A vehicle-mounted system safety detection and risk assessment system

Abstract

The application discloses a kind of vehicle-mounted system safety detection and risk assessment system, belong to vehicle-mounted network security technical field, comprising: vehicle-mounted terminal environment perception module, for collecting the multilevel environment information of vehicle-mounted system, including system layer information, network layer information and security layer information;Vehicle-mounted configuration file and communication white list detection module is connected to vehicle-mounted terminal environment perception module, for establishing and maintaining security white list library according to the system information collected, and by periodic scanning, the current configuration file of system, dynamic library, port and certificate state are compared with security white list library, to detect configuration exception and file tampering event;Vehicle-mounted process and control task analysis module;Communication anomaly detection and coding identification module;Security assessment and risk feedback module.The application can realize all-around monitoring and intelligent analysis to vehicle-mounted system configuration, process behavior and network communication, effectively identify hidden backdoor, abnormal process and malicious communication.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security technology, specifically a vehicle system security detection and risk assessment system. Background Technology

[0002] With the rapid development of intelligent connected vehicles, vehicles have evolved into complex "mobile computing terminals" integrating multiple computing units, infotainment systems, V2X communication modules, and cloud service interfaces. The vehicle-to-everything (V2X) environment has led to an increasingly dispersed attack surface and exacerbated device heterogeneity. To facilitate functional expansion, in-vehicle systems widely adopt dynamic loading mechanisms, but this also provides attackers with opportunities to create backdoors. Furthermore, with the surge in the number of in-vehicle software programs, users may inadvertently install tampered or rootkit-infected pseudo-trusted software, resulting in backdoors that are highly concealed and have long incubation periods, making traditional signature-based or fixed-rule detection methods ineffective.

[0003] Existing vehicle security solutions often focus on single-layer protection, such as network firewalls, intrusion detection systems (IDS), or simple file integrity checks, lacking the comprehensive capability to perform collaborative analysis and multimodal reasoning of system configuration, process behavior, and network traffic. Therefore, there is an urgent need for a vehicle system security detection solution that can deeply integrate static system configuration, dynamic operating status, and network communication content, and perform anomaly reasoning through intelligent models.

[0004] To address these issues, those skilled in the art have provided a vehicle system safety detection and risk assessment system. Summary of the Invention

[0005] The purpose of this invention is to provide a vehicle system security detection and risk assessment system that can achieve comprehensive monitoring and intelligent analysis of vehicle system configuration, process behavior and network communication, effectively identify hidden backdoors, abnormal processes and malicious communication, so as to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A vehicle-mounted system safety testing and risk assessment system, comprising:

[0008] The vehicle terminal environment perception module is used to collect multi-level environmental information of the vehicle system, including system layer information, network layer information and security layer information;

[0009] The vehicle configuration file and communication whitelist detection module is connected to the vehicle terminal environment perception module. It is used to establish and maintain a security whitelist library based on the collected system information, and compare the current system configuration file, dynamic library, port and certificate status with the security whitelist library through periodic scanning to detect configuration abnormalities and file tampering events.

[0010] The vehicle process and control task analysis module is connected to the vehicle terminal environment perception module. It is used to monitor the system process in real time, build a process behavior profile based on the collected process information, and detect hidden processes, unauthorized processes and abnormal behavior events by comparing the deviation between the current process behavior characteristics and the normal behavior profile built based on historical data.

[0011] The communication anomaly detection and encoding recognition module is connected to the vehicle terminal environment perception module. It is used to capture and analyze network traffic. By performing encoding recognition, entropy analysis and semantic analysis on the payload content, it can detect high-entropy traffic, forged commands and abnormal communication.

[0012] The safety assessment and risk feedback module is connected to the vehicle configuration file and communication whitelist detection module, the vehicle process and control task analysis module, and the communication anomaly detection and code recognition module, respectively. It is used to perform data fusion and weight evaluation on the abnormal events output by the above modules, calculate the comprehensive risk score, and execute the corresponding risk response strategy according to the score level.

[0013] As a further aspect of the present invention: the multi-level acquisition structure of the vehicle-mounted terminal environment perception module includes:

[0014] The system-level acquisition unit is used to identify the operating system type, kernel version, process snapshots, and file system metadata by reading system files or command output;

[0015] The network layer acquisition unit is used to collect information on the physical and virtual network interfaces of the vehicle-mounted equipment, IP / MAC addresses, port listening status, and interface security configurations.

[0016] The security layer acquisition unit is used to collect system certificate and signature information, security policy status, user permissions, and audit logs.

[0017] As a further aspect of the present invention: the periodic scan performed by the vehicle configuration file and communication whitelist detection module has a detection cycle of 10 minutes, and the detection objects include the file hash value under the key directory, the dynamic library path loaded by the process, the system listening port, and the validity and signature of the digital certificate.

[0018] As a further aspect of the present invention: the process of establishing a process behavior profile by the vehicle process and control task analysis module includes: collecting the process's PID, process name, running path, resource utilization, user permissions, parent-child relationship and communication direction information, and encapsulating the multi-dimensional features into a behavior vector; the abnormal behavior events include the process execution path being deleted but still running, non-system users starting system tasks, and processes frequently accessing unknown IPs or high-risk ports and marking them as potential command execution events.

[0019] As a further aspect of the present invention: the content parsing and encoding recognition process of the communication anomaly detection and encoding recognition module supports recursive decoding of at least one encoding or compression format among Base64, Hex, URL encoding, Gzip, and Zlib; and when a preset illegal character combination appears in the decoded content, it is marked as suspicious communication.

[0020] As a further aspect of the present invention: the entropy analysis process of the communication anomaly detection and encoding identification module includes: calculating the Shannon entropy of the decoded data block, and calculating the anomaly score according to the entropy range, the proportion of printable characters, and the character set compatibility characteristics through a preset weight formula; wherein, data blocks with an entropy value greater than 4.5 are determined to be high-entropy data.

[0021] As a further aspect of the present invention: the semantic analysis process of the communication anomaly detection and encoding recognition module is implemented through a multimodal reasoning model, which includes:

[0022] The encoding module is used to perform text encoding on traffic content text and a predefined set of semantic tags, including normal plaintext communication, encoded / compressed data, encrypted traffic and abnormal instructions, and to perform graph encoding on a knowledge subgraph containing at least one communication rule among port, direction and security level.

[0023] The multimodal feature module is used to extract and update knowledge subgraph features by interacting with text representations and graph node representations through an attention mechanism.

[0024] The reconstruction module is used to dynamically mask the knowledge subgraph based on a random walk strategy and predict the relationship of the masked edges to explain the rationality of the communication structure.

[0025] The prediction module is used to fuse the question representation and the knowledge subgraph representation, and calculates the confidence probability of each semantic label through a classifier to complete the semantic classification.

[0026] As a further aspect of the present invention: in the weight evaluation of the security assessment and risk feedback module, the formula for calculating the comprehensive risk score is: Score = 0.3 × communication anomaly score + 0.25 × configuration anomaly score + 0.25 × process anomaly score + 0.1 × system risk score + 0.1 × AI confidence score, and the result is normalized to the range of 0 to 1.

[0027] As a further aspect of the present invention: the tiered response strategy executed by the security assessment and risk feedback module based on the comprehensive risk score includes:

[0028] When the score is in the high-risk range of 0.7 to 1.0, immediately disconnect the external communication interface and freeze the suspicious process;

[0029] When the score is in the medium risk range of 0.4 to 0.7, record the event log and upload it to the cloud security center;

[0030] When the score is in the low-risk range of 0.0 to 0.4, it is recorded locally and used as a learning sample for optimizing the risk model.

[0031] As a further aspect of the present invention: the detection report and all response operations output by the security assessment and risk feedback module are recorded in an audit log, and the audit log includes a timestamp and signature hash.

[0032] Compared with the prior art, the beneficial effects of the present invention are:

[0033] 1. Multi-dimensional collaborative detection: Through the collaborative work of four modules—environmental perception, configuration verification, process analysis, and traffic parsing—it covers the complete security chain of the vehicle system, from static assets to dynamic behavior.

[0034] 2. Intelligent Semantic Understanding: By introducing an inference model based on multimodal representation enhancement, it can understand the deep semantics of network traffic content, effectively distinguish between normal communication, encoded data and malicious instructions, and improve the accuracy and interpretability of detection.

[0035] 3. Dynamic risk assessment and response: A weighted fusion mechanism is used to comprehensively score multi-source abnormal events and implement differentiated automatic response strategies based on risk levels, realizing closed-loop safety protection from detection to disposal.

[0036] 4. Adaptive and scalable: The whitelist library can be updated, the detection model can be optimized by learning from new samples, and the encoding recognition supports custom extensions, enabling the system to adapt to the ever-evolving in-vehicle environment and threats. Attached Figure Description

[0037] Figure 1 This is a structural framework diagram of a vehicle-mounted system safety detection and risk assessment system.

[0038] Figure 2 This is a schematic diagram of the architecture of a multimodal reasoning model used in a communication anomaly detection and encoding recognition module of a vehicle system safety detection and risk assessment system. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] As mentioned in the background section of this application, research has found that existing vehicle security solutions mostly focus on single-layer protection, such as network firewalls, intrusion detection systems (IDS), or simple file integrity checks. They lack the comprehensive ability to perform collaborative analysis and multimodal reasoning on system configuration, process behavior, and network traffic, and thus have certain shortcomings.

[0041] To address the aforementioned deficiencies, this application discloses a vehicle system security detection and risk assessment system, which can achieve comprehensive monitoring and intelligent analysis of vehicle system configuration, process behavior, and network communication, and effectively identify hidden backdoors, abnormal processes, and malicious communications.

[0042] The following will describe in detail, with reference to the accompanying drawings, how the solution of this application solves the above-mentioned technical problems.

[0043] Please see Figure 1In this embodiment of the invention, a vehicle-mounted system security detection and risk assessment system includes: a vehicle-mounted terminal environment perception module, used to collect multi-level environmental information of the vehicle-mounted system, including system-level information, network-level information, and security-level information; a vehicle-mounted configuration file and communication whitelist detection module, connected to the vehicle-mounted terminal environment perception module, used to establish and maintain a security whitelist database based on the collected system information, and to periodically scan and compare the current configuration file, dynamic library, port, and certificate status of the system with the security whitelist database to detect configuration anomalies and file tampering events; and a vehicle-mounted process and control task analysis module, connected to the vehicle-mounted terminal environment perception module, used to monitor system processes in real time, establish process behavior profiles based on the collected process information, and... By comparing the deviation between the current process behavior characteristics and the normal behavior profile built based on historical data, hidden processes, unauthorized processes, and abnormal behavior events are detected. A communication anomaly detection and encoding recognition module, connected to the vehicle terminal environment perception module, captures and analyzes network traffic. Through encoding recognition, entropy analysis, and semantic analysis of the payload content, it detects high-entropy traffic, forged commands, and abnormal communication. A security assessment and risk feedback module, connected to the vehicle configuration file and communication whitelist detection module, the vehicle process and control task analysis module, and the communication anomaly detection and encoding recognition module, respectively, performs data fusion and weight evaluation on the abnormal events output by the above modules, calculates a comprehensive risk score, and executes corresponding risk response strategies based on the score level. This application constructs a collaborative working framework composed of five core modules: environment perception, configuration detection, process analysis, communication detection, and comprehensive assessment. This framework, through data connections and functional division between modules, realizes a complete closed-loop process from underlying information collection and multi-dimensional security event detection to unified risk assessment and response, forming the basic logical structure for the system to perform security detection.

[0044] In this embodiment, the multi-level acquisition structure of the vehicle terminal environment perception module includes: a system-level acquisition unit, used to identify the operating system type, kernel version, process snapshot, and file system metadata by reading system files or command output; a network-level acquisition unit, used to collect physical and virtual network interface information, IP / MAC addresses, port listening status, and interface security configuration of the vehicle device; and a security-level acquisition unit, used to collect system certificate and signature information, security policy status, user permissions, and audit logs. This setup structurally decomposes the environmental information acquisition task into three levels: system, network, and security. Through the collaboration of the three dedicated acquisition units, it achieves a systematic collection of comprehensive and standardized basic information on the vehicle system hardware, software, network configuration, and security policies, providing unified and multi-dimensional data input for upstream detection modules.

[0045] In this embodiment, the periodic scan performed by the vehicle configuration file and communication whitelist detection module has a detection cycle of 10 minutes. The detection targets include file hash values ​​in key directories, dynamic library paths loaded by processes, system listening ports, and the validity and signature of digital certificates. By setting a fixed detection cycle (e.g., 10 minutes) and clearly defining the key targets of the scan (e.g., file hashes, dynamic libraries, ports, certificates), the configuration detection behavior is transformed from random sampling to timed and fixed-point systematic monitoring, thereby establishing a predictable balance between resource consumption and real-time security monitoring.

[0046] In this embodiment, the process of establishing a process behavior profile by the vehicle-mounted process and control task analysis module includes: collecting the process's PID, process name, running path, resource utilization, user permissions, parent-child relationship, and communication direction information, and encapsulating the multi-dimensional features into a behavior vector; abnormal behavior events include processes running even after their execution path has been deleted, non-system users starting system tasks, and processes frequently accessing unknown IPs or high-risk ports and being marked as potential command execution events. This setting integrates discrete process monitoring data (such as PID, resource utilization, etc.) into a structured "behavior vector," and based on this, defines judgment rules for specific abnormal behaviors such as "hidden processes," "unauthorized processes," and "potential command execution," thereby transforming abstract "behavior analysis" into operable and concrete detection logic.

[0047] In this embodiment, the content parsing and encoding recognition process of the communication anomaly detection and encoding recognition module supports recursive decoding of at least one encoding or compression format among Base64, Hex, URL encoding, Gzip, and Zlib; and when a preset illegal character combination appears in the decoded content, it is marked as suspicious communication. This setting provides a deep parsing capability for network traffic payloads. By supporting recursive decoding of multiple common encoding formats (such as Base64 and Gzip), it can strip away encoding layers that attackers may use for obfuscation; at the same time, by using preset illegal character combinations as trigger markers, it provides a rule-based judgment basis for quickly identifying plaintext or shallowly encoded traffic containing suspicious instructions.

[0048] In this embodiment, the entropy analysis process of the communication anomaly detection and encoding identification module includes: calculating the Shannon entropy of the decoded data block, and calculating anomaly scores based on the entropy range, the proportion of printable characters, and character set compatibility characteristics using a preset weighting formula; data blocks with an entropy value greater than 4.5 are identified as high-entropy data. This setting introduces the quantitative indicator of information entropy, combined with other statistical characteristics (such as the proportion of printable characters), to perform "anomaly scoring" on the decoded data blocks using a preset weighting formula. This function transforms the subjective judgment of traffic randomness into objective numerical calculation, and in particular, by setting an entropy value greater than 4.5 as a high-entropy data threshold, it provides a quantifiable standard for filtering suspected encrypted or highly obfuscated malicious traffic.

[0049] In this embodiment, the semantic analysis process of the communication anomaly detection and encoding recognition module is implemented through a multimodal reasoning model. This model includes: an encoding module, used to encode the traffic content text and a predefined set of semantic tags, including normal plaintext communication, encoded / compressed data, encrypted traffic, and abnormal commands, and to perform graph encoding on a knowledge subgraph containing at least one communication rule among port, direction, and security level; a multimodal feature module, used to extract and update knowledge subgraph features by interacting with text representations and graph node representations through an attention mechanism; a reconstruction module, used to dynamically mask the knowledge subgraph based on a random walk strategy and predict the relationships between masked edges to explain the rationality of the communication structure; and a prediction module, used to fuse the question representation and the knowledge subgraph representation, and calculate the confidence probability of each semantic tag through a classifier to complete semantic classification. This setup constructs an intelligent analysis engine capable of simultaneously processing text semantics (traffic content) and structured knowledge (communication rule graph). Through the collaboration of the four sub-modules—encoding, feature interaction, graph reconstruction, and prediction—this model achieves fusion reasoning and automated classification of high-level semantics of network traffic (such as distinguishing between normal and attack commands).

[0050] In this embodiment, the comprehensive risk score is calculated using the following formula in the weighted evaluation of the security assessment and risk feedback module: Score = 0.3 × Communication Anomaly Score + 0.25 × Configuration Anomaly Score + 0.25 × Process Anomaly Score + 0.1 × System Risk Score + 0.1 × AI Confidence Score, and the result is normalized to the range of 0 to 1. This setting establishes a set of deterministic quantitative evaluation rules, which assign specific weights to anomaly signals from different detection modules (communication, configuration, processes, etc.), which vary in nature and scale, and perform linear weighted fusion to uniformly normalize them into a scalar risk value between 0 and 1, providing a clear and consistent numerical basis for subsequent graded response decisions.

[0051] In this embodiment, the security assessment and risk feedback module implements a tiered response strategy based on the comprehensive risk score, including: when the score is in the high-risk range of 0.7 to 1.0, immediately cutting off external communication interfaces and freezing suspicious processes; when the score is in the medium-risk range of 0.4 to 0.7, recording event logs and uploading them to the cloud security center; and when the score is in the low-risk range of 0.0 to 0.4, recording locally and using it as a learning sample for optimizing the risk model. This setting defines a hierarchical automated response strategy that maps continuous risk score values ​​to discrete (high, medium, and low) risk levels, and associates each level with preset response actions of increasing intensity (such as recording, reporting, and blocking). This function achieves automated connection from risk "detection" to "handling," ensuring that the system can take appropriate countermeasures based on the severity of the threat.

[0052] In this embodiment, the detection reports and all response operations output by the security assessment and risk feedback module are recorded in audit logs, which include timestamps and signature hashes. This setting provides a complete chain of evidence with timestamps and tamper-proof signatures (hashes) for all detection results and response operations of the system. This function not only meets the needs of security auditing and event backtracking, but more importantly, it ensures the authenticity and integrity of the logs themselves through technical means, providing reliable basic data for liability determination and system behavior verification.

[0053] To further illustrate the present invention, the following describes in detail, with reference to embodiments, a vehicle-mounted system safety detection and risk assessment system provided by the present invention.

[0054] Example 1: Vehicle-mounted terminal environmental perception module;

[0055] The vehicle-mounted terminal environment perception module primarily collects information about the vehicle environment, serving as the source of fundamental information for this application. Its core task is to identify the operating environment of the vehicle-mounted unit, creating an "environmental profile" of the current system, thus providing foundational support for subsequent configuration verification lists, process analysis, and communication traffic detection.

[0056] The main information collected includes the following:

[0057] 1. Operating system type / version, kernel information, list of installed / running software, process snapshots, file system metadata (paths and hashes of important configuration files), firmware version, mounted partitions, etc.

[0058] 2. Physical and virtual interfaces (CAN / ETH / WWAN / Wi-Fi), IP / MAC, port listening, connection table, routing table, V2X interface status, interface bandwidth / packet loss / latency statistics, and interface security configuration (TLS / DTLS status).

[0059] 3. Certificate and signature information, TPM / HSM status, key container, SELinux / AppArmor policy, users / permissions, change audit log (auditd), security configuration (ssh / sshd, sudoers, etc.).

[0060] The module adopts a multi-level acquisition structure: system layer acquisition, network layer acquisition, and security layer acquisition.

[0061] System-level data collection: Due to the differences in basic information across systems, this application requires customized system information collection to differentiate related code and processes. For example, reading system file and command output can identify the vehicle system type, version number, and kernel information using / proc / version, / etc / os-release, and uname -a. If the operating system is detected as Linux, the distribution version is further identified. The file storage location is read, and its initial existence information is recorded.

[0062] Network layer data collection: Supports the communication anomaly detection module in traffic capture and parsing, and supports the process analysis module in determining external connection relationships. It collects all interface information of the vehicle-mounted equipment, including CAN bus, Ethernet, and other network interfaces, through psutil, ifconfig, or ipa, while recording the interface's MAC address, IP configuration, bandwidth usage, and whether security protocols are enabled. It also detects duplicate or abnormally open ports.

[0063] Security layer collection: Certificate and policy status are pushed to the whitelist detection module, and unauthorized access or policy change events are synchronized to the process analysis module. The main focus is on system security configuration and certificate status, including the validity period of digital certificates, issuing authority, and hash fingerprint verification. The system stores weak passwords, plaintext keys, and visible configuration items.

[0064] Example 2: Vehicle configuration file and communication whitelist detection module;

[0065] Since the vehicle-mounted terminal's environmental perception module has already obtained the system's basic information, this application will proceed as follows:

[0066] First, the system version, file list, and certificate status are loaded. This application establishes a whitelist database, which records the file path and its hash value, the legitimate module path and communication port, the unique source of the legitimate certificate, its validity period, and the organization's fingerprint, etc., as the initial trusted state.

[0067] Next, system changes are constantly monitored by periodically scanning system configurations and extracting information every 10 minutes. This involves traversing key directories such as ` / etc / v2x / ` and ` / usr / lib / vehicle / ` (where ` / etc / v2x / ` represents the "security configuration area," monitored to ensure the integrity of communication configurations and prevent communication link disruption; and ` / usr / lib / vehicle / ` represents the "core code area," monitored to ensure the purity of executable code and prevent malicious code from being loaded and executed), calculating the hash value of files, and comparing the result with the original value in the whitelist. If the hash value is inconsistent or an unknown file is added, it is marked as a "suspected tampered file." The loading status of system dynamic libraries (.so / .dll) is monitored, and the ` / proc / ` directory of processes is read. <pid>The ` / maps` file extracts the paths to loaded library files, monitoring the loading status of system dynamic libraries (.so / .dll). If a registered or externally loaded dynamic library is detected, a risk event is reported to prevent malicious module injection. Communication ports and protocols are checked using `netstat` or `ss` to obtain the system's listening ports and compare them with the whitelisted running ports. Any abnormal ports or abnormal external communication are reported. Certificate sources are updated periodically, and signature verification is performed. If a certificate expires or the signature does not match, the update operation is rejected. `netstat` and `ss` are two command-line tools used to view network connections, listening ports, and network statistics. They are commonly used in Linux / Unix-like operating systems (including Linux-based vehicle systems) for network diagnostics and system monitoring, helping system administrators or security systems understand the current network activity status of the system.

[0068] Finally, this application will send the configuration anomalies and file tampering events detected by this module to the security assessment and risk feedback module.

[0069] Example 3: Vehicle Process and Control Task Analysis Module;

[0070] This module analyzes the system's dynamic behavior to monitor the running tasks in the vehicle system and control unit in real time, identify risks such as suspicious background processes, forged remote commands, abnormal CPU usage, and hidden processes, and ensure that the system operates within a controllable and reliable range.

[0071] The module is based on a three-layer architecture: "behavior monitoring, behavior modeling, and anomaly analysis." First, the system's monitoring layer collects information on all processes in real time through an interface, including PID, process name, command line records, execution path, CPU / memory usage, user permission list, and parent process PID. It creates periodic snapshots of the collected data, supporting trend analysis. Next, based on historical samples, it forms a "normal process profile," encapsulating the multi-dimensional characteristics of each process into a behavior vector, such as <process path, user permissions, parent-child relationship, open ports, resource usage, communication direction>. If a process's behavior deviates from its normal characteristics, such as an abnormal startup path, changed command line parameters, or abnormal resource consumption, it is marked as an abnormal task. Finally, if it detects that a process's execution path has been deleted but it is still running ( / proc / ...), the module will detect abnormal processes. <pid>The process is identified as a "hidden process" if it is running ` / exe → (deleted)`; if a system task is started by a non-system user, it is considered an "unauthorized process"; if the process frequently accesses unknown IPs or high-risk ports, it is marked as a "potential command execution". The system will correlate these behavioral events with the traffic logs of the communication module to determine whether there are forged remote control commands.

[0072] Example 4: Communication Anomaly Detection and Encoding Recognition Module;

[0073] The module traffic is captured on the vehicle network interface using the pyshark library. The traffic packets need to undergo content parsing and encoding recognition, entropy analysis and feature scoring, and semantic analysis.

[0074] Content parsing and encoding recognition: Captured data packets are processed by a parsing layer to extract the payload field and then the content is encoded. The system has built-in multiple keyless common encoding recognition algorithms, such as Base64, Hex, URL encoding, Quoted-Printable, Gzip, Zlib, Base58, Base91, and Base45. Custom module encodings can also be added, and recursive decoding is supported. The system automatically identifies whether data contains multi-layered nested encoding or mixed encoding. If executable instructions or illegal character combinations (such as "CMD=", "SHELL=", "root>") are found after decoding, the communication is immediately marked as suspicious.

[0075] Entropy analysis and feature scoring calculate the Shannon Entropy for each decoded data block to determine its randomness and complexity. Entropy < 4: usually normal text; Entropy 4–4.5: suspected encoded or compressed data; Entropy > 4.5: high entropy data, possibly an encrypted stream or malicious payload. Other feature indicators are also calculated, such as the proportion of printable characters, the proportion of whitespace characters, character set compatibility, and content length. The module calculates an "anomaly score" using a preset weighted formula: Score = 0.3 × Entropy score + 0.3 × Printable proportion score + 0.2 × Character compatibility + 0.2 × Structural integrity. If the risk score exceeds a threshold (e.g., 0.75), it enters the AI ​​discrimination stage.

[0076] Semantic analysis involves using an AI semantic analysis model to determine whether non-high-entropy data content constitutes suspicious instructions or forged communication. The model is trained on a large amount of vehicle network traffic data to distinguish between normal plaintext communication, encoded / compressed data, encrypted traffic, and abnormal instructions. The abnormal traffic judgment results are transmitted in real-time to the security assessment and risk feedback module. The semantic analysis model is a multimodal augmented inference model, and this application proposes the following architecture: divided into an encoding module, a multimodal feature module, a reconstruction module, and a prediction module, such as... Figure 2 As shown.

[0077] (1) Encoding module:

[0078] 1.1 Text Encoding: The encoding module uses a pre-trained language model to encode the text of the question and candidate answers. Question and candidate answers Both are used as input, where question q is the content of the communication traffic, which is a decoded string or instruction sequence, and a is a set of semantic tags defined by the system, such as a1: normal plaintext communication, a2: encoded / compressed data, a3: encrypted traffic, and a4: abnormal instructions. The language structure used to understand traffic is used to obtain the problem representation after passing through a pre-trained language model encoder. The calculation method is as follows:

[0079] ;

[0080] in, It is the embedding representation of the "[CLS]" token in the pre-trained language model.

[0081] 1.2 Subgraph Encoding: The encoding module uses a graph neural network model to encode the knowledge subgraph. For entities in the knowledge subgraph... , Let V be the number of entities, and V be the communication rules, such as port, direction, and security level. After passing through a graph neural network encoder, their corresponding node vector representations are obtained, learning the semantic relationships between entities. The calculation method is as follows:

[0082] ;

[0083] (2) Multimodal Feature Module: This module extracts feature information from interactive questions and knowledge subgraphs. The input to the multimodal feature module is the question representation obtained by the encoding module. Node representation of knowledge subgraph The updated knowledge subgraph node representation is obtained after the information refinement layer. The calculation method is as follows:

[0084] Extract the relationship characteristics between nodes, such as the dependency and combination relationships between fields;

[0085] Extract the semantic features of the nodes themselves, such as field types;

[0086] Then, the attention mechanism is used to make the model focus on the relationship between the communication content and the knowledge subgraph. .

[0087] Average pooling is performed on all nodes to obtain a representation of the entire knowledge subgraph. The calculation method is as follows: .

[0088] (3) Refactoring module:

[0089] A dynamic masking strategy based on random walks is adopted, selecting edges with low relevance to the problem for masking. Furthermore, masking is performed in each round to ensure that the masked parts of the knowledge subgraph are different in each round, thereby enhancing the model's generalization ability.

[0090] Specifically, this application categorizes nodes in the knowledge subgraph into three types: entities mentioned in the problem. The entity mentioned in the answer and other entities that do not belong to these two types. For any starting node in the graph, a random walk is performed according to certain rules until a specified target node is reached or the maximum number of steps is reached. This paper randomly selects half of the nodes as starting nodes. After completing the random walk of the entire graph, for... The edges between entities are masked.

[0091] After masking, the relationships in the reconstructed knowledge subgraph need to be predicted. The prediction process aggregates the representations of the head and tail nodes of the edges to be predicted. The final prediction score is output through an activation function, calculated as follows:

[0092] ;

[0093] in, and These are the head and tail entities of the edge to be predicted, respectively. Used to provide a rational explanation for the communication structure.

[0094] (4) Prediction module:

[0095] The expression of the problem and the representation of knowledge subgraphs Then, by concatenating the data and using a multilayer perceptron network to fuse and extract feature information, scores for candidate answers are calculated. Finally, using... The function normalizes the scores of all candidate answers and predicts the most reasonable answer. The calculation process is shown below:

[0096] ;

[0097] ;

[0098] As the probability of each candidate type in the final output, such as pa1: normal plaintext communication, pa2: encoded / compressed stream, pa3: encrypted traffic, pa4: abnormal instruction, the one with the highest probability is selected as the judgment result.

[0099] Example 5: Security Assessment and Risk Feedback Module;

[0100] The security assessment and risk feedback modules serve as the system's decision-making and response centers. They are responsible for integrating the detection results from the preceding modules, quantitatively assessing the overall security status of the system, and implementing corresponding protection strategies. The modules employ a logical structure of "data fusion, weighted evaluation, and tiered response." Finally, they output a detection report in the appropriate format.

[0101] The data fusion process unifies and summarizes the detection results of several sub-modules. This application adopts a scoring mechanism for the abnormal output of the preceding modules, including: network interface status; file tampering, whitelist anomalies; hidden processes, abnormal CPU usage; high entropy traffic, forged instructions; abnormal command semantics or potential attack behavior.

[0102] Weighted evaluation: Score = 0.3 × Communication anomaly + 0.25 × Configuration anomaly + 0.25 × Process anomaly + 0.1 × System risk + 0.1 × AI confidence level.

[0103] The rating results are normalized to values ​​between 0 and 1:

[0104] 0.0~0.4: Low risk, normal condition;

[0105] 0.4~0.7: Medium risk, suspected abnormality;

[0106] 0.7~1.0: High risk, potential intrusion or malicious behavior.

[0107] If the risk score exceeds the threshold (e.g., 0.8), the system will immediately activate the local defense strategy.

[0108] Response: All operations are logged with timestamps and signature hashes to ensure traceability.

[0109] High-risk incident: Immediately disconnect external communication interfaces, freeze suspicious processes, and trigger security log upload;

[0110] Medium-risk events: Record the event log and upload it to the cloud security center;

[0111] Low-risk events: Only recorded locally, and incorporated into subsequent learning samples to optimize the risk model.

[0112] This invention utilizes four modules working collaboratively—environmental perception, configuration verification, process analysis, and traffic parsing—to cover the complete security chain of an in-vehicle system, from static assets to dynamic behavior. By introducing an inference model based on multimodal representation enhancement, it can understand the deep semantics of network traffic content, effectively distinguishing between normal communication, encoded data, and malicious commands, thus improving the accuracy and interpretability of detection. Simultaneously, a weighted fusion mechanism is employed to comprehensively score multi-source anomaly events and execute differentiated automatic response strategies based on risk levels, achieving closed-loop security protection from detection to handling. Furthermore, the whitelist database is updatable, the detection model can be optimized through learning from new samples, and the encoding recognition supports custom extensions, enabling the system to adapt to the ever-evolving in-vehicle environment and threats.

[0113] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0114] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.< / pid> < / pid>

Claims

1. A vehicle-mounted system safety detection and risk assessment system, characterized in that, include: The vehicle terminal environment perception module is used to collect multi-level environmental information of the vehicle system, including system layer information, network layer information and security layer information; The vehicle configuration file and communication whitelist detection module is connected to the vehicle terminal environment perception module. It is used to establish and maintain a security whitelist library based on the collected system information, and compare the current system configuration file, dynamic library, port and certificate status with the security whitelist library through periodic scanning to detect configuration abnormalities and file tampering events. The vehicle process and control task analysis module is connected to the vehicle terminal environment perception module. It is used to monitor the system process in real time, build a process behavior profile based on the collected process information, and detect hidden processes, unauthorized processes and abnormal behavior events by comparing the deviation between the current process behavior characteristics and the normal behavior profile built based on historical data. The communication anomaly detection and encoding recognition module is connected to the vehicle terminal environment perception module. It is used to capture and analyze network traffic. By performing encoding recognition, entropy analysis and semantic analysis on the payload content, it can detect high-entropy traffic, forged commands and abnormal communication. The semantic analysis process of the communication anomaly detection and encoding recognition module is implemented through a multimodal reasoning model, which includes: an encoding module, used to perform text encoding on the traffic content text and a predefined set of semantic tags including normal plaintext communication, encoded / compressed data, encrypted traffic and abnormal instructions, and to perform graph encoding on the knowledge subgraph containing at least one communication rule among port, direction and security level; The multimodal feature module is used to extract and update the features of the knowledge subgraph by interacting with the text representation and the graph node representation through the attention mechanism; the reconstruction module is used to dynamically mask the knowledge subgraph based on the random walk strategy and predict the relationship of the masked edges to explain the rationality of the communication structure; the prediction module is used to fuse the question representation and the knowledge subgraph representation, and calculate the confidence probability of each semantic label through the classifier to complete the semantic classification. The safety assessment and risk feedback module is connected to the vehicle configuration file and communication whitelist detection module, the vehicle process and control task analysis module, and the communication anomaly detection and code recognition module, respectively. It is used to perform data fusion and weight evaluation on the abnormal events output by the above modules, calculate the comprehensive risk score, and execute the corresponding risk response strategy according to the score level.

2. The vehicle-mounted system safety detection and risk assessment system according to claim 1, characterized in that, The multi-level acquisition structure of the vehicle-mounted terminal environment perception module includes: The system-level acquisition unit is used to identify the operating system type, kernel version, process snapshots, and file system metadata by reading system files or command output; The network layer acquisition unit is used to collect information on the physical and virtual network interfaces of the vehicle-mounted equipment, IP / MAC addresses, port listening status, and interface security configurations. The security layer acquisition unit is used to collect system certificate and signature information, security policy status, user permissions, and audit logs.

3. The vehicle-mounted system safety detection and risk assessment system according to claim 2, characterized in that, The vehicle configuration file and communication whitelist detection module performs a periodic scan every 10 minutes. The detection targets include the file hash value in the key directory, the dynamic library path loaded by the process, the system listening port, and the validity and signature of the digital certificate.

4. The vehicle-mounted system safety detection and risk assessment system according to claim 3, characterized in that, The process of establishing a process behavior profile by the vehicle process and control task analysis module includes: collecting the process's PID, process name, running path, resource utilization, user permissions, parent-child relationship and communication direction information, and encapsulating the multi-dimensional features into a behavior vector; the abnormal behavior events include the process execution path being deleted but still running, non-system users starting system tasks, and the process frequently accessing unknown IPs or high-risk ports and being marked as potential command execution events.

5. The vehicle-mounted system safety detection and risk assessment system according to claim 4, characterized in that, The content parsing and encoding recognition process of the communication anomaly detection and encoding recognition module supports recursive decoding of at least one encoding or compression format among Base64, Hex, URL encoding, Gzip, and Zlib; and when a preset illegal character combination appears in the decoded content, it is marked as suspicious communication.

6. The vehicle-mounted system safety detection and risk assessment system according to claim 5, characterized in that, The entropy analysis process of the communication anomaly detection and encoding recognition module includes: calculating the Shannon entropy of the decoded data block, and calculating the anomaly score according to the entropy range, the proportion of printable characters, and the character set compatibility characteristics through a preset weight formula; wherein, data blocks with an entropy value greater than 4.5 are judged as high-entropy data.

7. The vehicle-mounted system safety detection and risk assessment system according to claim 6, characterized in that, In the weighted evaluation of the security assessment and risk feedback module, the comprehensive risk score is calculated as follows: Score = 0.3 × Communication anomaly score + 0.25 × Configuration anomaly score + 0.25 × Process anomaly score + 0.1 × System risk score + 0.1 × AI confidence score, and the result is normalized to the range of 0 to 1.

8. The vehicle-mounted system safety detection and risk assessment system according to claim 7, characterized in that, The tiered response strategy implemented by the security assessment and risk feedback module based on the comprehensive risk score includes: When the score is in the high-risk range of 0.7 to 1.0, immediately disconnect the external communication interface and freeze the suspicious process; When the score is in the medium risk range of 0.4 to 0.7, record the event log and upload it to the cloud security center; When the score is in the low-risk range of 0.0 to 0.4, it is recorded locally and used as a learning sample for optimizing the risk model.

9. The vehicle-mounted system safety detection and risk assessment system according to claim 8, characterized in that, The detection report and all response operations output by the security assessment and risk feedback module are recorded in the audit log, which includes a timestamp and signature hash.

Images