Security vulnerability management system of intelligent networked vehicle-mounted terminal

Abstract

The invention relates to the technical field of data processing, in particular to a security vulnerability management system for a vehicle-mounted terminal of an intelligent networked automobile, and the system comprises a data collection module which is used for collecting event control data; the preliminary probability module is used for calculating the preliminary abnormal probability of the event; the abnormal probability module is used for acquiring an event which is the same as the initiating terminal corresponding to the target event, and adjusting the initial abnormal probability of the target event in combination with the occurrence frequency of the event to obtain the abnormal probability of the target event; the control exception module is used for calculating continuous control exception parameters of the target event according to the control relation of different events on the initiating terminal and the receiving terminal and the sequence of the events in combination with the exception probability of the events; and the vulnerability management module is used for performing vulnerability risk assessment and repair by using the abnormal probability of the event and the continuous control abnormal parameters. According to the invention, the safety and reliability of the communication process of the intelligent connected automobile are ensured.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically to a security vulnerability management system for intelligent connected vehicle in-vehicle terminals. Background Technology

[0002] With the rapid development of intelligent connected vehicle technology, in-vehicle terminals, as an important component of intelligent vehicles, undertake key functions such as vehicle control, information interaction, and data processing. However, security issues of in-vehicle terminals have gradually emerged, becoming one of the bottlenecks restricting the development of intelligent connected vehicles. In particular, the command interaction events between in-vehicle terminals (hereinafter referred to as events) used for vehicle control are vulnerable to security vulnerabilities such as remote intrusion, data tampering, and malware attacks, which directly affect vehicle safety.

[0003] In the detection of anomalies between vehicle terminals, existing analyses are often based on the matching relationship between the terminals corresponding to the events and the frequency of event occurrence. That is, anomalies are identified by high-frequency repetitive events. However, some advanced malicious attacks may be able to mimic the frequency of event occurrence, resulting in low accuracy of existing methods. At the same time, the control between vehicle terminals in reality is quite complex and often involves continuous control logic. Advanced malicious attacks cannot mimic the continuous control between terminals. Therefore, general anomaly event identification methods do not analyze the continuous control between events, which makes it impossible to identify some advanced malicious attacks and affects the management of security vulnerabilities in vehicle terminals. Summary of the Invention

[0004] This invention provides a security vulnerability management system for intelligent connected vehicle in-vehicle terminals to solve existing problems.

[0005] The security vulnerability management system for intelligent connected vehicle in-vehicle terminals of the present invention adopts the following technical solution: One embodiment of the present invention provides a security vulnerability management system for an intelligent connected vehicle in-vehicle terminal, the system comprising the following modules: The data acquisition module is used to collect event control data, which includes several events, each event corresponding to a sending timestamp and a receiving timestamp, as well as an initiating terminal and a receiving terminal; The preliminary probability module is used to calculate the preliminary probability of an event's anomaly based on its frequency of occurrence. The anomaly probability module is used to take any event as the target event, obtain the same events as the initiating terminal corresponding to the target event, and adjust the initial anomaly probability of the target event based on the occurrence frequency of the event to obtain the anomaly probability of the target event. The control anomaly module is used to calculate the continuous control anomaly parameters of the target event based on the control relationship between different events on the initiating terminal and the receiving terminal, as well as the order in which the events occur, and in combination with the anomaly probability of the events. The vulnerability management module is used to assess and remediate vulnerability risks by utilizing the abnormal probability of events and continuously controlling abnormal parameters.

[0006] Optionally, the specific method for calculating the preliminary anomaly probability of an event based on its occurrence frequency includes: Obtain the frequency of any event, and denote it as the first frequency of the event; Use the sending timestamp of any event as the occurrence time of the corresponding event, with a preset duration parameter. And construct a length of The time window is defined by taking the occurrence time of the event as the center point of the time window, obtaining the frequency of the event within the time window, which is recorded as the local frequency of the event, and taking the ratio of the local frequency of the event to the duration parameter corresponding to the time window as the local occurrence frequency of the event. The preliminary anomalous probability of an event is obtained based on the difference between the local occurrence frequency of any event and the first frequency of the event.

[0007] Optionally, the specific method for obtaining the event that is the same as the initiating terminal corresponding to the target event includes: Obtain the receiving terminal and the initiating terminal corresponding to the target event, and record them as the target receiving terminal and the target initiating terminal of the target event, respectively. Record all events with the target receiving terminal as the receiving terminal as the first event of the target receiving terminal.

[0008] Optionally, the specific method for calculating the anomalous probability of the target event is as follows: Obtain the first frequency of all first events, and record the cumulative value of the first frequencies of all first events as the second frequency of the target event; Based on the difference between the first and second frequencies of the target event, the relative frequency of the target event is obtained. The relative frequency of the target event is adjusted using the initial abnormal frequency of the target event to obtain the abnormal probability of the target event. The first frequency and the initial abnormal probability of the target event are positively correlated with the abnormal probability of the target event, while the second frequency of the target event is negatively correlated with the abnormal probability of the target event.

[0009] Optionally, the specific method for calculating the continuous control anomaly parameters of the target event based on the control relationship between different events on the initiating terminal and the receiving terminal, the order in which the events occur, and in combination with the anomaly probability of the events, includes: Based on the control relationship between different events on the initiating terminal and the receiving terminal, as well as the order in which the events occur, the prerequisite events and co-control prerequisite events of the events are obtained. Based on the first frequency of the prerequisite events and co-control prerequisite events of the target event, the degree of abnormality of the continuous control logic of the target event is calculated. Based on the time intervals between the target event, the co-control relationship event, and the corresponding prerequisite event, and combined with the anomaly probability of the co-control prerequisite event corresponding to the co-control relationship event of the target event, the time correlation deviation between the target event and the co-control prerequisite event is calculated; the continuous control logic anomaly degree of the target event and the time correlation deviation are combined to obtain the continuous control anomaly parameter of the target event.

[0010] Optionally, the specific method for obtaining the prerequisite events and co-control prerequisite events based on the control relationship between different events on the initiating terminal and the receiving terminal, as well as the order in which the events occur, includes: Events that are identical to the target initiating terminal and the target receiving terminal corresponding to the target event are taken as the same control relationship events of the target event. The time corresponding to the time that is closest in time to the occurrence time of the target event is taken as the premise event of the target event, thus obtaining the premise event of each event. The initiating terminal and receiving terminal corresponding to the prerequisite events of the target event are obtained and denoted as the prerequisite initiating terminal and prerequisite receiving terminal of the target event, respectively. Among the prerequisite events of all control-related events of the target event, the prerequisite events whose corresponding initiating terminal and receiving terminal are both the prerequisite initiating terminal and prerequisite receiving terminal of the target event are obtained and denoted as the control-related prerequisite events of the target event.

[0011] Optionally, the specific method for calculating the degree of continuous control logic anomaly of the target event based on the first frequency of the prerequisite events and co-control prerequisite events of the target event includes: In the prerequisite events of all events with the same control relationship to the target event, the first frequency of the corresponding events under the same initiating terminal and receiving terminal is counted and recorded as the common control prerequisite frequency of the target event. Based on the common control prerequisite frequency of the target event and the first frequency of the prerequisite events of the target event, the degree of continuous control logic anomaly of the target event is calculated.

[0012] Optionally, the method for calculating the time correlation deviation between the target event and the co-control relationship event based on the time interval between the occurrence of the target event, the co-control relationship event, and the corresponding prerequisite event, and in combination with the anomaly probability of the co-control relationship event corresponding to the co-control prerequisite event of the target event, includes the following specific methods: The time interval between the occurrence times of the target event and its prerequisite events is obtained and denoted as the prerequisite interval of the target event. The time interval between the occurrence times of any co-control relationship event of the target event and its corresponding co-control prerequisite events is obtained and denoted as the prerequisite interval of the co-control relationship event of the target event. Based on the difference between the prerequisite interval of the target event and the prerequisite interval between any co-control relationship events, the interval deviation between the target event and the co-control relationship events is obtained. By using the method for obtaining the abnormal probability of an event, the abnormal probability of the pre-control event corresponding to any pre-control event of the target event is obtained. By combining the abnormal probability of any pre-control event of the target event and the interval deviation, the time correlation deviation between the target event and the pre-control event is obtained.

[0013] Optionally, the specific method for combining the degree of continuous control logic anomaly of the target event with the time correlation deviation to obtain the continuous control anomaly parameter of the target event includes: The cumulative value of the time correlation deviation between the target event and all events with the same control relationship is recorded as the continuous control time deviation of the target event. Combining the degree of continuous control logic anomaly of the target event and the continuous control time deviation, the continuous control anomaly parameter of the target event is obtained. Both the degree of continuous control logic anomaly and the continuous control time deviation are positively correlated with the continuous control anomaly parameter.

[0014] Optionally, the specific methods for vulnerability risk assessment and remediation using the anomaly probability of events and continuously controlled anomaly parameters include: The product of the anomaly probability of the target event and the continuously controlled anomaly parameter is obtained as the final anomaly factor of the target event; the final anomaly factors of all events are linearly normalized to obtain the final anomaly coefficient of any event; an anomaly threshold is preset, and events with a final anomaly coefficient greater than or equal to the anomaly threshold are regarded as anomaly events. By using the final anomaly coefficient of the abnormal event, the risk level of the abnormal event is set, and corresponding risk management is carried out for abnormal events of different risk levels, and the vulnerabilities involved in the abnormal event are repaired.

[0015] The beneficial effects of the technical solution of this invention are as follows: It achieves refined security analysis and risk assessment of vehicle communication events through multi-module collaboration. The data acquisition module comprehensively acquires event control data including timestamps and information from both communicating parties, providing a reliable data foundation for subsequent analysis; the preliminary probability module performs statistical analysis based on event occurrence frequency, initially identifying potential abnormal behaviors and improving the objectivity of anomaly detection; the anomaly probability module further combines associated event information from the same initiating terminal to dynamically adjust the anomaly probability of each event, enhancing the accuracy of judgment and context awareness; the control anomaly module introduces control relationships and timing logic between terminals, comprehensively considering the rationality of events in actual control logic, effectively identifying behaviors that violate normal control logic, and significantly improving the detection capability for covert attacks or illegal operations; the vulnerability management module integrates anomaly probability and continuous control anomaly parameters to achieve comprehensive risk assessment of system security vulnerabilities and support subsequent early warning and remediation decisions. The entire system achieves full-process coverage from data acquisition to risk closed-loop management, improving the vehicle terminal's ability to identify and respond to complex network threats, and ensuring the security and reliability of intelligent connected vehicle communication processes. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a structural block diagram of a security vulnerability management system for an intelligent connected vehicle terminal according to the present invention. Detailed Implementation

[0018] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a security vulnerability management system for an intelligent connected vehicle terminal proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0019] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0020] The following description, in conjunction with the accompanying drawings, details the specific solution of a security vulnerability management system for an intelligent connected vehicle terminal provided by this invention.

[0021] Please see Figure 1 The diagram illustrates a structural block diagram of a security vulnerability management system for an intelligent connected vehicle terminal according to an embodiment of the present invention. The system includes the following modules: The data acquisition module 101 is used to collect event control data.

[0022] It should be noted that in vehicle control, the control events between vehicle terminals are the core carrier of "inter-terminal command interaction" within intelligent connected vehicles, and are directly related to the execution of vehicle functions and state coordination. Therefore, the security of control communication between vehicle terminals is a key target for vehicle terminal security testing.

[0023] To implement the security vulnerability management system for intelligent connected vehicle in-vehicle terminals proposed in this embodiment, it is first necessary to collect event control data. The specific process is as follows: First, determine the data collection tools and interfaces, and then collect the data.

[0024] As an optional embodiment, the specific process of determining the data acquisition tool and interface and performing data acquisition includes: Bus acquisition: Access the vehicle's CAN / LIN / Ethernet bus via devices such as CANoe and VN1630, and parse the command frames on the bus (including initiator / receiver terminal ID and data fields).

[0025] Terminal Log: A built-in log module is provided in decision-making / execution terminals to record "instruction reception time, execution result, and reason for exception".

[0026] Time synchronization: The vehicle clock synchronization protocol ensures that the timestamp error of each terminal is ≤1ms.

[0027] Then, the collected data is recorded in a structured format using CSV format.

[0028] It should be noted that the data recorded in the structured format using CSV is exemplified in Table 1. Furthermore, the data collected in the above process includes data from the actual normal driving process of the vehicle, as well as data from simulating typical operating conditions in the hardware-in-the-loop (HIL) simulation environment.

[0029] Thus, the event control data has been obtained using the methods described above.

[0030] The preliminary probability module 102 is used to calculate the preliminary probability of an event's abnormality based on the frequency of its occurrence.

[0031] It should be noted that when performing CAN / LIN bus (hereinafter referred to as bus) detection, the main focus is on event requests (hereinafter referred to as events) used by the terminal to control the vehicle. One event includes a request command and a receiving terminal. For example, an event is "turn signal on". Then, by identifying abnormal events of the terminal, bus vulnerabilities are identified. In the vehicle terminal, the occurrence of each event must conform to the vehicle control logic. In vehicle control, all events are designed with different operating conditions and application scenarios in mind. Considering various scenarios, all events will have a frequency, i.e., the frequency of event occurrence. When the vehicle terminal is subjected to malicious attacks, it generally manifests as multiple consecutive attacks, which will change the frequency of event occurrence. Therefore, for the same event, the greater the deviation between its current occurrence frequency and the frequency under normal operating conditions, the more abnormal the current event behavior. Therefore, this embodiment of the invention obtains the preliminary abnormal probability of the event by performing deviation analysis on the occurrence frequency of the event.

[0032] Specifically, as a preferred embodiment, the method for obtaining the preliminary anomaly probability is as follows: First, obtain the frequency of any event, and denote it as the first frequency of the event.

[0033] Then, the sending timestamp of any event is used as the occurrence time of the corresponding event, with a preset duration parameter. And construct a length of The time window is defined by taking the occurrence time of the event as the center point of the time window, obtaining the frequency of the event within the time window, and recording it as the local frequency of the event. The ratio of the local frequency of the event to the duration parameter corresponding to the time window is taken as the local occurrence frequency of the event.

[0034] It should be noted that the preset duration parameters are based on experience. The duration is 10 seconds, but it can be adjusted according to the actual situation. This embodiment of the invention does not impose a specific limitation.

[0035] Finally, the preliminary anomalous probability of the event is obtained based on the difference between the local occurrence frequency of any event and the first frequency of the event.

[0036] As an optional embodiment, the specific method for calculating the preliminary anomaly probability of any event is as follows: in, Indicates the initial probability of an event being anomalous; Indicates the local frequency of occurrence of an event; Indicates the first frequency of the event; Represents the absolute value function; Indicates the first frequency of the event; This represents the linear normalization function.

[0037] It should be noted that the initial anomaly probability of an event is quantified by normalizing the deviation between the event's frequency within a local time window and its historical normal frequency. This normalization process characterizes the significance of the event's frequency deviating from the vehicle's design operating conditions. The greater the frequency deviation, the more likely the event is to be affected by external interference or malicious attacks. This facilitates the rapid identification of potential threats caused by abnormally high or low frequency triggers, improves the system's real-time perception of sudden attack behaviors, reduces the risk of false alarms based on a single threshold, and lays a data foundation for subsequent refined analysis.

[0038] Thus, the preliminary probability of an anomaly for any event is obtained through the above method.

[0039] The anomaly probability module 103 takes any event as the target event, adjusts the initial anomaly probability of the target event based on the order of occurrence of different events and the target event, as well as the initiating terminal and receiving terminal corresponding to the event, and in combination with the occurrence frequency of the event, to obtain the anomaly probability of the target event.

[0040] It's important to note that for in-vehicle terminals, vehicle control generally follows certain control logic. This common control logic essentially manifests as a control relationship: "who controls whom." Therefore, each event corresponds to a requesting terminal and a receiving terminal. The initiating terminal sends an event request to the receiving terminal, and the receiving terminal responds. This establishes a control relationship between the initiating and receiving terminals. Furthermore, in vehicle control, numerous terminals operate, and the control logic is rigorous. The control relationship for each event is determined through strict design and experimentation. Therefore, the control relationship between the initiating and receiving terminals must strictly adhere to the design logic. However, malicious attacks constantly disrupt the vehicle's designed control relationships. Thus, the control relationships for malicious attacks with security vulnerabilities differ significantly from the designed control relationships. These differences primarily manifest as a mismatch between the initiating and receiving terminals. Given the control relationship of the current event (i.e., the initiating and receiving terminals), search for identical control relationships in the test data. If no identical control relationship exists, the current event can be directly identified as an abnormal event. If an identical control relationship exists, further analysis is required. For example, if the current event is "the air conditioner sends a command to the windshield wipers," but there is no actual event in vehicle control where the air conditioner controls the windshield wipers, then the current event can be directly identified as an abnormal event.

[0041] It should be further clarified that the above analysis of control relationships only addresses the correspondence between the initiating terminal and the receiving terminal of an event. However, in reality, the same terminal can act as either the initiating terminal or the receiving terminal in different events. That is, a terminal acting as a receiving terminal may have different initiating terminals in the corresponding events. Furthermore, the frequency analysis above only considers the events corresponding to the receiving terminal and does not emphasize the corresponding initiating terminal. Therefore, the event frequencies statistically analyzed in the above process may include different initiating terminals. In this case, to highlight the frequency relationship between the receiving terminal and the initiating terminal of an event, it is necessary to analyze the event frequency distribution of the receiving terminal corresponding to different initiating terminals in the test data.

[0042] Specifically, as a preferred embodiment, the method for obtaining the anomaly probability of the event is as follows: First, any event is recorded as the target event. The receiving terminal and the initiating terminal corresponding to the target event are obtained and recorded as the target receiving terminal and the target initiating terminal of the target event, respectively. All events with the target receiving terminal as the receiving terminal are recorded as the first events of the target receiving terminal, and all initiating terminals corresponding to all first events are recorded as the first initiating terminals.

[0043] For example, the process of obtaining the first initiating terminal is as follows: for any event, the receiving terminal of the event is recorded as the terminal. The terminal that initiates the event is denoted as the terminal. , obtain terminal All events received by the receiving terminal are denoted as first events. The initiating terminals corresponding to all first events can be of several types. All initiating terminals corresponding to all first events are obtained and denoted as first initiating terminals, thus yielding a total of... The set of all first initiating terminals corresponding to each first event is represented as follows: ,in Indicates the first The first initiating terminal corresponding to the first event.

[0044] Then, obtain the first frequency of all first events, and record the cumulative value of the first frequencies of all first events as the second frequency of the target event.

[0045] For example, the process of obtaining the second frequency is as follows: for any first event, the first event corresponds to a terminal Using a first initiating terminal and a first frequency acquisition method, the first frequency of any first event is obtained. This yields the set of the first frequencies of all first events, specifically represented as Get the cumulative value of the first frequency of all first events, and denote it as the second frequency. ,in Indicates the first The first frequency of the first event.

[0046] It should be noted that the preliminary anomaly probability corresponding to the current event is known. The only limitation is the receiving terminal, so the preliminary anomaly probability is... This includes events corresponding to different initiating terminals. In this case, to highlight the initial anomaly probability between the initiating and receiving terminals corresponding to the current event... The performance in the event needs to be analyzed to determine the relative frequency of events originating from and receiving the same terminal as the current event, and the frequency of the current event itself. In events where the receiving terminal is terminal A, the relative frequency of events originating from the same terminal and receiving the same terminal represents the relative frequency of the control relationship corresponding to the current event. The higher the relative frequency of the control relationship corresponding to the current event, the higher the initial anomaly probability of the current event. The higher the credibility, the better. Based on this, and considering the relative frequency of the control relationships corresponding to the current event, the initial anomaly probability of the event is corrected: Finally, based on the difference between the first and second frequencies of the target event, the relative frequency of the target event is obtained. The relative frequency of the target event is adjusted using the initial abnormal frequency of the target event to obtain the abnormal probability of the target event. The first frequency and the initial abnormal probability of the target event are positively correlated with the abnormal probability of the target event, while the second frequency of the target event is negatively correlated with the abnormal probability of the target event.

[0047] As an optional embodiment, the specific method for calculating the anomaly probability of any event is as follows: in, Indicates the probability of an event being abnormal; Indicates the first frequency of the target event; Indicates the second frequency of the target event; This indicates the initial probability of an event being anomalous.

[0048] It should be noted that the anomaly probability of an event is used to reflect the reasonableness of the event within the rigorously designed terminal control logic of the vehicle, highlighting the impact of control relationship matching degree on anomaly judgment; in In this study, by introducing specific control relationship constraints between the event initiating terminal and the receiving terminal based on the initial anomaly probability, the relative frequency of this control relationship in the overall event flow is calculated and dynamically corrected. This enables the effective identification of instructions or logical conflict behaviors initiated by unauthorized terminals (such as abnormal instructions between non-design-related terminals), significantly enhancing the detection accuracy of covert logic attacks, avoiding misjudging reasonable frequency fluctuations under normal operating conditions as anomalies, and thus improving the context adaptability and reliability of vulnerability identification.

[0049] Thus, the anomalous probability of the target event is obtained through the above method.

[0050] The control anomaly module 104 is used to calculate the continuous control anomaly parameters of the target event based on the control relationship between different events on the initiating terminal and the receiving terminal, the order in which the events occur, and the anomaly probability of the events.

[0051] It should be noted that, to ensure safe vehicle control, vehicle control logic is generally diverse and rigorous, involving multiple or continuous control logics. This means that the completion of one event is often accompanied by the occurrence of another, or the occurrence of one event requires the completion of another. In contrast, typical malicious attacks are often simply continuous attacks without exhibiting continuous control behavior. Furthermore, actual vehicle control test data often covers almost all control processes, resulting in a large number of continuous control events. Therefore, it is necessary to compare the current event's continuous control process with existing continuous control patterns to reflect any abnormalities in the current event's continuous control.

[0052] Specifically, in step S401, based on the control relationship of different events on the initiating terminal and the receiving terminal, as well as the order in which the events occur, the prerequisite events and co-control prerequisite events of the event are obtained. Based on the first frequency of the prerequisite events and co-control prerequisite events of the target event, the degree of continuous control logic anomaly of the target event is calculated.

[0053] First, events that are identical to the target initiating terminal and the target receiving terminal corresponding to the target event are taken as the same control relationship events of the target event. Then, the time corresponding to the time closest to the occurrence time of the target event is taken as the premise event of the target event, thus obtaining the premise event of each event.

[0054] Then, obtain the initiating terminal and receiving terminal corresponding to the prerequisite events of the target event, and denot them as the prerequisite initiating terminal and prerequisite receiving terminal of the target event, respectively; among the prerequisite events of all co-control relationship events of the target event, obtain the prerequisite events whose corresponding initiating terminal and receiving terminal are both the prerequisite initiating terminal and prerequisite receiving terminal of the target event, and denot them as the co-control prerequisite events of the target event.

[0055] It should be noted that, in all test data, the prerequisite events of events with the same control relationship can reflect the control logic of continuous control. Specifically, the more stable the prerequisite events of events with the same control relationship are, the more obvious the characteristics of continuous control logic are. Among them, the higher the frequency of events with the same control relationship (same initiating terminal, same receiving terminal) in the prerequisite events of events with the same control relationship, the more stable the prerequisite events of events with the same control relationship are.

[0056] Finally, among all the pre-events of the target event with the same control relationship, the first frequency of the corresponding events under the same initiating terminal and receiving terminal is counted and recorded as the pre-control frequency of the target event. Based on the pre-control frequency of the target event and the first frequency of the pre-event of the target event, the degree of continuous control logic abnormality of the target event is calculated.

[0057] As an optional embodiment, the specific method for calculating the degree of abnormality in the continuous control logic of the target event is as follows: in, Indicates the degree of abnormality in the continuous control logic of the target event; This represents the maximum value of the co-control premise frequency of the target event; The first frequency of the prerequisite event for the target event.

[0058] It should be noted that, This reflects the stability of the prerequisite events of the target event and the events with the same control relationship. The larger the value, the more stable the prerequisite events of the events with the same control relationship, that is, the more obvious the continuous control logic of the control relationship. When the control relationship of the prerequisite events of the target event is that the initiating terminal is the terminal... The receiving terminal is a terminal At that time, in the prerequisite events of the target event and the control relationship event, the initiating terminal is the terminal. The receiving terminal is a terminal The event frequency is the co-control premise frequency. The closer the first frequency of the premise event of the target event is to the maximum value of the co-control premise frequency of the target event, the more the premise event of the current event satisfies the continuous control logic. Conversely, the greater the difference between the first frequency of the premise event of the target event and the maximum value of the co-control premise frequency of the target event, the less the continuous control logic between the target event and its corresponding premise event satisfies the continuous control logic under the same control relationship, and the more abnormal the continuous control logic of the target event. Furthermore, for control relationships with more obvious control logic, the difference between the first frequency of the premise event of the target event and the maximum value of the co-control premise frequency of the target event more clearly demonstrates the abnormality of the target event in its continuous control logic.

[0059] Step S402: Based on the time interval between the target event, the co-control relationship event and the corresponding prerequisite event, and combined with the abnormal probability of the co-control prerequisite event corresponding to the co-control relationship event of the target event, calculate the time correlation deviation between the target event and the co-control prerequisite event; combine the continuous control logic abnormality degree of the target event with the time correlation deviation to obtain the continuous control abnormality parameter of the target event.

[0060] It should be noted that continuous control of a vehicle generally has a temporal correlation, that is, the time interval between the occurrence of an event and its prerequisite event has a certain stable relationship. At this time, the deviation of the continuous control time of the current event from the time interval between the current event and the prerequisite event can be used to reflect the continuous control time deviation of the current event, thereby reflecting the continuous control anomaly of the current event; the time corresponding to one of the events is the time when the receiving terminal receives the signal.

[0061] It should be noted that the time interval between the current event and its prerequisite events is known to be... Among all events with the same control relationship, the terminal that initiated the prerequisite event is selected as the terminal. The receiving terminal is a terminal The events, and the time interval between the selected events and their prerequisite events is... ,in This indicates the temporal relationship between the selected event and its prerequisite event, where the time interval is... With time interval The deviation reflects the degree to which the current event satisfies the temporal correlation between it and its prerequisite events.

[0062] First, the time interval between the occurrence times of the target event and its prerequisite events is obtained, and denoted as the prerequisite interval of the target event. Then, the time interval between the occurrence times of any co-control relationship event of the target event and its corresponding co-control prerequisite event is obtained, and denoted as the prerequisite interval of the co-control relationship event of the target event. Based on the difference between the prerequisite interval of the target event and the prerequisite interval between any co-control relationship events, the interval deviation between the target event and the co-control relationship events is obtained.

[0063] Then, using the method for obtaining the abnormal probability of an event, the abnormal probability of the co-control premise event corresponding to any co-control relationship event of the target event is obtained. Combining the abnormal probability of any co-control premise event of the target event and the interval deviation, the time correlation deviation between the target event and the co-control premise event is obtained.

[0064] As an optional embodiment, the specific method for calculating the time correlation deviation between the target event and the co-control premise event is as follows: in, Indicates the target event and the first Time correlation deviation of events with the same control relationship; The first term of the target event The probability of an anomaly in the precondition event corresponding to a given control relationship event; Indicates the interval preceding the target event; The first term of the target event The prerequisite interval for events with the same control relationship; Represents the absolute value symbol.

[0065] It should be noted that, for the time correlation deviation between the target event and the co-control prerequisite event, the difference between the time interval between the target event and its prerequisite event and the time interval of similar control relationship events is quantified, and the abnormal probability of the prerequisite event is used as the weight for weighted calculation. This characterizes the stability of the time series in the continuous control process. The larger the deviation value, the more the event timing violates the timing constraints of the vehicle control logic. This enables the system to accurately capture abnormal performance of time correlation in malicious attacks (such as disordered time intervals of attack commands), strengthen the ability to identify attacks on continuous control logic, ensure that the system can effectively distinguish between normal operation and malicious behavior in the timing dimension, and improve the robustness of defense against complex timing attacks.

[0066] Finally, the cumulative value of the time correlation deviation between the target event and all events with the same control relationship is recorded as the continuous control time deviation of the target event. Combining the degree of continuous control logic anomaly of the target event and the continuous control time deviation, the continuous control anomaly parameter of the target event is obtained. Both the degree of continuous control logic anomaly and the continuous control time deviation are positively correlated with the continuous control anomaly parameter.

[0067] As an optional embodiment, the specific calculation method for the continuous control anomaly parameter of the target event is as follows: in, Represents continuous control anomaly parameters for the target event; Indicates the degree of abnormality in the continuous control logic of the target event; This indicates the continuous control time deviation of the target event.

[0068] It should be noted that the continuous control anomaly parameter integrates the degree of continuous control logic anomaly with the time correlation deviation. By fusing the two into a unified parameter, it comprehensively assesses the anomaly of events, characterizing the overall degree of anomaly of the corresponding event in the vehicle's multi-layer control process. It covers both logical relationships and time series dimensions, enabling comprehensive detection of continuous control attacks, effectively identifying complex anomalies that violate design logic (such as the coexistence of logical conflicts and timing disorders), significantly reducing the false negative rate, providing an objective basis for vulnerability risk classification, and thus improving the system's security protection effectiveness and response accuracy under complex operating conditions.

[0069] Thus, the continuous control anomaly parameters for any event are obtained through the above method.

[0070] Vulnerability management module 105 is used to assess and remediate vulnerability risks by utilizing the abnormal probability of events and continuously controlling abnormal parameters.

[0071] Specifically, first, the product of the abnormal probability of the target event and the continuously controlled abnormal parameters is obtained as the final abnormal factor of the target event; the final abnormal factors of all events are linearly normalized to obtain the final abnormal coefficient of any event; an abnormal threshold is preset, and events with a final abnormal coefficient greater than or equal to the abnormal threshold are regarded as abnormal events.

[0072] It should be noted that the preset abnormal threshold is 0.7 based on experience, and can be adjusted according to the actual situation. This embodiment of the invention does not impose specific limitations. Based on the above steps, abnormal identification of control events in the CAN bus is realized.

[0073] Then, using the final anomaly coefficient of the abnormal event, the risk level of the abnormal event is set, and corresponding risk management is carried out for abnormal events of different risk levels, and the vulnerabilities involved in the abnormal event are repaired.

[0074] As an optional embodiment, the method of using the final anomaly coefficient of the anomaly event to set the risk level of the anomaly event and performing corresponding risk management for anomalies of different risk levels includes: […]. The system is divided into four equal-sized range intervals. These intervals are then arranged in descending order of their values ​​to form a range interval sequence. Each range interval in this sequence is assigned a risk level: P1, P2, P3, and P4. When an abnormal event occurs, for P1, the vehicle firewall (such as a CAN gateway) temporarily blocks the abnormal ID or data. For P2, the maximum number of frames for a given ID per unit time is limited. For P3 and P4, unnecessary functions are suspended to cut off attack paths.

[0075] It should be noted that, regarding the risk levels, P1 indicates emergency, which can be remotely exploited by hackers (such as braking command vulnerabilities) and directly affects driving safety; P2 indicates high risk, which requires physical contact to affect the corresponding safety functions (such as tampering with mileage after OBD-II access); P3 indicates medium risk, which, if exploited, will only affect non-safety functions (such as the IVI system sending garbage frames to the CAN bus); and P4 indicates low risk, which is extremely difficult for hackers to exploit and poses no actual harm (such as a low-priority ID verification defect).

[0076] As an optional embodiment, the method for patching the vulnerabilities involved in the abnormal event includes: for protocol layer vulnerabilities, adding MA (Message Authentication Code) to control-type CAN (Controller Area Network) frames, and verifying the MAC before the ECU (Electronic Control Unit) receives the frame; upgrading to CANFD (CAN Flexible Data-rate) or in-vehicle Ethernet: using the extended data field of CAN FD to transmit authentication information, or implementing end-to-end encryption through Ethernet TLS 1.3; for software logic vulnerabilities, fixing defects in the ECU firmware and verifying the effectiveness of the fix through static code analysis (Coverity); for vehicles already sold, upgrading the target ECU firmware through differential OTA; for hardware design defects, replacing the defective CAN transceiver for vehicles not yet manufactured; for vehicles already sold, disabling the vulnerable interface through firmware patching; and migrating the key and authentication algorithm to an independent security chip to avoid key leakage due to vulnerabilities in the main chip.

[0077] This concludes the embodiment.

[0078] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.

Claims

1.A security vulnerability management system of an intelligent connected vehicle terminal, characterized in that, The system comprises the following modules: A data collection module for collecting event control data, wherein the event control data comprises a plurality of events, each event corresponding to a sending timestamp and a receiving timestamp, and an initiating terminal and a receiving terminal; A preliminary probability module for calculating a preliminary abnormal probability of an event based on the frequency of occurrence of the event; An abnormal probability module for taking any event as a target event, obtaining events corresponding to the same initiating terminal as the target event, and adjusting the preliminary abnormal probability of the target event based on the frequency of occurrence of the events to obtain the abnormal probability of the target event; A control abnormality module for calculating a continuous control abnormality parameter of a target event based on the control relationship of different events on the initiating terminal and the receiving terminal, the sequence before and after the occurrence of the events, and the abnormal probability of the events; A vulnerability management module for performing vulnerability risk assessment and repair based on the abnormal probability of the events and the continuous control abnormality parameter. 2.The intelligent connected vehicle terminal security vulnerability management system according to claim 1, characterized in that, The method for calculating the preliminary abnormal probability of an event based on the frequency of occurrence of the event comprises the following steps: Obtaining the frequency of any event, denoted as the first frequency of the event; The sending time stamp of any event is taken as the occurrence time of the corresponding event, and a preset time length parameter and a time window with a length of is constructed, the occurrence time of the event is taken as the center point of the time window, the frequency of the event within the time window is obtained, denoted as the local frequency of the event, and the ratio of the local frequency of the event to the time length parameter corresponding to the time window is taken as the local occurrence frequency of the event. Obtaining the preliminary abnormal probability of the event based on the difference between the local frequency of occurrence of any event and the first frequency of the event. 3.The intelligent connected vehicle terminal security vulnerability management system of claim 1, wherein, The method for obtaining events corresponding to the same initiating terminal as the target event comprises the following steps: Obtaining the receiving terminal and the initiating terminal corresponding to the target event, denoted as the target receiving terminal and the target initiating terminal of the target event, respectively, and taking the target receiving terminal as all events of the receiving terminal, denoted as the first event of the target receiving terminal. 4.The intelligent connected vehicle terminal security vulnerability management system of claim 3, wherein, The specific calculation method for the abnormal probability of the target event comprises the following steps: Obtaining the first frequency of all first events, and taking the cumulative value of the first frequency of all first events as the second frequency of the target event; Obtaining the relative frequency of the target event based on the difference between the first frequency and the second frequency of the target event, adjusting the relative frequency of the target event based on the preliminary abnormal frequency of the target event to obtain the abnormal probability of the target event, wherein the first frequency and the preliminary abnormal probability of the target event are positively correlated with the abnormal probability of the target event, and the second frequency of the target event is negatively correlated with the abnormal probability of the target event. 5.The intelligent connected vehicle terminal security vulnerability management system of claim 2, wherein, The method for calculating the continuous control abnormality parameter of a target event based on the control relationship of different events on the initiating terminal and the receiving terminal, the sequence before and after the occurrence of the events, and the abnormal probability of the events comprises the following steps: Obtaining the prerequisite event and the same-control prerequisite event of an event based on the control relationship of different events on the initiating terminal and the receiving terminal, and the sequence before and after the occurrence of the events, calculating the continuous control logic abnormality degree of the target event based on the first frequency of the prerequisite event and the same-control prerequisite event of the target event; Calculating the time correlation deviation between the target event and the same-control prerequisite event based on the interval between the target event and the same-control relationship event and the corresponding prerequisite event in the occurrence time, and combining the abnormal probability of the same-control prerequisite event corresponding to the same-control relationship event of the target event; and combining the continuous control logic abnormality degree and the time correlation deviation of the target event to obtain the continuous control abnormality parameter of the target event. 6.The intelligent networked vehicle terminal security vulnerability management system of claim 5, wherein, The method for obtaining the prerequisite events and co-control prerequisite events based on the control relationship between different events on the initiating terminal and the receiving terminal, as well as the order in which the events occur, includes the following specific methods: Events that are identical to the target initiating terminal and the target receiving terminal corresponding to the target event are taken as the same control relationship events of the target event. The time corresponding to the time that is closest in time to the occurrence time of the target event is taken as the premise event of the target event, thus obtaining the premise event of each event. The initiating terminal and receiving terminal corresponding to the prerequisite events of the target event are obtained and denoted as the prerequisite initiating terminal and prerequisite receiving terminal of the target event, respectively. Among all the prerequisite events of the target event and the events with the same control relationship, the prerequisite events in which the corresponding initiating terminal and the receiving terminal are both prerequisite initiating terminal and prerequisite receiving terminal of the target event are denoted as the prerequisite events of the target event. 7.The intelligent networked vehicle terminal security vulnerability management system of claim 5, wherein, The method for calculating the degree of continuous control logic anomaly of the target event based on the first frequency of the prerequisite events and co-control prerequisite events is as follows: In the prerequisite events of all events with the same control relationship to the target event, the first frequency of the corresponding events under the same initiating terminal and receiving terminal is counted and recorded as the common control prerequisite frequency of the target event. Based on the common control prerequisite frequency of the target event and the first frequency of the prerequisite events of the target event, the degree of continuous control logic anomaly of the target event is calculated. 8.The intelligent networked vehicle terminal security vulnerability management system of claim 5, wherein, The method for calculating the time correlation deviation between the target event and the co-control relationship event based on the time interval between the occurrence of the target event, the co-control relationship event, and the corresponding prerequisite event, and in combination with the anomaly probability of the co-control relationship event corresponding to the co-control prerequisite event of the target event, includes the following specific methods: The time interval between the occurrence times of the target event and its prerequisite events is obtained and denoted as the prerequisite interval of the target event. The time interval between the occurrence times of any co-control relationship event of the target event and its corresponding co-control prerequisite events is obtained and denoted as the prerequisite interval of the co-control relationship event of the target event. Based on the difference between the prerequisite interval of the target event and the prerequisite interval between any co-control relationship events, the interval deviation between the target event and the co-control relationship events is obtained. By using the method for obtaining the abnormal probability of an event, the abnormal probability of the pre-control event corresponding to any pre-control event of the target event is obtained. By combining the abnormal probability of any pre-control event of the target event and the interval deviation, the time correlation deviation between the target event and the pre-control event is obtained. 9.The intelligent network connected vehicle terminal security vulnerability management system of claim 5, wherein, The specific method for combining the degree of continuous control logic anomaly of the target event with the time correlation deviation to obtain the continuous control anomaly parameters of the target event includes: The cumulative value of the time correlation deviation between the target event and all events with the same control relationship is recorded as the continuous control time deviation of the target event. Combining the degree of continuous control logic anomaly of the target event and the continuous control time deviation, the continuous control anomaly parameter of the target event is obtained. Both the degree of continuous control logic anomaly and the continuous control time deviation are positively correlated with the continuous control anomaly parameter. 10.The intelligent connected vehicle terminal security vulnerability management system of claim 1, wherein, The specific methods for vulnerability risk assessment and remediation using the anomaly probability of events and continuously controlled anomaly parameters include: The product of the anomaly probability of the target event and the continuous control anomaly parameter is obtained as the final anomaly factor of the target event; the final anomaly factors of all events are linearly normalized to obtain the final anomaly coefficient of any event. A preset anomaly threshold is set, and events whose final anomaly coefficient is greater than or equal to the anomaly threshold are considered as anomalies. By using the final anomaly coefficient of the abnormal event, the risk level of the abnormal event is set, and corresponding risk management is carried out for abnormal events of different risk levels, and the vulnerabilities involved in the abnormal event are repaired.

Images