A vehicle information security identification method and device based on a behavior knowledge graph

Abstract

A vehicle information security identification method and device based on a behavior knowledge graph, the method comprising: determining a behavior knowledge graph; receiving a node abnormal event association graph from a vehicle end, the node abnormal event association graph being determined by the vehicle end through association of abnormal indicators; adding suspicious edge relationships in the abnormal event association graph to the behavior knowledge graph as preset low-confidence abnormal relationships to obtain an updated behavior knowledge graph; and based on the updated behavior knowledge graph, using a graph reasoning algorithm and a preset identification rule to analyze the connectivity of the relationships between nodes, and identifying a target attack chain that matches a known attack mode or is similar to the known attack mode. Thus, instead of simple threshold comparison, the preset identification rule analysis and the graph reasoning algorithm intelligent reasoning and automatic determination of complex attacks that match a known attack mode or are similar to the known attack mode can effectively identify complex attacks implemented across different entities or functional subsystems.

Description

Technical Field

[0001] This application relates to the field of vehicle safety detection technology, and in particular to a vehicle information security identification method and device based on behavioral knowledge graph. Background Technology

[0002] Intelligent connected vehicles contain dozens of electronic control units (ECUs) with different functions, such as powertrain ECUs, body system ECUs, and infotainment system ECUs. These ECUs communicate and cooperate through network buses (such as CAN, LIN, and Ethernet) to achieve complex vehicle functions.

[0003] Current vehicle safety detection technologies typically employ methods based on fixed rules or single-source data analysis. This involves setting static thresholds or signature codes for individual ECUs or single types of data streams (such as CAN bus traffic) to identify anomalies. However, advanced cyberattacks often employ slow, indirect strategies, penetrating a non-critical ECU (such as the infotainment system) and then gradually moving laterally towards critical ECUs (such as the brake controller). During this process, the anomalous signals generated by attackers on a single node or data stream are extremely weak, or even appear as normal behavior, thus easily evading existing detection methods.

[0004] Therefore, how to effectively identify complex attacks carried out by attackers across different entities or functional subsystems within intelligent connected vehicles is a key research topic for those skilled in the art. Summary of the Invention

[0005] Firstly, this application provides a vehicle information security identification method based on behavioral knowledge graphs, applied in the cloud. The method includes: determining a behavioral knowledge graph, wherein nodes in the behavioral knowledge graph represent vehicle entities, edges represent normal or abnormal interaction relationships between entities, edge attributes include confidence level and historical frequency of interaction between nodes, and node attributes include current indicators, wherein the entity is any component in any subsystem of the vehicle; receiving a node abnormal event association graph from the vehicle end, wherein the node abnormal event association graph is determined by the vehicle end through entities associated with abnormal indicators; adding suspicious edge relationships in the abnormal event association graph as preset low-confidence abnormal relationships to the behavioral knowledge graph to obtain an updated behavioral knowledge graph, wherein the suspicious edge relationships are entity-to-entity edge relationships not included in the behavioral knowledge graph; and based on the updated behavioral knowledge graph, using a graph reasoning algorithm and preset identification rules to analyze the connectivity of relationships between nodes, identifying target attack chains that match or are similar to known attack patterns, wherein the target attack chain is an attack chain across entities within a single subsystem or an attack chain across multiple subsystems.

[0006] The vehicle information security identification method based on behavioral knowledge graph provided in this application can effectively identify complex attacks that span different entities or functional subsystems by using the intelligent reasoning and automatic judgment based on preset identification rule analysis and graph reasoning algorithms to match or be similar to known attack patterns, rather than simple threshold comparison.

[0007] On the other hand, by adding suspicious connections as low-confidence anomalies to the behavioral knowledge graph, the behavioral knowledge graph can learn and evolve from real-world events, rather than being a static database.

[0008] On the other hand, the vehicle sends a large number of isolated abnormal indicators to the cloud by associating them into a structured node abnormal event association graph, instead of uploading a large amount of real-time raw data. This can achieve the effect of removing redundancy and isolated noise, and achieving highly condensed information. At the same time, it can significantly reduce the amount of data uploaded to the cloud and improve the bandwidth bottleneck problem of vehicle-cloud communication.

[0009] In some possible implementations, the step of using graph inference algorithms and preset identification rules to analyze the connectivity of relationships between nodes and identify target attack chains that match or are similar to known attack patterns includes: searching for reachable paths from abnormal nodes to preset key asset nodes in the behavioral knowledge graph based on the graph inference algorithm to identify lateral movement attack chains; identifying suspicious subgraphs formed by multiple seemingly isolated abnormal nodes in the behavioral knowledge graph within a preset time period based on the graph inference algorithm to identify collaborative attack chains; and using the semantic information of the behavioral knowledge graph, based on graph neural networks or subgraph isomorphism algorithms, determining novel attack chains that are structurally similar to known attack patterns but have different specific entities on the attack chains.

[0010] Using this approach, the solution, based on graph structure and relationship reasoning, can not only identify pre-defined lateral movement attacks and cooperative attacks, but also identify cooperative attacks and lateral attacks that have never been seen before but have abnormal behavior patterns, ensuring the comprehensiveness and completeness of attack detection and greatly improving attack detection capabilities.

[0011] In some possible implementations, the graph reasoning algorithm includes path analysis, community detection, and subgraph matching, wherein the path analysis is used to identify connected paths from anomalous nodes to critical asset nodes; the community detection is used to identify anomalous entity clusters with highly similar behavioral patterns; and the subgraph matching is used to identify patterns that match known attack patterns.

[0012] In some possible implementations, the step of searching for reachable paths from abnormal nodes to preset key asset nodes in the behavioral knowledge graph based on the graph reasoning algorithm and identifying lateral movement attack chains includes: searching for reachable paths from abnormal nodes to preset key asset nodes in the behavioral knowledge graph based on path analysis and community detection algorithms in the graph reasoning algorithm to identify suspected lateral movement attack chains; and identifying known lateral movement attack chains that match known lateral movement attack patterns among the suspected lateral movement attack chains based on subgraph matching algorithms.

[0013] In some possible implementations, the step of identifying suspicious subgraphs formed by multiple seemingly isolated abnormal nodes in the behavioral knowledge graph within a preset time period based on the graph reasoning algorithm, and identifying collaborative attack chains, includes: identifying suspicious subgraphs formed by multiple seemingly isolated abnormal nodes in the behavioral knowledge graph within a preset time period based on path analysis and community detection algorithms in the graph reasoning algorithm, and identifying suspected collaborative attack chains; and identifying known collaborative attack chains in the suspected collaborative attack chains that match known collaborative attack patterns based on subgraph matching algorithms.

[0014] This approach first uses path analysis and community detection to perform a broad-spectrum scan to identify all suspected targets, and then uses subgraph matching to accurately identify and confirm known attack paths. Based on the efficient process of first broad-spectrum detection and then accurate identification, it avoids the huge computational overhead caused by directly performing full quantum graph matching.

[0015] In some possible implementations, the step of using the semantic information of the behavioral knowledge graph, based on a graph neural network or a subgraph isomorphism algorithm, to determine a novel attack chain that is structurally similar to a known attack pattern but has different specific entities on the attack chain includes: using the semantic information of the behavioral knowledge graph, based on a graph neural network or a subgraph isomorphism algorithm, to determine a novel lateral movement attack chain among unknown suspected lateral movement attack chains that is structurally similar to a known lateral movement attack pattern but has different specific entities on the attack chain; and to determine a novel cooperative attack chain among unknown suspected cooperative attack chains that is structurally similar to a known cooperative attack pattern but has different specific entities on the attack chain; wherein, the unknown suspected lateral movement attack chain is a suspected lateral movement attack chain other than a known lateral movement attack chain, and the unknown suspected cooperative attack chain is a suspected cooperative attack chain other than a known cooperative attack chain.

[0016] This approach, on the one hand, clearly distinguishes the processing paths for known attack paths and novel attack paths. For suspected attack chains that cannot be matched, similarity inference is performed using graph neural networks, ensuring the defense capability against unknown attack paths. On the other hand, explicitly distinguishing novel attack chains into novel lateral movement attacks and novel cooperative attacks makes the detection of unknown attack paths more targeted and interpretable.

[0017] In some possible implementations, the entity includes hardware entities, software entities, data entities, and logical entities; wherein, the hardware entity includes electronic control unit (ECU) and sensors, the software entity includes processes and services, the data entity includes messages and instructions, and the logical entity includes driving behavior and user sessions; the anomaly indicator includes scalar values ​​and vectors, the scalars include any one of deviation, probability value, and similarity score, and the vectors include behavioral pattern vectors.

[0018] Using this method, the anomaly indicators include vectors, which can detect not only scalar anomalies (such as numerical values ​​exceeding limits) but also behavioral pattern anomalies (such as sequence anomalies), greatly enhancing the detection depth.

[0019] In some possible implementations, after identifying the target attack chain, the method further includes: confirming the preset low-confidence anomaly relationship on the target attack chain as a preset high-confidence attack relationship.

[0020] In some possible implementations, after identifying the target attack chain, the method further includes: calculating and updating the attack confidence of the nodes on the target attack chain by combining the abnormal attribute information of the nodes and edges on the target attack chain.

[0021] In some possible implementations, after identifying the target attack chain, the method further includes: generating a preset response strategy and sending it to the vehicle, the preset response strategy including at least one of the following operations: outputting a security notification, isolating the electronic control unit (ECU) associated with the target attack chain, disabling related services, or entering a safe mode, wherein the security notification is used to indicate information related to the target attack chain.

[0022] This approach links detection and response, clearly defining the action strategy after discovering the attack path, thus forming a complete adaptive security closed loop.

[0023] In some possible implementations, after identifying the target attack chain, the method further includes: marking the source node of the target attack chain as attacked and reducing the confidence of other normal connections associated with the source node.

[0024] In some possible implementations, after identifying the target attack chain, the method further includes: using the full-link data of the target attack chain as feedback samples to optimize and update the entity's dynamic behavior baseline model and the behavior knowledge graph, so as to achieve self-learning and evolution of the entity's dynamic behavior baseline model and the behavior knowledge graph.

[0025] By adopting this approach and through a feedback learning mechanism, the system gains the ability to learn from historical attacks, evolving from a statically deployed system into a security detection organism that becomes increasingly intelligent and accurate with use.

[0026] In some possible implementations, after identifying the target attack chain, the method further includes: increasing the confidence of high-frequency normal connection relationships in the behavioral knowledge graph that do not belong to the target attack chain, do not exist with the target attack chain, and have an interaction frequency greater than a preset frequency.

[0027] Secondly, this solution provides a vehicle information security identification method based on behavioral knowledge graphs. The method is applied to the vehicle end and includes: calculating anomaly indicators of entities based on a dynamic behavioral baseline model of the entities, and associating entities with anomaly indicators with a node anomaly event association graph, where the entity is any component in any subsystem of the vehicle; sending the anomaly event association graph to the cloud, so that the cloud updates the behavioral knowledge graph based on the anomaly event association graph, analyzes the connectivity between nodes using graph reasoning algorithms and preset identification rules, and identifies target attack chains that match or are similar to known attack patterns.

[0028] In some possible implementations, before calculating the anomaly indicators of entities based on the entity-based dynamic behavior baseline model, the method further includes: learning and determining the dynamic behavior baseline model corresponding to each entity of the vehicle based on a large amount of historically reliable heterogeneous data streams, wherein the baseline values ​​in the entity's dynamic behavior baseline model dynamically and adaptively change with the vehicle's operating state and / or preset context information, the heterogeneous data streams include historical data from different subsystems, the preset context information includes geographical location information and / or time information, and the vehicle operating state includes driving state, parking state, and charging state.

[0029] This approach allows the vehicle-side self-learning system to establish a personalized baseline that is well-suited to the vehicle, avoiding the weakening of the baseline's personalization caused by adding data from other vehicles. Furthermore, completing baseline learning on the vehicle side means that the raw data does not need to leave the vehicle; only the abstract baseline model or anomalies interact with the cloud, reducing the risk of user privacy leaks. Moreover, on-vehicle self-calculation and comparison also avoids the network latency caused by sending data to the cloud and waiting for instructions.

[0030] In some possible implementations, the heterogeneous data stream includes network traffic data, system operating status data, vehicle status and sensor data, and user behavior data. The network traffic data includes one or more of CAN bus, LIN bus, Ethernet, and cellular communication messages. The system operating status data includes one or more of ECU firmware hash, process list, CPU utilization, memory utilization, and file system critical file access logs. The vehicle status and sensor data includes one or more of vehicle speed, steering wheel angle, braking status, and GPS coordinates. The user behavior data includes one or more of diagnostic interface access records, application usage logs, and remote control commands.

[0031] In some possible implementations, the method further includes: receiving a preset response policy from the cloud, and performing related operations based on the preset response policy, wherein the preset response policy includes at least one of the following operations: outputting a security notification, isolating an electronic control unit (ECU) associated with the target attack chain, disabling related services, or entering a safe mode.

[0032] Thirdly, this application also provides a vehicle information security identification device based on behavioral knowledge graph, including a unit for performing any one of the vehicle information security identification methods based on behavioral knowledge graph in the first or second aspect.

[0033] Fourthly, this application also provides a computer storage medium that can store multiple instructions, which are adapted to be loaded and executed by a processor using any of the vehicle information security identification methods based on behavioral knowledge graphs in the first aspect.

[0034] Fifthly, embodiments of this application also provide a computer program product containing instructions, which, when run on an electronic device, causes the electronic device to execute any one of the vehicle information security identification methods based on behavioral knowledge graphs in the first or second aspect.

[0035] Sixthly, embodiments of this application also provide a chip module, including a transceiver component and a chip, wherein the chip is used to execute any one of the vehicle information security identification methods based on behavioral knowledge graphs in the first or second aspect.

[0036] It is understood that the vehicle information security identification device, computer storage medium, computer program, computer program product, and chip system provided above based on behavioral knowledge graphs are all used to execute the method shown in any implementation of the first or second aspect of the embodiments of this application. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects in the corresponding methods, and will not be repeated here. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of the method flow of a vehicle information security identification method based on behavioral knowledge graph provided in an embodiment of this application;

[0038] Figure 2 This is a schematic diagram illustrating a specific scenario implementation of a vehicle information security identification method based on behavioral knowledge graphs provided in this application embodiment;

[0039] Figure 3 This is a schematic diagram of a vehicle information security identification device based on behavioral knowledge graph applied in the cloud, provided in an embodiment of this application;

[0040] Figure 4 This is a schematic diagram of a vehicle information security identification device based on behavioral knowledge graph, provided in an embodiment of this application, applied to a vehicle.

[0041] Figure 5 This is a schematic diagram of another vehicle information security identification device based on behavioral knowledge graph provided in the embodiments of this application. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described below in conjunction with the accompanying drawings.

[0043] Example 1:

[0044] Please see Figure 1 , Figure 1 This document provides a flowchart of a vehicle information security identification method based on behavioral knowledge graphs, as an embodiment of this application. Figure 1 As shown, the vehicle information security identification method based on behavioral knowledge graph includes the following steps:

[0045] S101, cloud-based behavioral knowledge graph.

[0046] In the embodiments of this application, the nodes in the behavioral knowledge graph are used to represent vehicle entities, the edges are used to represent normal or abnormal interaction relationships between entities, the edge attributes include confidence and historical frequency of interaction between nodes, and the node attributes include current indicators. The entity is any component in any subsystem of the vehicle.

[0047] As an example, in the initial stage of solution deployment, a data acquisition agent is deployed collaboratively on the vehicle and / or in the cloud. The cloud continuously acquires a large amount of historical, reliable, heterogeneous data streams from different vehicle subsystems (such as the powertrain, body system, infotainment system, and T-Box of the connectivity system). Based on this heterogeneous data stream, the cloud extracts vehicle entities and the interaction relationships between entities to construct the initial baseline state of the behavioral knowledge graph (i.e., a behavioral knowledge graph reflecting the normal behavior patterns of the vehicle).

[0048] In some possible implementations, the aforementioned heterogeneous data streams include network traffic data, system operating status data, vehicle status and sensor data, and user behavior data; wherein, network traffic data includes one or more of CAN bus, LIN bus, Ethernet, and cellular communication messages; the system operating status data includes one or more of ECU firmware hash, process list, CPU utilization, memory utilization, and file system critical file access logs; the vehicle status and sensor data includes one or more of vehicle speed, steering wheel angle, braking status, and GPS coordinates; and the user behavior data includes one or more of diagnostic interface access records, application usage logs, and remote control commands.

[0049] As an example, entities include hardware entities, software entities, data entities, and logical entities. Hardware entities include electronic control units (ECUs) and sensors, software entities include processes and services, data entities include messages and instructions, and logical entities include driving behavior and user sessions.

[0050] As an example, the cloud extracts entities and their interactions from CAN bus data, including: if it discovers that ECU_A sends message 'ID_0x100' to ECU_B and the historical transmission frequency is greater than a preset frequency (e.g., the preset frequency is greater than or equal to 5), then the cloud creates an interaction relationship in the graph where "node ECU_A, node ECU_B, and the edge between the two nodes are sending [message_0x100]", and identifies this interaction relationship as a preset high-confidence normal relationship (e.g., a preset high-confidence normal relationship is represented by a black solid line in the graph), and sets the confidence value of the normal relationship based on its interaction frequency (e.g., the higher the historical interaction frequency, the higher the confidence of the normal relationship).

[0051] As another example, the cloud extracts entities and interactions between entities from system operation status data, including: if it finds that every time the vehicle starts, process_P is called by service_S on ECU_C, then the cloud creates an interaction relationship of "node process_P, node service_S, and edge 'call'" in the graph, and identifies this interaction relationship as a preset high-confidence normal relationship, and sets the confidence value of its normal relationship based on the interaction frequency.

[0052] S102, the vehicle side calculates the abnormal indicators of the entities based on the dynamic behavior baseline model of each entity, and determines the node abnormal event association diagram by associating entities with abnormal indicators.

[0053] In this embodiment of the application, the node abnormal event association graph is a subgraph that includes abnormal nodes, the node relationships between abnormal nodes, and abnormal indicator information of abnormal nodes.

[0054] In the embodiments of this application, the entities of abnormal indicators may include different entities from different subsystems of the vehicle, or they may include different entities from the same subsystem. This document does not limit this.

[0055] In some possible implementations, the anomaly index includes scalar values ​​and vectors. The scalars include any one of the following: deviation (the degree of deviation from the normal value), probability value (the probability of the scalar appearing, with a lower probability indicating a higher degree of anomaly), and similarity score (the similarity score to the normal value). The vectors include behavioral pattern vectors.

[0056] In some possible implementations, the dynamic behavior baseline models of each entity of the vehicle are determined by the vehicle itself. Specifically, the vehicle learns and determines the dynamic behavior baseline models corresponding to each entity based on a large amount of historically reliable heterogeneous data streams. The baseline values ​​in the dynamic behavior baseline models of the entities dynamically and adaptively change with the vehicle's operating state and / or preset context information. The heterogeneous data streams include historical data from different subsystems, the preset context information includes geographical location information and / or time information, and the vehicle operating state includes driving state, parking state, and charging state.

[0057] In other possible implementations, the dynamic behavior baseline models of each entity within the vehicle can also be determined in the cloud and sent to the vehicle. The cloud can analyze and obtain the dynamic behavior baseline models of each entity within the first vehicle based on its historical heterogeneous data stream. Alternatively, it can centralize heterogeneous data streams from all vehicles (e.g., all vehicle data of the same type, and / or, for different types of vehicles, data from those different types can be centralized for general indicators) and analyze and learn to obtain the dynamic behavior baseline models of the entities.

[0058] For example, determining a dynamic behavioral baseline model of an entity based on a large amount of historically reliable heterogeneous data streams, either on the vehicle side or in the cloud, includes determining one or more of the following behavioral baselines for a predefined entity:

[0059] Communication behavior baseline: includes one or more of the following parameter baselines: frequency (number of messages sent or received per second / minute) and period (regularity of message transmission).

[0060] System resource behavior baseline: includes one or more of the following parameter baselines: CPU / memory utilization (refers to the normal range of CPU and memory utilization of a certain ECU or process under specific vehicle conditions, such as idling or high-speed driving), process lifecycle (whether the start and stop times of the process are regular, such as a certain service only starting when the vehicle is unlocked).

[0061] Command / Operation Behavior Baseline: Includes one or more of the following parameter baselines: command sequence (the normal order in which a series of ECU commands are issued when an operation is completed, such as opening a door), API call sequence (the normal pattern in which an application or service calls the system API).

[0062] Furthermore, the aforementioned behavioral baselines dynamically adapt to changes in vehicle operating status (e.g., driving, parking, charging) and context (e.g., geographical location, time). For example, the activity levels and communication patterns of each subsystem differ significantly under different vehicle operating states. For instance, the communication frequency baseline between powertrain ECUs during high-speed driving differs from that during parking. Similarly, the network access patterns and frequency baselines of the infotainment system differ between daytime and nighttime. For example, access to diagnostic interfaces may be more lenient near a dealership or home, but will be strictly monitored in unfamiliar areas.

[0063] As an example, the data format of an entity's dynamic behavior baseline model can include a probability distribution. For instance, the CPU utilization rate of an ECU under high-speed driving conditions follows a normal distribution with a mean of 30% and a standard deviation of 5%. Based on this probability distribution, any new sampled data point collected by the vehicle can have its probability calculated under this distribution; a probability that is too low is considered an abnormal indicator.

[0064] As another example, the data format of an entity's dynamic behavior baseline model can also include behavior pattern vectors. For example, a communication sequence or instruction sequence over a period of time can be abstracted into a feature vector. Normal behaviors will cluster in one or more clusters in the feature space. New behavior vectors that deviate from all these normal clusters are considered abnormal indicators.

[0065] Understandably, the above steps S101 and S102 can be executed simultaneously or sequentially, and the order is not limited.

[0066] S103, the vehicle sends a node abnormal event association diagram to the cloud, and the cloud receives the node abnormal event association diagram accordingly.

[0067] S104, the cloud adds the suspicious edge relationships in the abnormal event association graph as preset low-confidence abnormal relationships to the above-mentioned behavioral knowledge graph, and obtains the updated behavioral knowledge graph.

[0068] In this embodiment of the application, the suspected connection relationship is the entity connection relationship not included in the above-mentioned behavioral knowledge graph.

[0069] For example, in a behavioral knowledge graph, red dashed edges are used to represent pre-defined low-confidence abnormal relationships.

[0070] S105, based on the updated behavioral knowledge graph, uses graph reasoning algorithms and preset recognition rules to analyze the connectivity between nodes and identify target attack chains that match or are similar to known attack patterns.

[0071] In the embodiments of this application, the target attack chain is an attack chain across entities within a single subsystem or an attack chain across multiple subsystems. This solution can identify both complex attack chains across multiple entities within a single subsystem and complex attack chains across multiple subsystems.

[0072] In this embodiment, the graph reasoning algorithm is used to discover preset potential attack relationships, such as lateral movement attacks, cooperative attacks, and novel attacks.

[0073] This solution, based on preset identification rules analysis and graph reasoning algorithms, intelligently and automatically determines complex attacks that cross entities or subsystems, rather than simply comparing thresholds. It can effectively identify complex attacks that span different entities or functional subsystems.

[0074] In some possible implementations, graph inference algorithms and preset identification rules are used to analyze the connectivity of relationships between nodes and identify target attack chains across subsystems. This includes: searching for reachable paths from abnormal nodes to preset key asset nodes in the behavioral knowledge graph based on the graph inference algorithm, identifying lateral movement attack chains, and calculating and updating the attack confidence of nodes on the reachable paths by combining the abnormal attribute information of nodes and edges on the reachable paths; identifying suspicious subgraphs formed by multiple seemingly isolated abnormal nodes in the behavioral knowledge graph within a preset time period based on the graph inference algorithm, identifying collaborative attack chains, and calculating the attack confidence of nodes on the suspicious subgraphs by combining the abnormal attribute information of nodes and edges on the suspicious subgraphs to update the attack confidence of nodes on the suspicious subgraphs; using the semantic information of the behavioral knowledge graph, based on graph neural networks or subgraph isomorphism algorithms, determining new attack chains that are structurally similar to known attack patterns but have different specific entities on the attack chains, and calculating the attack confidence of nodes on the new attack chains by combining the abnormal attribute information of nodes and edges on the new attack chains to update the attack confidence of nodes on the new attack chains.

[0075] In some possible implementations, the graph reasoning algorithm includes path analysis, community detection, and subgraph matching. The path analysis is used to identify connected paths from anomalous nodes to critical asset nodes; the community detection is used to identify anomalous entity clusters with highly similar behavioral patterns; and the subgraph matching is used to identify patterns that match known attack patterns and known attackers.

[0076] In some possible implementations, the cloud-based approach in step S105 above uses graph inference algorithms and preset identification rules to analyze the connectivity between nodes and identify target attack chains that match or are similar to known attack patterns. Specifically, this includes: the cloud first identifying suspected lateral movement attack chains and suspected cooperative attack chains based on path analysis and community detection algorithms in the graph inference algorithm; then identifying known lateral movement attack chains and known cooperative attack chains among the suspected lateral movement attack chains and suspected cooperative attack chains based on subgraph matching algorithms; and finally, identifying novel lateral movement attack chains and novel cooperative attack chains among the unknown suspected lateral movement attack chains and unknown suspected cooperative attack chains based on graph neural networks or subgraph isomorphism algorithms.

[0077] Among them, the suspected lateral movement attack chain is a reachable path from an abnormal node to a preset key asset node found by a path analysis algorithm from a behavioral knowledge graph; the suspected cooperative attack chain is a suspicious subgraph in an abnormal entity cluster with highly similar behavioral patterns identified by a community detection algorithm and a path analysis algorithm; the suspicious subgraph contains two or more nodes with abnormal indicators, and the time of the abnormal events of the two or more nodes with abnormal indicators is within a preset time period (e.g., within 2 minutes); the novel lateral movement attack chain is a new attack chain with a structure similar to the known lateral movement attack pattern but different specific entities; and the novel cooperative attack chain is a new attack chain with a structure similar to the known cooperative attack pattern but different specific entities.

[0078] This approach does not directly perform subgraph matching of known attack chains, thus determining that the system is safe and nothing has happened if the matching fails. Instead, it first identifies suspected attack chain behaviors. Even if the suspected attack chain fails to match the known subgraph, the system can still know that an unknown attack behavior with characteristics resembling a lateral movement attack has occurred. This allows the system to speculate on unknown attack paths, identify new attack chains, and greatly expand the boundaries of security identification capabilities.

[0079] As an example, cloud-based identification of lateral movement attack chains includes: searching for reachable paths from anomalous nodes to preset key asset nodes in the behavioral knowledge graph based on path analysis algorithms. If a reachable path is found, a subgraph matching algorithm is used to determine whether the reachable path matches a known lateral movement attack pattern. If a match is found, the reachable path is identified as a lateral movement attack chain, and the lateral movement attack chain in the behavioral knowledge graph is marked as a preset high-confidence attack relationship chain (e.g., represented by red solid lines connecting edges). Furthermore, a community detection algorithm can be used to determine whether the anomalous nodes in the reachable path form a larger community cluster with other anomalous nodes in the graph. If subgraph matching fails, it means that a new attack pattern may have been discovered, triggering the "new attack chain" detection process to identify new attack chains that are structurally similar to known lateral movement attack chains but whose specific entities are not completely identical.

[0080] In this embodiment, after determining that the reachable path is a lateral movement attack chain, the cloud can also determine its attack confidence level based on the abnormal indicators of the nodes on the lateral movement attack chain. For example, if multiple key nodes on the path all exhibit high abnormal indicators, the attack confidence level is determined to be a preset high confidence level (e.g., 95%). Based on this attack confidence level, the attack severity level is determined, and a corresponding response strategy is generated and sent to the vehicle. If the community detection algorithm also determines that the abnormal nodes in the reachable path belong to a large botnet community, it indicates that this lateral movement attack is not an isolated event but part of a large-scale coordinated attack, further increasing the severity level of the lateral movement attack.

[0081] As another example, cloud-based identification of collaborative attack chains includes: identifying a cluster of abnormal entities with highly similar behavioral patterns based on a community detection algorithm; then, using a path analysis algorithm, determining whether the cluster contains a suspicious subgraph containing two or more nodes with anomalous indicators, and the occurrence of anomalous events at these nodes all within a preset time period (e.g., within 2 minutes); if a suspicious subgraph is found, determining whether it belongs to a known collaborative attack pattern based on a subgraph matching algorithm. If it belongs to a known collaborative attack pattern, the reachable path is identified as a collaborative attack chain. If it does not belong to a known collaborative attack pattern, the "new attack chain identification" detection process is triggered.

[0082] In some possible implementations, for the aforementioned unknown suspected lateral movement attack chains and unknown suspected cooperative attack chains that cannot be identified as novel lateral movement attack chains and novel cooperative attack chains based on graph neural networks or subgraph isomorphism algorithms, the cloud can also display them to the user for further manual confirmation.

[0083] In some possible implementations, after identifying the target attack chain, the cloud identifies preset low-confidence anomaly relationships on the target attack chain as preset high-confidence attack relationships. For example, in a behavioral knowledge graph, the solid red lines represent preset low-confidence anomaly relationships.

[0084] In some possible implementations, after identifying the target attack chain, the cloud will also mark the source node of the target attack chain as having been attacked and reduce the confidence of other normal connections related to the source node.

[0085] In some possible implementations, after identifying a target attack chain, the cloud also generates a preset response strategy and sends it to the vehicle. The preset response strategy includes at least one of the following operations: outputting a security notification, isolating the Electronic Control Unit (ECU) associated with the target attack chain (clearly indicating the entity to be isolated), disabling related services, or entering a safe mode. The security notification indicates relevant information about the target attack chain (e.g., including but not limited to attack path nodes and connectivity, attack confidence). For example, the cloud determines the preset response strategy based on the severity level of the target attack chain.

[0086] In some possible implementations, after identifying the target attack chain, the cloud will also use the full-link data of the target attack chain as feedback samples to optimize and update the entity's dynamic behavior baseline model and behavior knowledge graph, so as to realize the self-learning and evolution of the entity's dynamic behavior baseline model and behavior knowledge graph.

[0087] Example 2:

[0088] The following Figure 1 Based on the method and flow shown, combined with Figure 2 Taking a specific lateral movement attack as an example, this paper illustrates one specific implementation method of the present application.

[0089] As an example, when a T-Box suddenly establishes a connection to an unknown IP address while the vehicle is in motion (network anomaly), simultaneously, a non-core process of the infotainment system attempts to access the CAN bus (system behavior anomaly), and brake sensor data exhibits brief abnormal fluctuations (vehicle status anomaly), these three anomaly indicators from different data sources, after being correlated in step S102, will form a tightly connected "suspicious subgraph" in the knowledge graph of S4. The inference engine in S5, based on preset rules such as "non-critical components attempting to access critical buses," will determine that this is a potential remote intrusion and vehicle control attempt, thereby triggering a high-level alarm and restricting the process's permissions in S6. Data from the entire process will be recorded to update relevant baselines and graphs, making the system more sensitive to similar behaviors in the future.

[0090] Phase 1: Initial Intrusion (Starting from the Networked System)

[0091] Anomaly detection: A process called ssh_daemon in the T-Box established a connection with an external public IP address (which violates the dynamic baseline that "the T-Box should only communicate with cloud services while in motion").

[0092] Graph representation: A new, questionable red dashed line relationship has been created in the knowledge graph.

[0093] Phase Two: Internal Lateral Movement (From Gateway to Infotainment System)

[0094] Anomaly detection: A telnet_client process that is not normally present suddenly appeared on the gateway ECU, and this process actively connected to port 23 of the infotainment system ECU.

[0095] Knowledge Graph Representation: In the knowledge graph: A new anomalous child node, telnet_client, was created under the gateway ECU node. A new, unusual relationship with a red dashed line was established between the gateway ECU and the infotainment system ECU. The explorer.exe process of the infotainment system ECU was marked as anomalous because it gained unauthorized privileges.

[0096] Phase Three: Reaching Key Control Domains (From Infotainment Systems to Body and Powertrain Systems)

[0097] Anomaly Detection: A process on the compromised infotainment system ECU began attempting to access the body control module's (BCM) can_bus_bind service. Subsequently, the BCM sent commands to the powertrain domain controller's throttle_control service.

[0098] The knowledge graph reveals a red anomaly chain, linking non-critical infotainment systems to critical vehicle body and powertrain systems. This severely violates the security policy that "infotainment systems have no right to directly request critical control services."

[0099] Hazard Identification and Conclusions:

[0100] By analyzing the above graph, the graph reasoning engine can clearly identify a complete lateral movement attack chain from "Network Access Point (T-Box)" → "Network Hub (Gateway ECU)" → "In-Vehicle Information Node (Infotainment System)" → "Body Control" → "Core Power Control" (highlighted red dashed path in the graph).

[0101] System response:

[0102] The system not only alerts to "abnormal connection detected," but also reports precisely: "A lateral movement attack originating from the external network has been detected. The attacker has penetrated the gateway through the T-Box and further controlled the infotainment system, currently attempting to illegally operate the throttle via the body control module." It is recommended to immediately isolate the T-Box, gateway ECU, and infotainment system ECU.

[0103] It is understood that this application embodiment uses the cloud as an example to illustrate the execution entity in the vehicle information security identification method based on behavioral knowledge graph provided in this application, which is applied to the cloud. The cloud can also be understood as the vehicle information security identification device based on behavioral knowledge graph shown in this application embodiment. In this application embodiment, the cloud can be any electronic device such as a microprocessor or computer used to execute program code. Any electronic device in the cloud that can be used to execute the method provided in this application embodiment is within the protection scope of this application embodiment, and this application does not impose any limitations. For example, the electronic device in the cloud can be a 32-bit microprocessor, a 64-bit microprocessor, a server, a server cluster, etc., and this application embodiment does not limit this.

[0104] It is understood that this application embodiment uses a vehicle as an example to illustrate the execution subject in the vehicle information security identification method based on behavioral knowledge graph provided in this application. The vehicle can also be understood as the vehicle information security identification device based on behavioral knowledge graph shown in this application embodiment. In this application embodiment, the vehicle can be any electronic device such as a microprocessor or computer used to execute program code. Any electronic device on the vehicle that can be used to execute the method provided in this application embodiment falls within the protection scope of this application embodiment, and this application does not impose any limitations. For example, the electronic device on the vehicle can be a 32-bit microprocessor, a 64-bit microprocessor, a chip, an ECU, etc., and this application embodiment does not limit this.

[0105] This application also provides a vehicle information security identification device based on behavioral knowledge graph, including a unit for executing any of the vehicle information security identification methods based on behavioral knowledge graph in the above method embodiments.

[0106] Please refer to Figure 3 This application provides a schematic diagram of the structure of a vehicle information security identification device based on behavioral knowledge graphs applied in the cloud. For example... Figure 3 As shown, the vehicle information security identification device based on behavioral knowledge graph in this application embodiment may include:

[0107] The first determining unit 301 is used to determine the behavioral knowledge graph;

[0108] The receiving unit 302 is used to receive the node abnormal event association diagram from the vehicle end;

[0109] The drawing unit 303 is used to add the suspicious edge relationships in the abnormal event association graph as preset low-confidence abnormal relationships to the behavior knowledge graph to obtain the updated behavior knowledge graph.

[0110] The second determining unit 304 is used to analyze the connectivity of relationships between nodes based on the updated behavioral knowledge graph, using graph reasoning algorithms and preset identification rules, identify target attack chains that match or are similar to known attack patterns, and confirm the preset low-confidence abnormal relationships on the target attack chains as preset high-confidence attack relationships.

[0111] In some possible implementations, the second determining unit 304 specifically includes:

[0112] The first identification subunit is used to search for reachable paths from abnormal nodes to preset key asset nodes in the behavioral knowledge graph based on graph reasoning algorithms, identify lateral movement attack chains, and calculate and update the attack confidence of nodes on the reachable path by combining the abnormal attribute information of nodes and edges on the reachable path.

[0113] The second identification subunit is used to identify suspicious subgraphs formed by multiple seemingly isolated abnormal nodes in the behavioral knowledge graph within a preset time period based on the graph reasoning algorithm, identify collaborative attack chains, and calculate attack confidence based on the abnormal attribute information of nodes and edges on the suspicious subgraphs in order to update the attack confidence of nodes on the suspicious subgraphs.

[0114] The third identification subunit is used to utilize the semantic information of the behavioral knowledge graph, based on graph neural networks or subgraph isomorphism algorithms, to determine a new attack chain that is structurally similar to a known attack pattern but has different specific entities on the attack chain, and to calculate the attack confidence by combining the abnormal attribute information of the nodes and edges on the new attack chain, so as to update the attack confidence of the nodes on the new attack chain.

[0115] In some possible implementations, the device further includes: a processing unit for generating a preset response strategy; a sending unit for sending the preset response strategy to the vehicle terminal; a marking unit for marking the source node of the target attack chain as attacked and reducing the confidence of other normal connection relationships related to the source node; and an updating unit for using the full-link data of the target attack chain as feedback samples to optimize and update the dynamic behavior baseline model of the entity and the behavior knowledge graph, so as to achieve self-learning and evolution of the dynamic behavior baseline model of the entity and the behavior knowledge graph.

[0116] In some possible implementations, the device further includes: a third determining unit, configured to determine the dynamic behavior baseline model corresponding to each entity of the vehicle based on a large amount of historically reliable heterogeneous data streams; the aforementioned sending unit is further configured to send the dynamic behavior baseline model of each entity to the vehicle terminal, so that the vehicle terminal calculates the abnormal indicators of the entities based on the dynamic behavior baseline model of each entity and determines the node abnormal event association graph by associating entities with abnormal indicators.

[0117] In some possible implementations, the first identification unit is specifically used to search for reachable paths from abnormal nodes to preset key asset nodes in the behavioral knowledge graph based on path analysis and community detection algorithms in graph reasoning algorithms, and to identify suspected lateral movement attack chains; and to identify known lateral movement attack chains that match known lateral movement attack patterns in the suspected lateral movement attack chains based on subgraph matching algorithms.

[0118] The aforementioned second identification unit is specifically used to identify suspicious subgraphs formed by multiple seemingly isolated abnormal nodes in the behavioral knowledge graph within a preset time period based on path analysis and community detection algorithms in graph reasoning algorithms, and to identify suspected collaborative attack chains; and to identify known collaborative attack chains that match known collaborative attack patterns in the suspected collaborative attack chains based on subgraph matching algorithms.

[0119] The aforementioned third identification unit is specifically used to utilize the semantic information of the behavioral knowledge graph, based on graph neural networks or subgraph isomorphism algorithms, to identify novel lateral movement attack chains in unknown suspected lateral movement attack chains that are structurally similar to known lateral movement attack patterns but have different specific entities on the attack chain, and to identify novel cooperative attack chains in unknown suspected cooperative attack chains that are structurally similar to known cooperative attack patterns but have different specific entities on the attack chain.

[0120] Please refer to Figure 4 This application provides a schematic diagram of the structure of a vehicle information security identification device based on behavioral knowledge graphs applied in the cloud. For example... Figure 4 As shown, the vehicle information security identification device based on behavioral knowledge graph in this application embodiment may include:

[0121] The calculation unit 401 is used to calculate the abnormal indicators of entities based on the dynamic behavior baseline model of entities, and to determine the node abnormal event association graph by associating entities with abnormal indicators.

[0122] The sending unit 402 is used to send the abnormal event association graph to the cloud so that the cloud updates the behavioral knowledge graph based on the abnormal event association graph, uses graph reasoning algorithm and preset recognition rules to analyze the connectivity of the relationship between nodes, and identifies the target attack chain that matches or is similar to the known attack pattern.

[0123] In some possible implementations, the device also includes:

[0124] The determination unit is used to learn and determine the dynamic behavior baseline model corresponding to each entity of the vehicle based on a large amount of historically reliable heterogeneous data streams.

[0125] Any implementation method mentioned in the method embodiments of this application is also applicable to the implementation provided in this application. Figure 3 or Figure 4 The specific execution steps of the vehicle information security identification device based on behavioral knowledge graph shown can be found in the description of the aforementioned method embodiments, and will not be detailed here.

[0126] This application also provides a vehicle information security identification device based on behavioral knowledge graph for application in the cloud or vehicle, including a processor, which is used to execute any of the vehicle information security identification methods based on behavioral knowledge graph in the above method embodiments.

[0127] Please refer to Figure 5 This is a schematic diagram of another vehicle information security identification device based on behavioral knowledge graph provided in an embodiment of this application, as shown below. Figure 5 As shown, the vehicle information security identification device 500 based on behavioral knowledge graphs may include: at least one processor 501, such as a CPU, at least one communication interface 503, a memory 504, and at least one communication bus 502. The communication bus 502 is used to enable communication between these components. The communication interface 503 may optionally include a standard wired interface, a wireless interface (such as a Wi-Fi interface or a Bluetooth interface), etc. The memory 504 may be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage device. Optionally, the memory 504 may also be at least one storage device located remotely from the aforementioned processor 501. Figure 5 As shown, the memory 504, which serves as a computer storage medium, may include an operating system, a network communication module, and program instructions.

[0128] exist Figure 5 In the vehicle information security identification device 500 based on behavioral knowledge graph shown, the processor 501 can be used to load the program instructions stored in the memory 504 and specifically execute any of the implementation methods in the above method embodiments.

[0129] It should be noted that the specific execution process can be found in the detailed description of the above method embodiments, and will not be elaborated here.

[0130] For specific execution steps, please refer to the description of the foregoing method embodiments, which will not be detailed here.

[0131] This application also provides a computer storage medium that can store multiple instructions. These instructions are adapted to be loaded and executed by a processor. The specific execution process can be found in the detailed description of the method embodiments shown above, and will not be elaborated here.

[0132] This application also provides a computer program product containing instructions that, when run on an electronic device, cause the electronic device to execute the method steps of the method embodiments shown above.

[0133] This application also provides a chip module, including a transceiver component and a chip, wherein the chip is used to execute the method steps of the above-described method embodiments.

[0134] It is understood that the vehicle information security identification system based on behavioral knowledge graph, the vehicle information security identification device based on behavioral knowledge graph, the computer storage medium, the computer program, the computer program product, and the chip provided above are all used to execute the methods shown in any implementation of the corresponding aspects of the embodiments of this application. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects in the corresponding methods, and will not be detailed here.

[0135] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes the processes of the embodiments of the above methods.

[0136] The term "at least one" in this application refers to one or more items. "More than one item" means two or more items. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. Furthermore, it should be understood that although the terms "first," "second," etc., may be used to describe objects in this application, these objects should not be limited to these terms. These terms are only used to distinguish the objects from each other.

[0137] The terms “including” and “having” mentioned above, and any variations thereof, are intended to cover non-exclusive inclusion.

[0138] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A vehicle information security identification method based on behavioral knowledge graph, characterized in that, Applied to the cloud, the method includes: A behavioral knowledge graph is defined, wherein nodes in the behavioral knowledge graph are used to represent entities of the vehicle, edges are used to represent normal or abnormal interaction relationships between entities, edge attributes include confidence and historical frequency of interaction between nodes, and node attributes include indicators, and the entity is any component in any subsystem of the vehicle. Receive a node anomaly event association graph from the vehicle end, wherein the node anomaly event association graph is determined by the vehicle end through entities associated with anomaly indicators; The suspicious connections in the abnormal event association graph are added to the behavior knowledge graph as preset low-confidence abnormal connections to obtain an updated behavior knowledge graph. The suspicious connections are entity-to-entity connections not included in the behavior knowledge graph. Based on the updated behavioral knowledge graph, the connectivity between nodes is analyzed using graph reasoning algorithms and preset recognition rules to identify target attack chains that match or are similar to known attack patterns. The target attack chains are either cross-entity attack chains within a single subsystem or cross-multiple subsystem attack chains. The method employs graph reasoning algorithms and preset identification rules to analyze the connectivity between nodes and identify target attack chains that match or are similar to known attack patterns, including: Based on path analysis in graph reasoning algorithms, the algorithm searches for reachable paths from abnormal nodes to preset key asset nodes in the behavioral knowledge graph to identify suspected lateral movement attack chains; based on subgraph matching algorithms, it identifies known lateral movement attack chains that match known lateral movement attack patterns among the suspected lateral movement attack chains. Based on path analysis and community detection algorithms in graph reasoning algorithms, suspicious subgraphs formed by multiple isolated abnormal nodes in the behavioral knowledge graph within a preset time period are identified, and suspected collaborative attack chains are identified. The suspicious subgraphs contain two or more nodes with abnormal indicators, and the time of the abnormal events of the two or more nodes with abnormal indicators is within the preset time period. Based on subgraph matching algorithms, known collaborative attack chains that match known collaborative attack patterns are identified in the suspected collaborative attack chains. Using the semantic information of the behavioral knowledge graph, and based on graph neural networks or subgraph isomorphism algorithms, novel lateral movement attack chains are identified among unknown suspected lateral movement attack chains that are structurally similar to known lateral movement attack patterns but have different specific entities on the attack chain. Additionally, novel cooperative attack chains are identified among unknown suspected cooperative attack chains that are structurally similar to known cooperative attack patterns but have different specific entities on the attack chain. The unknown suspected lateral movement attack chains are suspected lateral movement attack chains other than known lateral movement attack chains, and the unknown suspected cooperative attack chains are suspected cooperative attack chains other than known cooperative attack chains.

2. The method as described in claim 1, characterized in that, The graph reasoning algorithm includes path analysis, community detection, and subgraph matching. The path analysis is used to identify the connectivity paths from anomalous nodes to critical asset nodes. The community detection is used to identify clusters of anomalous entities with highly similar behavioral patterns. The subgraph matching is used to identify patterns that match known attack patterns.

3. The method as described in claim 1 or 2, characterized in that, The entities include hardware entities, software entities, data entities, and logical entities; wherein, the hardware entities include electronic control units (ECUs) and sensors, the software entities include processes and services, the data entities include messages and instructions, and the logical entities include driving behavior and user sessions; The anomaly indicators include scalar values ​​and vectors. The scalar values ​​include any one of deviation, probability value, and similarity score. The vectors include behavioral pattern vectors.

4. The method as described in claim 1 or 2, characterized in that, After identifying the target attack chain, the method further includes: The preset low-confidence anomaly relationship on the target attack chain is identified as a preset high-confidence attack relationship; The attack confidence of the nodes on the target attack chain is calculated and updated by combining the abnormal attribute information of the nodes and edges on the target attack chain; The source node of the target attack chain is marked as attacked, and the confidence of other normal connections related to the source node is reduced. A preset response strategy is generated and sent to the vehicle. The preset response strategy includes at least one of the following operations: outputting a security notification related to the target attack chain, isolating the electronic control unit (ECU) related to the target attack chain, disabling related services, and entering a safe mode. Using the full-link data of the target attack chain as feedback samples, the dynamic behavior baseline model and the behavior knowledge graph of the entity are optimized and updated to achieve self-learning and evolution of the dynamic behavior baseline model and the behavior knowledge graph of the entity.

5. A vehicle information security identification device based on behavioral knowledge graph, characterized in that, Includes a unit for performing the method as described in any one of claims 1 to 4.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program, and when the computer program is executed, the method of any one of claims 1 to 4 is performed.

Images