A security detection method of an in-vehicle network, a vehicle, and a medium

Abstract

The application provides a security detection method of an in-vehicle network, a vehicle and a medium, wherein the method comprises: when communication data of any channel in the in-vehicle network is listened to, extracting statistical features, protocol features and sequence features of the communication data; according to the statistical features, determining a behavior detection result for measuring whether the communication behavior under the channel deviates from the behavior; according to the protocol features, determining a protocol detection result for measuring whether the communication data conforms to the communication protocol constraint condition corresponding to the channel; according to the sequence features, determining an operation detection result for measuring whether the communication data conforms to the operation logic corresponding to the in-vehicle network; and according to the multiple detection results, determining whether the communication data poses a security threat to the in-vehicle network. Through multi-dimensional analysis of the behavior mode, protocol specification and operation logic of the communication data, the application realizes accurate detection of the security threat of the in-vehicle network and improves the security of the in-vehicle network.

Description

Technical Field

[0001] This application relates to the field of vehicle information processing technology, and more specifically, to a security detection method for vehicle networks, a vehicle, and a medium. Background Technology

[0002] With the widespread adoption of intelligent connected vehicles, electronic control units (ECUs) equipped with complex operating systems (such as Linux / QNX / Android Automotive), such as the Central Computing Unit (CCU), Telematics Box (T-Box), and In-Vehicle Domain Control Unit (IDCU), face a variety of core security threats. These threats include malware attacks via USB / Bluetooth / Wi-Fi / cellular networks, forged firmware packages hijacking vehicle control, targeted attacks exploiting undisclosed vulnerabilities in automotive-grade operating systems, and the illegal theft and leakage of vehicle sensor information.

[0003] However, existing protection technologies rely on a single ECU's virus signature database to detect and remove viruses by identifying static signature codes, lacking dynamic behavior analysis and real-time protection capabilities. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a security detection method, vehicle and medium for vehicular networks, which aims to overcome at least one of the above-mentioned defects.

[0005] Firstly, this application provides a security detection method for an in-vehicle network. The method includes: when monitoring communication data of any channel in the in-vehicle network, extracting statistical features, protocol features, and sequence features of the communication data; determining, based on the statistical features, a behavior detection result for measuring whether the communication behavior under the channel deviates from the expected behavior; determining, based on the protocol features, a protocol detection result for measuring whether the communication data conforms to the communication protocol constraints corresponding to the channel; determining, based on the sequence features, an operation detection result for measuring whether the communication data conforms to the operation logic corresponding to the in-vehicle network; and determining, based on multiple detection results, whether the communication data poses a security threat to the in-vehicle network.

[0006] In one possible implementation, the protocol detection result is determined by: loading a protocol verification model corresponding to the communication protocol supported by the channel, wherein the protocol verification model is constructed based on the communication protocol constraints of the communication protocol; and inputting the protocol features into the protocol verification model to obtain the protocol detection result. In one possible implementation, the protocol verification model obtains the protocol detection result by: parsing the protocol features to obtain the current state and input symbols, wherein the current state indicates all states in the parsing process and the input symbols indicate the key parameters that need to be verified; inputting the current state and the input symbols into a state transition function to obtain an output result on whether the input symbols satisfy the communication protocol constraints, and obtaining the protocol detection result based on the output result.

[0007] In one possible implementation, the operation detection result is determined by: loading a sequence transition probability model, which is constructed based on the operation logic corresponding to the vehicular network; and inputting the sequence features into the sequence transition probability model to obtain the operation detection result.

[0008] In one possible implementation, the sequence transition probability model determines the operation detection result by: determining the historical probability of each state in the sequence features transitioning to the next state; obtaining a joint probability based on all historical probabilities; and determining the sequence anomaly degree of the communication data based on the joint probability, so as to determine the operation detection result based on the sequence anomaly degree.

[0009] In one possible implementation, the statistical features include data load distribution, and the behavior detection result includes randomness detection result, wherein the randomness detection result is determined by: loading an information entropy model, which is constructed based on the random variation of the data load distribution of the channel; inputting the data load distribution into the information entropy model, and outputting an entropy deviation, the output entropy deviation indicating the degree of deviation between the current entropy value of the communication data and the baseline entropy value of the channel, to determine the randomness detection result based on the output entropy deviation.

[0010] In one possible implementation, the statistical features further include a historical message count sequence, and the behavior detection result further includes a periodic detection result, wherein the periodic detection result is determined by: loading a time series model corresponding to the channel, the time series model being constructed based on the periodicity of the message volume of the channel; inputting the historical message count sequence into the time series model to obtain a standardized prediction residual, and determining the periodic detection result based on the standardized prediction residual.

[0011] In one possible implementation, the step of determining whether the communication data poses a security threat to the vehicle network based on multiple detection results includes: determining a weight value corresponding to each detection result of the channel, and performing a weighted summation of all detection results to obtain a comprehensive threat value; if the comprehensive threat value exceeds the security threshold corresponding to the channel, then it is determined that the communication data poses a security threat to the vehicle network.

[0012] Secondly, this application provides a vehicle, including: a controller configured to: when monitoring communication data of any channel in an in-vehicle network, extract statistical features, protocol features, and sequence features of the communication data; determine, based on the statistical features, a behavior detection result for measuring whether the communication behavior under the channel deviates from the expected behavior; determine, based on the protocol features, a protocol detection result for measuring whether the communication data conforms to the communication protocol constraints corresponding to the channel; determine, based on the sequence features, an operation detection result for measuring whether the communication data conforms to the operation logic corresponding to the in-vehicle network; and determine, based on multiple detection results, whether the communication data poses a security threat to the in-vehicle network.

[0013] Thirdly, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the method described above.

[0014] The beneficial effects of the vehicle network security detection solution proposed in this application are as follows: This application achieves accurate detection of security threats to vehicle networks by conducting multi-dimensional analysis of the behavior patterns, protocol specifications, and operational logic of communication data, thereby improving the security of vehicle networks.

[0015] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart illustrating a security detection method for an in-vehicle network provided in an embodiment of this application; Figure 2 This is a flowchart illustrating the determination of protocol detection results provided in an embodiment of this application; Figure 3 A flowchart illustrating how the protocol verification model provided in this application obtains the protocol detection results; Figure 4 This is a flowchart illustrating the process of determining the detection result in an embodiment of this application. Figure 5 This is a flowchart illustrating the sequence transition probability model used in this application to determine the operation detection result. Figure 6 This is a flowchart illustrating the determination of randomness detection results provided in an embodiment of this application; Figure 7 This is a flowchart illustrating the determination of periodic detection results provided in an embodiment of this application; Figure 8 This is a flowchart illustrating how to determine whether communication data poses a security threat to the vehicle network, as provided in an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0019] First, the applicable application scenarios of this application will be introduced. This application can be applied to the field of vehicle information processing technology.

[0020] Research has revealed that with the widespread adoption of intelligent connected vehicles, the Central Computing Unit (CCU), Telematics Box (T-Box), and In-Vehicle Domain Control Unit (IDCU), equipped with complex operating systems (such as Linux / QNX / Android Automotive) and Electronic Control Units (ECUs), face a variety of core security threats. These threats include malware attacks via USB / Bluetooth / Wi-Fi / cellular networks, forged firmware packages hijacking vehicle control, targeted attacks against undisclosed vulnerabilities in automotive-grade operating systems, and the illegal theft and leakage of vehicle sensor information. However, existing protection technologies rely on the virus signature database of a single ECU, detecting and removing viruses by identifying static signature codes, lacking dynamic behavior analysis and real-time protection capabilities.

[0021] Based on this, embodiments of this application provide a security detection method, vehicle, and medium for vehicular networks. The aim is to achieve accurate detection of security threats to vehicular networks and improve the security of vehicular networks by performing multi-dimensional analysis on the behavior patterns, protocol specifications, and operational logic of communication data, and obtaining a comprehensive threat score based on the fusion weights according to channel characteristics.

[0022] Firstly, please refer to Figure 1 , Figure 1 This is a flowchart illustrating a security detection method for an in-vehicle network provided in an embodiment of this application. Figure 1 As shown in the embodiments of this application, the security detection method for vehicular networks includes: S101. When monitoring communication data of any channel in the vehicle network, extract the statistical characteristics, protocol characteristics, and sequence characteristics of the communication data.

[0023] Here, the channel includes the vehicle bus and external communication interface. The vehicle bus includes, but is not limited to, CAN (Controller Area Network), LIN (Local Interconnect Network), ETH (Ethernet) or FlexRay network, etc. The external communication interface includes, but is not limited to, OBD (On-Board Diagnostics), USB, Bluetooth or WiFi connection, etc. Any channel refers to any one of the above channels.

[0024] This application can be monitored via bus monitoring or peripheral monitoring.

[0025] Specifically, bus monitoring can obtain communication data through domain controller monitoring. It obtains communication data by collecting bus traffic from CAN / LIN / ETH / FlexRay, such as CCU, IDCU, and Autonomous Driving Domain Control Unit (ADCU). The communication data of bus monitoring is a set of bus messages within a preset sliding time window, including message ID, transmission period, data load, and timestamp collected by the domain controller.

[0026] Peripheral monitoring can intercept the transmission data between OBD commands (such as CCU), USB flash drive file operations, and Bluetooth / WiFi connection requests (such as IDCU). The communication data monitored by peripheral monitoring is a complete peripheral operation sequence, such as OBD command chain, USB flash drive file operation sequence, Bluetooth / WiFi transmission data, etc.

[0027] S102. Based on statistical characteristics, determine the behavior detection results used to measure whether there is a behavior deviation in the communication behavior under the channel; based on protocol characteristics, determine the protocol detection results used to measure whether the communication data conforms to the communication protocol constraints corresponding to the channel; based on sequence characteristics, determine the operation detection results used to measure whether the communication data conforms to the operation logic corresponding to the vehicle network.

[0028] The following is through Figure 2 This section describes the specific process for determining the results of protocol testing.

[0029] Figure 2 This is a flowchart illustrating the determination of protocol detection results provided in an embodiment of this application.

[0030] S201. Load the protocol verification model corresponding to the communication protocol supported by the channel.

[0031] Specifically, the protocol verification model is constructed based on the communication protocol constraints of the communication protocol.

[0032] As an example, the protocol verification model can be an FSM (Finite State Machine) protocol verification model. In-vehicle bus protocols (CAN / LIN / ETH / FlexRay) have strict timing and state constraints. The normal behavior of each communication protocol is constructed using the FSM, i.e., the communication protocol constraints. When an input message does not conform to the expected state transition or conditions of the communication protocol constraints, it is judged as a violation, identifying a protocol-level attack. For example, an ETH IP fragmentation attack: an attacker sends abnormally fragmented messages, compromising the integrity of the TCP / IP protocol stack.

[0033] S202. Input the protocol features into the protocol verification model to obtain the protocol detection results.

[0034] The following is through Figure 3 This section describes the specific process by which the protocol verification model obtains protocol detection results.

[0035] Figure 3 This is a flowchart illustrating how the protocol verification model provided in this application obtains the protocol detection results.

[0036] S301. Parse the protocol features to obtain the current state and input symbols.

[0037] Specifically, the current state indicates all states of the parsing process, the input symbols indicate key parameters that need to be verified, and the protocol characteristics are network packets. Includes protocol fields The current state and input symbols are obtained by parsing the protocol fields.

[0038] The FSM protocol verification model is represented as 𝑀={𝑄,𝑃,𝑇}.

[0039] Specifically, 𝑄 represents the set of states, which contains all possible states during the protocol parsing process. It is divided into intermediate states and termination states. The following are intermediate states.

[0040] As examples, the intermediate states of the CAN protocol include start, ID_Field (processing identifier), Control_Field (control field), and Data_Field (data field). The intermediate states of the LIN protocol include start, PID_Field (protected identifier), Data_Field (data field), Checksum_Field (checksum end), etc. The intermediate states of the ETH (TCP / IP) protocol include start, MAC_Header (MAC header parsing), IP_Header (IP header parsing), Transport_Header (transport layer header parsing), and end, etc. The intermediate states of the FlexRay protocol include start, Slot_Assignment (time slot allocation), Cycle_Counter (cycle counting), data field, and end, etc.

[0041] Termination status is divided into reception (indicating that the message parsing is complete and valid) and violation termination (indicating that a protocol violation was detected).

[0042] P represents the set of input symbols, which contains fields or key parameters that need to be verified in the protocol message.

[0043] As examples, the CAN protocol includes frame start, ID identifier, DLC data length code, and Data segment; the LIN protocol includes protected identifier, Data segment, and Checksum verification; the ETH (TCP / IP) protocol includes source MAC address, destination MAC address, IP protocol type, Port, and Payload; and the FlexRay protocol includes slot identifier, Cycle_Count period counter, and Data segment.

[0044] 𝑇 represents the state transition function, which determines the next state or triggers a violation based on the current state and the input symbol. This includes valid and invalid transitions. A valid transition indicates that the input symbol satisfies the protocol rules, and the function transitions to the next stage state. An invalid transition indicates that the input symbol violates the protocol rules, and the function transitions to an error state.

[0045] S302. Input the current state and input symbol into the state transition function to obtain the output result of whether the input symbol meets the communication protocol constraints, so as to obtain the protocol detection result based on the output result.

[0046] Specifically, the output of the FSM protocol verification model is the protocol detection result, represented as: 0 indicates compliance, and 1 indicates violation.

[0047] As an example: In the Control_Field status, check if the CAN message DLC is valid. If DLC=8 is valid, proceed to the next data field status. The output is 1. If DLC=9, an error state is triggered. The output is 0.

[0048] The following is through Figure 4 This section describes the specific process for determining the results of operational tests.

[0049] Figure 4 This is a flowchart illustrating the determination of operation detection results provided in an embodiment of this application.

[0050] S401, Load sequence transition probability model.

[0051] Specifically, the sequence transition probability model is constructed based on the operational logic corresponding to the in-vehicle network.

[0052] As an example, the sequence transition probability model can be a Markov chain model. Markov chain models can capture the contextual dependencies of operational logic and defend against attacks that exploit combinations of legitimate functions. Because of the operational sequence dependencies in vehicular networks, attackers may use combinations of high-frequency legitimate instructions to launch multi-step attacks. For example, an attacker could hijack a diagnostic session and send diagnostic instructions in a non-standard order.

[0053] S402. Input the sequence features into the sequence transition probability model to obtain the operation detection results.

[0054] The following is through Figure 5 This section describes the specific process by which the sequence transition probability model determines the operation detection results.

[0055] Figure 5 This is a flowchart illustrating the sequence transition probability model used in this application to determine the operation detection results.

[0056] S501. Determine the historical probability of each state transitioning to the next state in the sequence features.

[0057] Specifically, the expression for the Markov chain model is as follows:

[0058] here, A sequence of instructions characterized by sequence features; The first in each state From state Transition to state Historical probability Instruction sequence The joint probability is given by the expression, where a smaller joint probability indicates a greater anomaly.

[0059] S502. Obtain the joint probability based on all historical probabilities, and determine the sequence anomaly degree of the communication data based on the joint probability, so as to determine the operation detection result based on the sequence anomaly degree.

[0060] Specifically, the sequence anomaly degree can be calculated using the following formula:

[0061] Among them, sequence abnormality The value is the operation detection result. If The operation test result was determined to be abnormal.

[0062] The example is an attacker hijacking a diagnostic session.

[0063] Legitimate diagnostic session status Session initialization Security verification Data Request Data Response Session terminated.

[0064] The hijacking diagnosis session status is: Session initialization Security verification Security verification (retry) Malicious data injection Session terminated.

[0065] The following is through Figure 6 This section describes the specific process for determining the results of randomness testing.

[0066] Figure 6 This is a flowchart illustrating the determination of randomness detection results provided in an embodiment of this application.

[0067] S601, Load the information entropy model.

[0068] Specifically, the information entropy model is constructed based on the random changes in the data load distribution of the channel. The statistical features also include historical message count sequences, and the behavior detection results also include periodic detection results.

[0069] Information entropy models can quantify the uncertainty of system communication by calculating the information entropy of bus message IDs or data payloads. They directly quantify the randomness of bus communication changes and are sensitive to sudden, unpredictable attacks. Under normal operating conditions, the distribution of bus message IDs is relatively stable, with small entropy fluctuations, such as with periodic control commands. Attacks, however, introduce abnormal randomness, leading to sudden changes in entropy. For example, in DoS attacks (such as CAN bus flooding), attackers send a large number of high-priority messages, causing the message ID distribution to become centralized and the entropy to decrease significantly; in fuzzy attacks (random IDs / data injection), randomized abnormal IDs or data payloads are generated, increasing the randomness of message distribution and causing an abnormal increase in entropy.

[0070] Here, the expression for the information entropy model is as follows.

[0071]

[0072] here, The information entropy of a random variable X (unit: bits) is used to quantify uncertainty. For the first Discrete events (such as CAN message ID, opcode). The probability of it occurring within the sliding time window. The total number of possible event types (e.g., the maximum value of CAN ID).

[0073] S602. Input the data load distribution into the information entropy model, output the entropy deviation, and determine the randomness detection result based on the output entropy deviation.

[0074] Here, the output entropy deviation indicates the degree of deviation between the current entropy value of the communication data and the baseline entropy value of the channel, so as to determine the randomness detection result based on the output entropy deviation.

[0075] Specifically, the detection process is as follows: input data load distribution (or message ID), entropy deviation. This refers to the randomness detection result; the entropy deviation is calculated as follows: ,in, The current entropy value, The baseline entropy value, if , The threshold for determining whether randomness is abnormal is used to identify the randomness detection result as abnormal.

[0076] The following is through Figure 7 This section describes the specific process for determining the results of periodic testing.

[0077] Figure 7 This is a flowchart illustrating the determination of periodic detection results provided in an embodiment of this application.

[0078] S701, the timing model corresponding to the loading channel.

[0079] Here, the time series model is constructed based on the periodicity of the message volume of the channel. The statistical features also include the historical message count sequence, and the behavior detection results also include periodic detection results.

[0080] Specifically, the timing model can be an ARIMA timing model. ARIMA timing models can predict the number of periodic bus messages and capture the periodic patterns of bus message time series. The periodicity of vehicle bus (CAN / LIN / ETH / FlexRay) messages (e.g., OTA status messages are sent every 10ms) is suitable for time series modeling. ARIMA models can predict the number of messages at future points in time; deviations from the predicted value indicate anomalies. For example, replay attacks: repeatedly sending historical messages causes the actual number of messages to deviate from the periodic prediction value (e.g., predicted value 50, actual value 80); timed injection attacks: injecting abnormal messages within a specific time window disrupts the periodic timing pattern (e.g., interfering with OTA status signals, causing the vehicle's infotainment system to be in a state of overload).

[0081] The expression for the ARIMA timing model is as follows:

[0082] here, For time points The observed values ​​(such as the number of CAN messages in the current window). This is a constant term (baseline offset). These are the autoregressive (AR) coefficients, representing historical values. The weight of the impact on the current value The AR order (depending on how many historical values). The moving average (MA) coefficient represents historical noise. The weight, Let MA be the order. The white noise error term follows a set pattern.

[0083] S702. Input the historical message count sequence of the channel into the time series model to obtain the standardized prediction residual, and determine the periodic detection result based on the standardized prediction residual.

[0084] Specifically, the ARIMA time series model models the patterns of time series based on observations at historical time points, in order to analyze the time points... Make a prediction and obtain the predicted value. The detection rule is to input a historical message count sequence and output the standardized prediction residual. Standardized prediction residuals This refers to the periodic detection results, indicating the degree of deviation between the message volume predicted by the time series model and the actual message volume of the communication data, and the standardized prediction residuals. This refers to the periodic test results. The standard deviation of the historical residuals (a measure of the dispersion of the prediction error) is given. When the periodic test results are determined to be abnormal, A threshold for determining whether periodicity is abnormal.

[0085] As an example, in predicting the number of messages in the next window Actual number of messages in the next window , , The periodic test results were determined to be abnormal.

[0086] return Figure 1 S103. Based on multiple test results, determine whether the communication data poses a security threat to the vehicle network.

[0087] The following is through Figure 8 This section describes the specific process for determining whether communication data poses a security threat to the vehicle network.

[0088] Figure 8 This is a flowchart illustrating how to determine whether communication data poses a security threat to the vehicle network, as provided in an embodiment of this application.

[0089] S801. Determine the weight value corresponding to each detection result of the channel, and then sum the weighted values ​​of all detection results to obtain the comprehensive threat value.

[0090] Specifically, the information entropy model, ARIMA timing model, FSM protocol verification model, and Markov chain model are used in parallel to detect the protocol compliance characteristics, statistical characteristics, and behavioral sequence characteristics of communication data. However, due to differences in model characteristics (e.g., the information entropy model is sensitive to bursty traffic, but a sudden change in the number of bus mute messages during legitimate firmware flashing may trigger false alarms; FSM is sensitive to protocol compliance, etc.), to avoid false alarms about virus intrusion (e.g., legitimate after-sales repair via OBD, or firmware flashing and debugging by R&D testers), the fusion decision model uses a weighted summation method to calculate the comprehensive threat value, based on the channel type coefficient. and historical accuracy The weights are dynamically adjusted together to make the decision.

[0091] Specifically, the overall threat value can be calculated using the following formula.

[0092]

[0093]

[0094]

[0095] here, For the overall threat value, The anomaly score corresponding to the k-th detection result. For randomness detection results, For periodic test results, For the protocol test results, For the operation of the test results, The weights of the model corresponding to the k-th detection result are... Let be the channel type coefficient of the k-th detection result. Let k be the historical detection accuracy of the model corresponding to the k-th detection result. Let be the number of correct detections by the model corresponding to the k-th detection result. This represents the number of false alarms for the model corresponding to the k-th detection result.

[0096] As an example, the following is a weight assignment for multiple channel types.

[0097]

[0098] S802. If the overall threat value exceeds the security threshold corresponding to the channel, it is determined that the communication data poses a security threat to the vehicle network.

[0099] One example is to explain the firmware flashing operation targeting the OBD interface. This operation may be a legitimate repair or a malicious attack. The detection results of four models are calculated using the above method to obtain a comprehensive threat value. The comprehensive threat value is then used to determine whether the communication data poses a security threat to the vehicle network.

[0100] (1) Output of each model:

[0101] (2) Weights of each model :

[0102] (3) Calculate the overall threat value :

[0103] (4) Decision-making: Output: Security threshold for OBD interface At that time, legal operation is permitted. The system triggers a security response to block malicious commands, records virus characteristics and performs repairs, notifies the platform's security center (Telematics Service Provider, TSP), and updates the shared virus database for car manufacturers.

[0104] This application embodiment also provides a vehicle, including: a controller configured to: when monitoring communication data of any channel in an in-vehicle network, extract statistical features, protocol features, and sequence features of the communication data; determine, based on the statistical features, a behavior detection result for measuring whether the communication behavior under the channel deviates from the expected behavior; determine, based on the protocol features, a protocol detection result for measuring whether the communication data conforms to the communication protocol constraints corresponding to the channel; determine, based on the sequence features, an operation detection result for measuring whether the communication data conforms to the operation logic corresponding to the in-vehicle network; and determine, based on multiple detection results, whether the communication data poses a security threat to the in-vehicle network.

[0105] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described actions. Figures 1-8 The steps of the vehicle network security detection method in the illustrated method embodiment can be found in the method embodiment for specific implementation, and will not be repeated here.

[0106] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0107] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0108] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0109] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0110] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0111] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A security detection method for vehicular networks, characterized in that, The method includes: When communication data is detected in any channel of the vehicle network, the statistical characteristics, protocol characteristics, and sequence characteristics of the communication data are extracted. Based on the statistical characteristics, a behavior detection result is determined to measure whether there is a behavior deviation in the communication behavior under the channel. Based on the protocol characteristics, a protocol detection result is determined to measure whether the communication data conforms to the communication protocol constraints corresponding to the channel. Based on the sequence characteristics, an operation detection result is determined to measure whether the communication data conforms to the operation logic corresponding to the vehicle network. Based on multiple test results, determine whether the communication data poses a security threat to the vehicle network; The protocol detection result is determined in the following manner: Load the protocol verification model corresponding to the communication protocol supported by the channel, and the protocol verification model is constructed based on the communication protocol constraints of the communication protocol; The protocol features are input into the protocol verification model to obtain the protocol detection result; The operation detection result is determined in the following manner: Load a sequence transition probability model, which is constructed based on the operation logic corresponding to the vehicle network; The sequence features are input into the sequence transition probability model to obtain the operation detection result; The statistical features include data load distribution, and the behavior detection results include randomness detection results. The randomness detection result is determined in the following way: Load the information entropy model, which is constructed based on the random variation of the data load distribution of the channel; The data load distribution is input into the information entropy model, and the entropy deviation is output to determine the randomness detection result based on the output entropy deviation.

2. The method according to claim 1, characterized in that, The protocol verification model obtains the protocol detection results in the following manner: The protocol features are parsed to obtain the current state and input symbols. The current state is used to indicate all states of the parsing process, and the input symbols are used to indicate the key parameters that need to be verified. The current state and the input symbol are input to the state transition function to obtain the output result of whether the input symbol satisfies the communication protocol constraints, so as to obtain the protocol detection result based on the output result.

3. The method according to claim 1, characterized in that, The sequence transition probability model determines the operation detection result in the following manner: Determine the historical probability of each state transitioning to the next state in the sequence features; The joint probability is obtained based on all historical probabilities, and the sequence anomaly degree of the communication data is determined based on the joint probability, so as to determine the operation detection result based on the sequence anomaly degree.

4. The method according to claim 1, characterized in that, The statistical features also include historical message count sequences, and the behavior detection results also include periodic detection results. The periodic detection results are determined in the following manner: Load the time series model corresponding to the channel, which is constructed based on the periodicity of the message volume of the channel; The historical message count sequence is input into the time series model to obtain standardized prediction residuals, and the periodic detection results are determined based on the standardized prediction residuals.

5. The method according to claim 1, characterized in that, The step of determining whether the communication data poses a security threat to the vehicle network based on multiple detection results includes: Determine the weight value corresponding to each detection result of the channel, and then perform a weighted summation of all detection results to obtain the comprehensive threat value; If the overall threat value exceeds the security threshold corresponding to the channel, then the communication data is determined to pose a security threat to the vehicle network.

6. A vehicle, characterized in that, include: The controller is configured to: upon detecting communication data in any channel of the vehicular network, extract statistical features, protocol features, and sequence features of the communication data; based on the statistical features, determine a behavior detection result to measure whether the communication behavior under the channel deviates from the expected behavior; based on the protocol features, determine a protocol detection result to measure whether the communication data conforms to the communication protocol constraints corresponding to the channel; based on the sequence features, determine an operation detection result to measure whether the communication data conforms to the operation logic corresponding to the vehicular network; and based on multiple detection results, determine whether the communication data poses a security threat to the vehicular network. The controller is further configured to: load a protocol verification model corresponding to the communication protocol supported by the channel, the protocol verification model being constructed based on the communication protocol constraints of the communication protocol; and input the protocol features into the protocol verification model to obtain the protocol detection result. The operation detection result is determined by: loading a sequence transition probability model, which is constructed based on the operation logic corresponding to the vehicle network; inputting the sequence features into the sequence transition probability model to obtain the operation detection result; the statistical features include data load distribution, and the behavior detection result includes randomness detection result; The controller is further configured to: load an information entropy model, which is constructed based on the random variation of the data load distribution of the channel; input the data load distribution into the information entropy model and output an entropy deviation, so as to determine the random detection result based on the output entropy deviation.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the method as described in any one of claims 1 to 5.

Images