if any one of the abnormal entropy value, the behavior deviation value, and the attack entropy value is high, the threat risk level is determined to be medium risk; if the abnormal entropy value, the behavior deviation value, and the attack entropy value are all medium, the threat risk level is determined to be medium risk; if any two of the abnormal entropy value, the behavior deviation value, and the attack entropy value are medium and the other is low, the threat risk level is determined to be medium risk; if any one of the abnormal entropy value, the behavior deviation value, and the attack entropy value is medium and the other two are low, the threat risk level is determined to be low risk; if the abnormal entropy value, the behavior deviation value, and the attack entropy value are high and the attack entropy value are all low, the threat risk level is determined to be low risk.

[0053] Among the three evaluation indicators, the threat risk level is determined according to the number of evaluation indicators with a grade of "high". If none of them are high, the threat risk level is determined according to the number of evaluation indicators with a grade of "medium". That is, the threat risk level is comprehensively assessed by the grades of the three evaluation indicators, thereby improving the accuracy of the evaluation results and solving the problem of high false alarm rate in existing methods.

[0054] In some embodiments, as another implementation, the threat level of the feature vector is assessed based on the abnormal entropy value, the behavior deviation, and the attack entropy value, which can be specifically implemented by a Sigmoid function: ,in, , H, D, A The coefficient represents the weight, which can be defined as needed. No limitation is made here. The output result represents the threat level. RiskLevel The probability ranges from 0 to 1.

[0055] In some embodiments, a layered response is performed based on the assessment results, including: if the assessment result is high risk, performing a local blocking operation; if the assessment result is medium risk, sending the feature vector to the cloud server for verification, and dynamically updating the feature library based on threat intelligence; if the assessment result is low risk, normal communication is performed.

[0056] A tiered response mechanism is employed: high-risk attacks are blocked locally, while medium-risk attacks are verified in the cloud. If the verification result identifies an anomaly (threat intelligence), the signature database is updated based on this anomaly. Based on the assessment results, processing tasks are dynamically allocated between edge and cloud servers, improving detection efficiency. Furthermore, the signature database is dynamically updated in tandem with the cloud, utilizing threat intelligence to further enhance the accuracy of detection results.

[0057] For example, the blocking technology used for local blocking can be CAN bus filtering, ECU sandbox isolation, or other blocking methods, which are not limited here. This implements ID-based filtering: whitelisted IDs are allowed, while blacklisted IDs are blocked. The whitelist consists of predefined normal communication IDs, while the blacklist consists of dynamically generated attack IDs. If the assessment result indicates high risk, the ID corresponding to the feature vector is considered an attack ID and is added to the blacklist, thereby blocking it. ECU sandbox isolation, for example, can restrict network access for abnormal modules and enhance logging levels.

[0058] In some embodiments, the method further includes: obtaining a confidence level of the feature vector; and if the confidence level is greater than a set second threshold, adding the feature vector to the feature library.

[0059] ; in, represents the normal behavior feature set, Indicates the known attack signature set in the signature library.

[0060] For example, see Figure 4 , Figure 4 This is a flowchart for updating a feature library based on confidence. Features with confidence levels greater than a second threshold are added to the library, enabling dynamic updates. If confidence levels are below the second threshold, manual verification can be performed. The second threshold can range from 0.8 to 0.95. Dynamic feature extraction allows for dynamic updates of the feature library, with an update frequency of every 5 minutes, addressing the issue of inaccurate detection results caused by static feature library lags.

[0061] In addition, when the cloud server detects a feature vector of a new unknown vulnerability in the feature library, it automatically triggers the update of the TF-IDF inverse document frequency matrix and retrains the hidden layer weights of the autoencoder to achieve self-evolution of the dynamic feature library.

[0062] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be described clearly and completely below. Figure 5 , Figure 5 This is a specific implementation flow chart of the unknown vulnerability detection method, which specifically includes: S201: The vehicle terminal collects CAN bus data (ID, DLC, Data), ECU operation log (module status, error code), and network traffic (IP, port, protocol) in real time and transmits them to the edge server; S202: The edge server performs dynamic feature extraction on the acquired vehicle data using an autoencoder and IF-IDF algorithm to obtain a feature vector. S203: Perform threat level assessment based on the feature vector to obtain an assessment result; S204: If the assessment result is high risk, local blocking is performed; if it is medium risk, it is sent back to the cloud server for verification and threat intelligence synchronization; if it is low risk, data archiving and normal communication are performed.

[0063] Please see Figure 6 , Figure 6 This is a structural diagram of an unknown vulnerability detection device provided by this application. It should be understood that the device is Figure 1 The method embodiment executed in the embodiment corresponds to the method, and can execute the steps involved in the aforementioned method. The specific functions of the device can be found in the description above. To avoid repetition, detailed description is appropriately omitted here. The device includes but is not limited to: A data acquisition module 110 is used to acquire vehicle-mounted data; A feature extraction module 120 is used to extract dynamic features based on vehicle-borne data to obtain feature vectors; A threat assessment module 130 is configured to perform threat level assessment based on the feature vector and obtain an assessment result; The response module 140 is configured to perform a hierarchical response based on the evaluation results.

[0064] In the technical solution of the embodiment of the present application, dynamic feature extraction is performed on unknown vulnerabilities without relying on known attacks, so that unknown attacks can be dealt with, and a layered response is performed based on the evaluation results without relying entirely on data processing by the on-board terminal, thereby improving detection efficiency.

[0065] According to some embodiments of the present application, the feature extraction module 120 is specifically configured to perform low-dimensional compression and reconstruction based on the vehicle data to obtain a reconstruction result; perform feature extraction based on the vehicle data to obtain a term frequency-inverse document frequency matrix; and obtain a feature vector based on the reconstruction result and the term frequency-inverse document frequency matrix. According to some embodiments of the present application, during decoding, nonlinear amplification is performed on feature dimensions whose reconstruction error exceeds a first threshold.

[0066] According to some embodiments of the present application, the threat assessment module 130 is specifically used to: obtain the abnormal entropy value, behavioral deviation and attack entropy value of the feature vector; perform threat level assessment on the feature vector based on the abnormal entropy value, behavioral deviation and attack entropy value. The specific calculation formulas for the abnormal entropy value, behavioral deviation and attack entropy value have been explained in the above embodiments and will not be repeated here.

[0067] According to some embodiments of the present application, threat level assessment may specifically include: performing fuzzy operations based on the abnormal entropy value, the behavioral deviation, and the attack entropy value, and obtaining the threat risk level based on the operation results. Specifically, the threat risk level is determined based on the high, medium, and low values ​​of the abnormal entropy value, the behavioral deviation, and the attack entropy value, wherein the high, medium, and low values ​​of the abnormal entropy value, the behavioral deviation, and the attack entropy value are respectively determined by set range thresholds, and the threat risk levels include high risk, medium risk, and low risk.

[0068] According to some embodiments of the present application, the specific risk level determination method is as follows: if the abnormal entropy value, the behavior deviation, and the attack entropy value are all high, the threat risk level is determined to be high risk; if any two of the abnormal entropy value, the behavior deviation, and the attack entropy value are high, the threat risk level is determined to be high risk; if any one of the abnormal entropy value, the behavior deviation, and the attack entropy value is high, the threat risk level is determined to be medium risk; if the abnormal entropy value, the behavior deviation, and the attack entropy value are all medium, the threat risk level is determined to be medium risk; if any two of the abnormal entropy value, the behavior deviation, and the attack entropy value are medium and the other is low, the threat risk level is determined to be medium risk; if any one of the abnormal entropy value, the behavior deviation, and the attack entropy value is medium and the other two is low, the threat risk level is determined to be low risk; if the abnormal entropy value, the behavior deviation, and the attack entropy value are high and the attack entropy value are all low, the threat risk level is determined to be low risk.

[0069] According to some embodiments of the present application, the response module 140 is specifically used to: if the assessment result is high risk, perform a local blocking operation; if the assessment result is medium risk, send the feature vector to the cloud server for verification, and dynamically update the feature library based on threat intelligence; if the assessment result is low risk, perform normal communication.

[0070] According to some embodiments of the present application, a feature library updating module 150 is further included, which is specifically used to: obtain the confidence of the feature vector; if the confidence is greater than a set second threshold, add the feature vector to the feature library.

[0071] Please see Figure 7 , Figure 7 This is an interactive diagram of an unknown vulnerability detection system provided in an embodiment of the present application. The present application also provides an unknown vulnerability detection system, which includes the aforementioned edge server and cloud server. The edge server obtains vehicle data from the vehicle terminal in real time, and performs dynamic feature extraction based on the vehicle data to generate a feature vector. A threat level assessment is performed based on the feature vector to obtain an assessment result. If the assessment result is high risk, local blocking is performed; if it is medium risk, in-depth analysis is performed on the cloud server, and the feature library is updated based on threat intelligence to optimize the detection capabilities of the edge server.

[0072] By achieving closed-loop processing of data from edge servers and cloud servers, the detection capability and efficiency of edge servers can be improved.

[0073] The present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the method in any of the aforementioned optional implementations.

[0074] The present application provides a readable storage medium, which stores computer program instructions. When the computer program instructions are read and executed by a processor, the method in any of the aforementioned optional implementations is executed.

[0075] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0076] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the devices, methods, and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment, or a portion of code, and the module, program segment, or a portion of code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0077] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0078] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0079] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0080] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0081] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A method for detecting unknown vulnerabilities, characterized in that: Applied to an edge server, the method includes: Obtain vehicle data; Performing dynamic feature extraction based on the vehicle-borne data to obtain a feature vector; Performing threat level assessment based on the feature vector to obtain an assessment result; A tiered response is developed based on the results of the assessment.

2. The unknown vulnerability detection method according to claim 1, characterized in that: The extracting dynamic features based on the vehicle-borne data to obtain a feature vector includes: Performing low-dimensional compression and reconstruction based on the vehicle-borne data to obtain a reconstruction result; Perform feature extraction based on the vehicle-borne data to obtain a word frequency-inverse document frequency matrix; A feature vector is obtained based on the reconstruction result and the term frequency-inverse document frequency matrix.

3. The unknown vulnerability detection method according to claim 2, characterized in that: The low-dimensional compression and reconstruction based on the vehicle-borne data to obtain a reconstruction result includes: During decoding, nonlinear amplification is performed on the feature dimensions whose reconstruction error exceeds the first threshold.

4. The unknown vulnerability detection method according to claim 1, characterized in that: The step of performing threat level assessment based on the feature vector to obtain an assessment result includes: Obtaining an abnormal entropy value, a behavior deviation value, and an attack entropy value of the feature vector; A threat level assessment is performed on the feature vector based on the abnormal entropy value, the behavior deviation and the attack entropy value.

5. The unknown vulnerability detection method according to claim 4, characterized in that: The obtaining of the abnormal entropy value, behavior deviation and attack entropy value of the feature vector includes: The formula for the abnormal entropy value is: ； in, Represents eigenvalues The probability distribution of n Indicates the number of attacks; The formula for the behavioral deviation is: ； in, represents the current eigenvalue, represents the mean of normal behavior characteristics, N Indicates the number of attacks; The formula for the attack entropy value is: ； in, F represents the support vector machine classification result of the feature vector, Represents the prior probability of attack type.

6. The unknown vulnerability detection method according to claim 4, characterized in that: The threat level assessment of the feature vector based on the abnormal entropy value, the behavior deviation and the attack entropy value includes: A fuzzy operation is performed based on the abnormal entropy value, the behavior deviation and the attack entropy value, and a threat risk level is obtained based on the operation result.

7. The unknown vulnerability detection method according to claim 6, characterized in that: The performing of fuzzy operations based on the abnormal entropy value, the behavior deviation, and the attack entropy value, and obtaining a threat risk level based on the operation result, includes: The threat risk level is determined based on the high, medium and low values ​​of the abnormal entropy value, the behavioral deviation value and the attack entropy value, wherein the high, medium and low values ​​of the abnormal entropy value, the behavioral deviation value and the attack entropy value are respectively determined by set range thresholds, and the threat risk level includes high risk, medium risk and low risk.

8. The unknown vulnerability detection method according to claim 7, characterized in that: The determining of the threat risk level based on the abnormal entropy value, the behavior deviation, and the attack entropy value as high, medium, or low includes: If the abnormal entropy value, behavior deviation, and attack entropy value are all high, the threat risk level is determined to be high risk; If any two of the abnormal entropy value, behavior deviation, and attack entropy value are high, the threat risk level is determined to be high risk; If any one of the abnormal entropy value, behavior deviation, and attack entropy value is high, the threat risk level is determined to be medium risk; If the abnormal entropy value, behavior deviation, and attack entropy value are all medium, the threat risk level is determined to be medium risk; If any two of the abnormal entropy value, behavior deviation, and attack entropy value are medium, and the other one is low, the threat risk level is determined to be medium risk; If any one of the abnormal entropy value, behavior deviation, and attack entropy value is medium, and the other two are low, the threat risk level is determined to be low risk; If the abnormal entropy value and the behavior deviation are high, and the attack entropy value is low, the threat risk level is determined to be low risk.

9. The unknown vulnerability detection method according to claim 1, characterized in that: The step of performing a tiered response based on the evaluation results includes: If the assessment result is high risk, local blocking will be performed; If the assessment result is medium risk, the feature vector is sent to the cloud server for verification, and the feature library is dynamically updated based on threat intelligence; If the assessment result is low risk, normal communication will be carried out.

10. The unknown vulnerability detection method according to claim 1, characterized in that: The method further comprises: Obtaining the confidence of the feature vector; If the confidence level is greater than a set second threshold, the feature vector is added to the feature library.

11. An unknown vulnerability detection device, characterized in that: Applied to an edge server, the device includes: A data acquisition module, used to acquire vehicle data; A feature extraction module, configured to extract dynamic features based on the vehicle-borne data to obtain a feature vector; A threat assessment module, configured to assess the threat level based on the feature vector and obtain an assessment result; A response module is used to make a hierarchical response based on the evaluation result.

12. An unknown vulnerability detection system, characterized in that: The system includes the edge server and cloud server described in any one of claims 1-10.

13. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the unknown vulnerability detection method according to any one of claims 1 to 10.

14. A readable storage medium, characterized in that The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the unknown vulnerability detection method according to any one of claims 1 to 10 is executed.

Images