Vehicle-mounted communication terminal protection strategy generation method and device, equipment and medium

Abstract

The invention discloses a vehicle-mounted communication terminal protection strategy generation method, apparatus and device, and a storage medium. The method comprises the steps of obtaining multi-source heterogeneous data of a vehicle-mounted communication terminal; performing feature extraction on the multi-source heterogeneous data to obtain a feature vector; inputting the feature vector into a target deep learning network, identifying the current attack mode of the vehicle-mounted communication terminal through the target deep learning network, and outputting an attack detection result; inputting the attack detection result and the state information of the vehicle-mounted communication terminal into a target reinforcement learning network, evaluating the security threat level of the attack mode through the target reinforcement learning network, and outputting the security threat level; and generating a target protection strategy of the vehicle-mounted communication terminal according to the security threat level. According to the invention, the adaptability of the vehicle-mounted communication terminal protection strategy is improved.

Description

Technical Field

[0001] This application relates to the field of vehicles, and in particular to a method, apparatus, device, and medium for generating a protection strategy for an in-vehicle communication terminal. Background Technology

[0002] Intelligent connected vehicles achieve real-time interconnection between the vehicle, cloud, and user terminals through in-vehicle communication terminals. Scenarios such as remote vehicle locking and diagnostic alerts all rely on the continuous high-speed data exchange of in-vehicle communication terminals. With the popularization of in-vehicle Ethernet and 5G communication, in-vehicle communication terminals have evolved from single communication modules into comprehensive security hubs integrating positioning, gateways, and edge computing. Their protection capabilities are directly related to the functional safety of the entire vehicle and the protection of user privacy.

[0003] However, most security protection technologies for vehicle-mounted communication terminals rely on pre-built static rule bases to generate protection strategies. This static mechanism is ill-equipped to cope with constantly evolving new network attack methods, resulting in insufficient adaptability of the generated protection strategies. When facing unknown threats and complex multi-stage attacks, the protection effect is significantly reduced. Summary of the Invention

[0004] This application aims to at least address the technical problems existing in the prior art. To this end, this application proposes a method, apparatus, device, and medium for generating a protection strategy for an in-vehicle communication terminal, which can improve the adaptability of the protection strategy, thereby improving the protection effect of the protection strategy and enhancing the protection capability of the in-vehicle communication terminal.

[0005] The first aspect of this application provides a method for generating a protection strategy for a vehicle-mounted communication terminal, including: Acquire multi-source heterogeneous data from the vehicle-mounted communication terminal; Feature extraction is performed on the multi-source heterogeneous data to obtain feature vectors; The feature vector is input into the target deep learning network, which identifies the current attack pattern of the vehicle communication terminal and outputs the attack detection result. The attack detection results and the status information of the vehicle-mounted communication terminal are input into the target reinforcement learning network. The security threat level of the attack pattern is evaluated by the target reinforcement learning network, and the security threat level is output. Based on the security threat level, a target protection strategy for the vehicle-mounted communication terminal is generated.

[0006] This application provides a method for generating a protection strategy for an in-vehicle communication terminal. The method involves acquiring multi-source heterogeneous data from the in-vehicle communication terminal; extracting features from the multi-source heterogeneous data to obtain feature vectors; inputting the feature vectors into a target deep learning network to identify the attack patterns currently being attacked by the in-vehicle communication terminal and outputting attack detection results; inputting the attack detection results and the state information of the in-vehicle communication terminal into a target reinforcement learning network to evaluate the security threat level of the attack patterns and outputting the security threat level; and generating a target protection strategy for the in-vehicle communication terminal based on the security threat level. Thus, through the synergistic effect of multi-source heterogeneous data fusion processing, deep learning attack identification, and reinforcement learning threat assessment, the adaptability of the protection strategy is improved, thereby enhancing the protection effect and improving the protection capability of the in-vehicle communication terminal.

[0007] In some embodiments of this application, the multi-source heterogeneous data includes at least one of vehicle bus data, network interface data, and on-board sensor data; The vehicle bus data includes at least one of the identifier field, data field, and period deviation of the bus signal frame; The network interface data includes at least one of the following: quintuple data, packet length distribution, and payload entropy value sequence; The vehicle-mounted sensor data includes at least one of inertial measurement data and positioning data.

[0008] In some embodiments of this application, the step of extracting features from the multi-source heterogeneous data to obtain feature vectors includes: The vehicle bus data is subjected to frame structure parsing and timing feature extraction to obtain the first type of features; The network interface data is subjected to traffic statistics features and entropy value features extraction to obtain the second type of features; Motion state features are extracted from the vehicle-mounted sensor data to obtain a third type of feature; The first type of feature, the second type of feature, and the third type of feature are normalized and concatenated to obtain the feature vector.

[0009] In some embodiments of this application, the target deep learning network is trained through the following steps: Acquire first training data, which includes historical multi-source heterogeneous data and attack mode labels corresponding to the historical multi-source heterogeneous data; The initial teacher network is iteratively trained using the first training data to obtain the target teacher network. Based on the hardware information of the vehicle-mounted communication terminal, determine the maximum number of network parameters; An initial student network is constructed based on the maximum number of parameters in the network; the number of parameters in the initial learning network is less than or equal to the maximum number of parameters in the network. Using the knowledge distillation method, the initial student network is trained through the target teacher network to obtain the target student network, and the target student network is used as the target deep learning network.

[0010] In some embodiments of this application, the target reinforcement learning network is trained through the following steps: The simulation training environment, the initial reinforcement learning network, and the second training data are acquired. The simulation training environment is used to simulate the state changes of the vehicle-mounted communication terminal according to the attack mode and the protection strategy. The second training data includes historical attack detection results and the state information of the vehicle-mounted communication terminal corresponding to the historical attack detection results. The second training data is input into the initial reinforcement learning network, and the initial reinforcement learning network outputs the protection strategy action. The protection strategy action is executed in the simulated training environment to obtain feedback information and reward value for the protection strategy action in the simulated training environment; The loss function value is determined based on the feedback information, the reward value, and the executed protection strategy actions. The parameters of the initial reinforcement learning network are adjusted based on the loss function value to obtain the target reinforcement learning network.

[0011] In some embodiments of this application, generating the target protection strategy for the vehicle-mounted communication terminal based on the security threat level includes: Based on the security threat level, select the corresponding basic protection strategy from the preset strategy library; Based on the status information of the vehicle-mounted communication terminal, the basic protection strategy is adjusted to obtain the target protection strategy for the vehicle-mounted communication terminal.

[0012] In some embodiments of this application, after generating the target protection strategy for the vehicle-mounted communication terminal based on the security threat level, the method further includes: The protection execution frequency is determined based on the security threat level; the protection execution frequency is positively correlated with the security threat level. The target protection strategy is executed according to the protection execution frequency.

[0013] A second aspect of this invention provides an apparatus for generating a protection strategy for a vehicle-mounted communication terminal, the apparatus comprising: The data acquisition module is used to acquire multi-source heterogeneous data from the vehicle communication terminal; The feature extraction module is used to extract features from the multi-source heterogeneous data to obtain feature vectors; An attack detection module is used to input the feature vector into a target deep learning network, identify the attack mode currently suffered by the vehicle communication terminal through the target deep learning network, and output the attack detection result. The security threat level assessment module is used to input the attack detection results and the status information of the vehicle communication terminal into the target reinforcement learning network, evaluate the security threat level of the attack mode through the target reinforcement learning network, and output the security threat level. The strategy generation module is used to generate a target protection strategy for the vehicle-mounted communication terminal based on the security threat level.

[0014] A third aspect of the present invention provides an electronic device, comprising: at least one control processor and a memory for communicatively connecting to the at least one control processor; the memory stores instructions executable by the at least one control processor, the instructions being executed by the at least one control processor to enable the at least one control processor to execute the above-described method for generating a vehicle communication terminal protection strategy.

[0015] A fourth aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions for causing a computer to execute the above-described method for generating a protection strategy for an in-vehicle communication terminal.

[0016] It is understood that the beneficial effects of the second to fourth aspects compared with the related technologies are the same as the beneficial effects of the first aspect compared with the related technologies. Please refer to the relevant description in the first aspect above, which will not be repeated here. Attached Figure Description

[0017] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which: Figure 1 This is a flowchart illustrating a method for generating a protection strategy for a vehicle-mounted communication terminal according to an embodiment of this application. Figure 2 This is a schematic diagram of the structure of a vehicle communication terminal security protection system when the method for generating a vehicle communication terminal protection strategy provided in this application is applied to the vehicle communication terminal security protection system.

[0018] Figure 3 This is a schematic diagram of the structure of a device for generating a protection strategy for an in-vehicle communication terminal provided in an embodiment of this application; Figure 4This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0019] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0020] In the description of this application, the use of terms such as "first," "second," etc., is for the purpose of distinguishing technical features only and should not be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated or the order of the technical features indicated.

[0021] In the description of this application, it should be understood that the orientation descriptions, such as up, down, etc., are based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application.

[0022] In the description of this application, it should be noted that, unless otherwise explicitly defined, terms such as "setup," "installation," and "connection" should be interpreted broadly, and those skilled in the art can reasonably determine the specific meaning of the above terms in this application in conjunction with the specific content of the technical solution.

[0023] Intelligent connected vehicles achieve real-time interconnection between the vehicle, cloud, and user terminals through in-vehicle communication terminals. Scenarios such as remote vehicle locking and diagnostic alerts all rely on the continuous high-speed data exchange of in-vehicle communication terminals. With the popularization of in-vehicle Ethernet and 5G communication, in-vehicle communication terminals have evolved from single communication modules into comprehensive security hubs integrating positioning, gateways, and edge computing. Their protection capabilities are directly related to the functional safety of the entire vehicle and the protection of user privacy.

[0024] However, most security protection technologies for vehicle-mounted communication terminals rely on pre-built static rule bases to generate protection strategies. This static mechanism is ill-equipped to cope with constantly evolving new network attack methods, resulting in insufficient adaptability of the generated protection strategies. When facing unknown threats and complex multi-stage attacks, the protection effect is significantly reduced.

[0025] Therefore, referring to Figure 1 This application provides a method for generating a protection strategy for an in-vehicle communication terminal. This method is applied to vehicles and includes the following steps S100 to S500: Step S100: Obtain multi-source heterogeneous data from the vehicle-mounted communication terminal.

[0026] Step S200: Extract features from the multi-source heterogeneous data to obtain feature vectors.

[0027] Step S300: Input the feature vector into the target deep learning network, identify the attack mode currently suffered by the vehicle communication terminal through the target deep learning network, and output the attack detection result.

[0028] Step S400: Input the attack detection result and the status information of the vehicle communication terminal into the target reinforcement learning network, evaluate the security threat level of the attack mode through the target reinforcement learning network, and output the security threat level.

[0029] Step S500: Generate a target protection strategy for the vehicle-mounted communication terminal based on the security threat level.

[0030] In this embodiment, the triggering conditions for step S100 are not limited. In some embodiments, step S100 can be executed when an abnormal attack is detected. In other embodiments, step S100 can be executed upon receiving instructions from a technician.

[0031] In this embodiment, the multi-source heterogeneous data of the vehicle communication terminal may include, but is not limited to, CAN bus data, network interface data, and vehicle sensor data.

[0032] Furthermore, since the types, formats, and dimensions of multi-source heterogeneous data may differ, targeted feature extraction methods can be used to extract features from different types of data, and then feature fusion can be used to obtain a feature vector with a unified dimension.

[0033] In some embodiments, an extraction method combining frame structure features and temporal features can be used to extract features from vehicle bus data. An extraction method combining statistical features and entropy features can be used to extract features from network interface data. An extraction method combining temporal statistical features and trend features can be used to extract features from vehicle sensor data.

[0034] Furthermore, normalizing the various single-source features extracted above can map the feature values ​​to the [0, 1] interval to eliminate the dimensional differences between different features. Then, all single-source features are merged into a fixed-dimensional feature vector by feature concatenation.

[0035] For example, if 12 features are extracted from vehicle bus data, 16 features are extracted from network interface data, and 12 features are extracted from vehicle sensor data, the fused feature vector has a dimension of 40. This feature vector comprehensively covers the bus communication status, network connection status, and vehicle operation status features of the vehicle communication terminal.

[0036] In this embodiment, the target deep learning network can be a hybrid neural network based on convolutional neural networks (CNN) and long short-term memory networks (LSTM). This network combines the ability of CNN to extract local features with the ability of LSTM to capture temporal dependencies, so as to accurately identify attack pattern features in multi-source heterogeneous data.

[0037] In this embodiment, the status information of the vehicle communication terminal may include the operating status of the core functions of the vehicle communication terminal, such as whether the bus data forwarding function, network communication function, and positioning data processing function are operating normally; and the redundancy of hardware resources, such as the remaining CPU processing power and the remaining memory space.

[0038] In this embodiment, the attack detection results output by the target deep learning network and the real-time collected vehicle communication terminal status information are input into the trained target reinforcement learning network. The target reinforcement learning network outputs the corresponding security threat level through comprehensive analysis and reasoning of the input information, so as to achieve a scientific assessment of the security threat of the attack mode.

[0039] Among them, the target reinforcement learning network can be trained by using the goal of maximizing the security protection benefits of the vehicle communication terminal as the reward objective.

[0040] In this embodiment, a protection strategy library corresponding to different security threat levels is preset, and the strategies in the protection strategy library gradually increase the protection strength as the threat level increases.

[0041] In some embodiments, after the target protection strategy is generated, it can be executed through the control module of the vehicle communication terminal, and the effect of the strategy execution can be monitored in real time. If the attack is not effectively contained after the strategy is executed (the attack is still detected by the target deep learning network again, and the threat level has not decreased), it is fed back to the target reinforcement learning network to reassess the threat level and adjust the protection strategy until the attack is contained or the threat level is reduced to a safe range.

[0042] In some embodiments, multi-source heterogeneous data may include at least one of vehicle bus data, network interface data, and on-board sensor data; The bus data includes at least one of the identifier field, data field, and period deviation of the bus signal frame; The network interface data includes at least one of the following: quintuple data, packet length distribution, and payload entropy value sequence; The vehicle-mounted sensor data includes at least one of inertial measurement data and positioning data.

[0043] In this embodiment, vehicle bus data refers to vehicle control and status transmission data collected by the vehicle communication terminal through the vehicle bus, such as CAN bus, LIN bus, FlexRay bus, etc., and may include, but is not limited to, at least one of the identifier field, data field, and period deviation of the bus signal frame. The identifier field is a unique identifier for the bus signal frame, used to distinguish different control commands or status data, such as the identifier corresponding to engine speed signals and brake control signals; the data field contains the specific numerical information carried in the signal frame, such as engine speed values ​​and vehicle speed values; the period deviation is the difference between the actual transmission period of the bus signal frame and a preset standard period. For example, if the standard transmission period of a brake signal is 10ms and the actual transmission period is 12ms, then the period deviation is 2ms.

[0044] Network interface data refers to network transmission data sent and received by a communication terminal through a network interface, such as an Ethernet interface, a 5G module interface, or a V2X communication interface. This data may include, but is not limited to, at least one of the following: 5-tuple data, packet length distribution, and payload entropy sequence. The 5-tuple data includes the source IP address, destination IP address, source port number, destination port number, and transmission protocol (e.g., TCP), used to uniquely identify a network communication connection. The packet length distribution represents the statistical characteristics of the lengths of all packets transmitted within a unit of time, such as length interval distribution and percentage. The payload entropy sequence is a time-series sequence obtained by calculating the entropy of the packet payload portion. The entropy value characterizes the randomness of the payload data; the higher the entropy value, the stronger the randomness of the data, and the more likely it is to contain malicious code or abnormal data.

[0045] Vehicle sensor data refers to environmental and vehicle status data collected by the vehicle communication terminal through connected vehicle sensors, which may include, but is not limited to, at least one of inertial measurement data and positioning data. Inertial measurement data is collected by an inertial measurement unit (IMU) and may include vehicle acceleration, angular velocity, and attitude angles; positioning data is collected by a satellite positioning module such as GPS or BeiDou positioning module and may include the vehicle's latitude and longitude coordinates, altitude, positioning accuracy, speed, and heading.

[0046] In some embodiments, by collecting the aforementioned multi-source heterogeneous data in real time, the collected data can be preprocessed. For example, for vehicle bus data, invalid frames with frame format errors or failed verification are removed; for network interface data, duplicate captured data packets are filtered and missing quintuple fields are filled in; for vehicle sensor data, the moving average method is used to smooth the noisy data; missing values ​​of various types of data are uniformly processed by mean filling or interpolation; and abnormal data that obviously exceeds the reasonable range is removed by setting data thresholds. Finally, a standardized multi-source heterogeneous dataset is obtained, providing a high-quality data foundation for subsequent feature extraction.

[0047] In some embodiments, step S200 may include, but is not limited to, steps S210 to S240: Step S210: Perform frame structure parsing and timing feature extraction on the vehicle bus data to obtain the first type of features; Step S220: Extract traffic statistics features and entropy features from the network interface data to obtain the second type of features; Step S230: Extract motion state features from the vehicle sensor data to obtain the third type of features; Step S240: Normalize and concatenate the first type of features, the second type of features, and the third type of features to obtain the feature vector.

[0048] In this embodiment, a method combining frame structure parsing and temporal feature extraction is used to capture features of vehicle bus data in all directions, thereby obtaining the first type of features.

[0049] Specifically, frame structure parsing can be used to parse the identifier field of bus signal frames, for example, extracting the most frequently occurring identifiers, the frequency and proportion of abnormal identifiers (i.e., identifiers not appearing in the preset whitelist), and the active duration of core control identifiers such as brake and steering-related identifiers; and to parse the data field, extracting the numerical range, mean, variance, maximum abrupt change (i.e., the maximum value of the difference between adjacent frame data), and invalid data proportion (i.e., the proportion of data exceeding the normal numerical range) of the data field corresponding to each identifier.

[0050] Timing feature extraction can be used to extract data such as the mean deviation, variance deviation, frequency of deviation exceeding the allowable threshold, duration of deviation exceeding the threshold, and trend of deviation timing changes per unit time for periodic deviations. For example, for the transmission timing of bus signal frames, the mean, variance, number of abrupt changes (number of times the interval change exceeds a set threshold), and number of repetitions of consecutive identical data frames can be extracted for the frame arrival interval.

[0051] In this embodiment, an extraction method combining traffic statistics and entropy analysis is used to mine abnormal features in network interface data and obtain the second type of features.

[0052] Specifically, traffic statistics feature extraction can extract the total number of connections per unit time, the number of connections initiated from the same source IP, the proportion of cross-network segment connections, the number of accesses to abnormal ports (not in the preset security port whitelist), and the distribution of protocol types for five-tuple data; for packet length distribution, it can extract the mean length, length variance, maximum / minimum packet length, peak length distribution (the length range with the highest frequency), frequency of length mutations (the number of times the length difference between adjacent packets exceeds the threshold), and the proportion of oversized packets (the length exceeds the set threshold).

[0053] Entropy feature extraction can calculate the entropy value of the data packet payload by dividing it into a preset sliding window, such as 10 data packets per window, to obtain a payload entropy value sequence. Based on this sequence, features such as the mean entropy value, the variance of the entropy value, the maximum / minimum entropy value, the proportion of high entropy value windows (the proportion of windows whose entropy value exceeds a set threshold), and the number of entropy value mutations (the number of times the entropy value difference between adjacent windows exceeds the threshold) can be extracted.

[0054] In this embodiment, we focus on the features related to the vehicle's motion state and extract the third type of features from the on-board sensor data.

[0055] Specifically, data such as the mean, variance, peak value, frequency of peak value occurrence, and zero crossover rate of acceleration can be extracted from inertial measurement data; as well as the mean, variance, maximum angular velocity, rate of change of angular velocity, and stability indicators of attitude angles (the fluctuation range of attitude angles within the sliding window) can be extracted to comprehensively cover the motion state of the vehicle.

[0056] It can also extract features from positioning data, such as the drift amount of positioning coordinates (average deviation from historical trajectories), drift trend, rate of change of heading angle, fluctuation range of positioning accuracy, and duration of stay at the same location.

[0057] In this embodiment, the first type of feature, the second type of feature, and the third type of feature can be normalized respectively, mapping all feature values ​​to the interval [0, 1], so as to eliminate the differences in dimensionality and numerical range between different features. For example, features of different magnitudes such as connection number, entropy value, and acceleration can be unified on a uniform scale. Furthermore, the normalized three types of features are sequentially concatenated to form a feature vector with a unified dimension. For example, if the first type of feature is 25-dimensional, the second type is 30-dimensional, and the third type is 20-dimensional, then the concatenated feature vector has a dimension of 75. This feature vector comprehensively covers the core features of the three major data dimensions of vehicle bus, network interface, and vehicle sensor, providing comprehensive data support for subsequent attack pattern recognition.

[0058] In some embodiments, the target deep learning network can be trained through the following steps: Acquire first training data, which includes historical multi-source heterogeneous data and attack mode labels corresponding to the historical multi-source heterogeneous data; The initial teacher network is iteratively trained using the first training data to obtain the target teacher network. Based on the hardware information of the vehicle-mounted communication terminal, determine the maximum number of network parameters; An initial student network is constructed based on the maximum number of parameters in the network; the number of parameters in the initial learning network is less than or equal to the maximum number of parameters in the network. Using the knowledge distillation method, the initial student network is trained through the target teacher network to obtain the target student network, and the target student network is used as the target deep learning network.

[0059] In this embodiment, the first training data includes historical multi-source heterogeneous data and attack mode labels corresponding to the historical multi-source heterogeneous data.

[0060] Among them, historical multi-source heterogeneous data can be obtained from the historical operation records of vehicle communication terminals, which can cover normal operation scenarios and various attack scenarios, such as vehicle bus data, network interface data and vehicle sensor data, such as malicious code injection attacks, data eavesdropping attacks, false command attacks, and port scanning attacks; attack mode labels are the attack types corresponding to historical multi-source heterogeneous data that are manually or automatically labeled, such as malicious code injection labels, to ensure that each historical data sample has a unique corresponding attack mode label.

[0061] In this embodiment, the initial teacher network can adopt a deep CNN-LSTM hybrid neural network architecture.

[0062] Specifically, the first training feature vector set can be divided into a teacher training set and a teacher validation set in an 8:2 ratio. The initial teacher network is then iteratively trained using the teacher training set to obtain the target teacher network. The target teacher network has high-precision attack pattern recognition capabilities, but it has a large number of parameters and high computational complexity.

[0063] Furthermore, based on the hardware information of the vehicle-mounted communication terminal, the maximum number of parameters for the target deep learning network is determined to ensure that the network can operate efficiently on the vehicle-mounted terminal. The hardware information of the vehicle-mounted communication terminal may include memory type and number of cores, memory capacity, image processor, etc.

[0064] Furthermore, based on the maximum number of parameters in the network, an initial student network is constructed. The number of parameters in the initial student network is less than or equal to the maximum number of parameters in the network, and the network architecture is consistent with that of the target teacher network (CNN-LSTM hybrid architecture). Lightweighting is achieved by compressing the network layer parameters.

[0065] For example, if the target number of network parameters for teachers is 8 million and the maximum number of network parameters is 2 million, then the initial number of network parameters for students is designed to be 1.8 million (less than 2 million) to ensure compatibility with the hardware resources of the vehicle terminal.

[0066] Furthermore, by using the knowledge distillation method, the initial student network is trained through the target teacher network, and the high-precision recognition knowledge of the teacher network is transferred to the lightweight student network.

[0067] In some embodiments, the target reinforcement learning network is trained through the following steps: The simulation training environment, the initial reinforcement learning network, and the second training data are acquired. The simulation training environment is used to simulate the state changes of the vehicle-mounted communication terminal according to the attack mode and the protection strategy. The second training data includes historical attack detection results and the state information of the vehicle-mounted communication terminal corresponding to the historical attack detection results. The second training data is input into the initial reinforcement learning network, and the initial reinforcement learning network outputs the protection strategy action. The protection strategy action is executed in the simulated training environment to obtain feedback information and reward value for the protection strategy action in the simulated training environment; The loss function value is determined based on the feedback information, the reward value, and the executed protection strategy actions. The parameters of the initial reinforcement learning network are adjusted based on the loss function value to obtain the target reinforcement learning network.

[0068] In this embodiment, the simulation training environment can be a high-fidelity virtual training environment constructed using simulation modeling tools, based on the hardware architecture of the vehicle communication terminal, such as the CPU model, the software system, such as the operating system version, and the actual application scenario, such as driving on urban roads.

[0069] In this embodiment, the initial reinforcement learning network can be a deep Q-network architecture, which may include an input layer, a hidden layer, and an output layer. The dimension of the input layer matches the dimension of the attack detection results and the state information features of the vehicle-mounted communication terminal.

[0070] The second training data can include historical attack detection results and corresponding vehicle communication terminal status information. The historical attack detection results can be derived from the target deep learning network's identification results of historical multi-source heterogeneous data, such as bus data injection attack with an attack strength of 0.85, no attack with an attack strength of 0. The corresponding terminal status information is the terminal's real-time status data under the attack scenario, such as core functions operating normally and CPU remaining processing capacity at 30%. Each historical attack case forms a sample pair of attack detection results and terminal status information.

[0071] Furthermore, the second training data can be divided into a training set and a validation set at a 9:1 ratio. The attack detection results and terminal state information samples from the training set are input into the initial reinforcement learning network. The initial reinforcement learning network calculates the Q-value corresponding to each security threat level through forward propagation, and selects the threat level with the largest Q-value as the protection strategy action corresponding to the current input sample (i.e., outputs the security threat level, and subsequently generates a protection strategy based on this level).

[0072] Furthermore, the output protection strategy action (security threat level) is input into the simulation training environment. The simulation training environment executes the corresponding protection strategy according to the preset threat level-protection strategy mapping relationship (e.g., if a level 3 threat is output, a medium protection strategy is executed), and simulates the interaction process between attack and protection, obtaining feedback information and reward value for the protection strategy action in the simulation training environment.

[0073] The feedback information may include the effectiveness of attack containment, such as whether the attack was blocked; the impact on terminal operation, such as changes in hardware resource utilization; and the data security status, such as whether there was a data leak.

[0074] The reward value can be calculated based on feedback information and preset reward rules. The reward rules can be set according to the actual situation and are not specifically limited here.

[0075] For example, the reward rules can be set as follows: If the protection strategy action (threat level) effectively curbs the attack (attack intensity decreases by ≥50%) and does not affect the operation of the terminal's core functions (core function response delay ≤50ms), a positive reward (+10) will be given. If the protection strategy curbs the attack but causes a slight degradation of core functions (response delay of 50-100ms), a moderate positive reward (+5) will be given. If the protection strategy fails to contain the attack (attack intensity decreases by <30%), or if excessive protection causes a serious degradation of core functions (response latency >100ms), a negative reward (-8) will be given. If the protection strategy does not match the attack threat (e.g., light protection for high threat, or heavy protection for low threat), a negative reward (-5) will be given. If the attack is completely contained and the terminal is not affected in any way, an additional reward (+3) will be given.

[0076] Furthermore, a loss function can be constructed using temporal difference, and the overall loss function value for the current iteration can be obtained by calculating the mean loss value of all samples in the training set.

[0077] Furthermore, the weight parameters of the initial reinforcement learning network are adjusted through backpropagation, and the above training process is repeated until the initial reinforcement learning network meets the convergence condition, thus obtaining the target reinforcement learning network. The convergence condition can be set according to the actual situation and is not specifically limited here. For example, it can be set that the initial reinforcement learning network converges when the loss function value is less than 0.001.

[0078] In this embodiment, by inputting the attack detection results and the real-time collected vehicle communication terminal status information into the target reinforcement learning network, the target reinforcement learning network outputs the corresponding security threat level through forward propagation, thereby achieving a scientific assessment of the security threat of the attack pattern.

[0079] In some embodiments, step S500 may include, but is not limited to, steps S510 to S520: Step S510: Select the corresponding basic protection strategy from the preset strategy library according to the security threat level; Step S520: Adjust the basic protection strategy according to the status information of the vehicle communication terminal to obtain the target protection strategy of the vehicle communication terminal.

[0080] In this embodiment, a basic protection strategy library is preset, which corresponds one-to-one with multiple security threat levels. The basic protection strategies in the basic protection strategy library may include the core protection measures, protection strength and execution priority corresponding to each threat level.

[0081] Furthermore, real-time status information of the vehicle-mounted communication terminal is obtained, and adaptive optimization is performed on the adjustable items in the basic protection strategy to ensure that the protection strategy matches the actual status of the terminal and avoid over-protection or under-protection.

[0082] Furthermore, the target protection strategy for the vehicle communication terminal can be obtained by adjusting the operating status and hardware resource redundancy of the vehicle communication terminal based on the status information.

[0083] For example, if the core functions of the terminal, such as communication functions, are currently running under high load, the frequency of unnecessary scanning / logging in the basic protection strategy should be reduced, such as adjusting vulnerability scanning from once every 6 hours to once every 8 hours, to avoid consuming too much CPU resources.

[0084] If there is sufficient hardware resource redundancy, with CPU remaining processing capacity ≥40% and memory remaining space ≥30%, then add deep detection measures to the basic protection strategy, such as additionally enabling attack tracing function to track the behavior trajectory of the attack source.

[0085] If hardware resources are nearing their limit (CPU remaining processing capacity < 10%), prioritize retaining core attack blocking measures, such as only retaining non-emergency measures like disconnecting the network, emergency mode, and security alerts, while suspending log storage and vulnerability scanning.

[0086] In this embodiment, through the above adjustments, the basic protection strategy is optimized into a target protection strategy that is highly adapted to the real-time status of the terminal.

[0087] In some embodiments, after step S500, the method for generating the vehicle communication terminal protection strategy provided in this application embodiment may also include, but is not limited to, steps S600 to S700: Step S600: Determine the protection execution frequency based on the security threat level; the protection execution frequency is positively correlated with the security threat level. Step S700: Execute the target protection strategy according to the protection execution frequency.

[0088] In this embodiment, after generating the target protection strategy, the protection execution frequency is dynamically determined based on the security threat level. The protection execution frequency is positively correlated with the security threat level. The higher the threat level, the more frequently the core protection measures are executed, and the target protection strategy is executed at this frequency.

[0089] Among them, the protection execution frequency can refer to the unit time execution cycle or number of times the core protection measures in the target protection strategy are triggered. Core protection measures can include key protection actions such as attack interception, data verification, vulnerability scanning, status monitoring, and log recording; non-core measures (such as alarm sending and data backup) are executed at the time preset by the strategy and are not subject to frequency restrictions.

[0090] Furthermore, the execution frequency can be based on the lowest security threat level (no threat), and increased exponentially as the threat level increases. At the same time, dynamic fine-tuning can be performed in conjunction with the redundancy of vehicle terminal hardware resources to ensure that the frequency matches the hardware carrying capacity.

[0091] The following describes the implementation process of the method for generating the vehicle communication terminal protection strategy provided in the embodiments of this application: See also Figure 2 , Figure 2 The diagram shows the structure of the vehicle communication terminal security protection system when the method for generating the vehicle communication terminal protection strategy provided in this application is applied to the vehicle communication terminal security protection system.

[0092] The vehicle-mounted communication terminal security protection system includes a hardware support layer, a security protection layer, a data acquisition layer, a detection and analysis layer, an intelligent decision-making layer, and an application layer.

[0093] Specifically, the hardware support layer integrates a high-performance main control chip, a multi-mode communication module, and a hardware security chip, providing a solid hardware foundation for security protection.

[0094] The security protection layer enables dynamic key management, access control, and secure communication functions, and employs a layered key architecture and hardware-level encryption to protect sensitive data.

[0095] The data acquisition layer can collect heterogeneous data from multiple sources such as CAN bus, network interface, and sensors, and provides high-quality input data for upper-layer detection through data preprocessing and feature extraction. The detection and analysis layer is the core of the system, integrating a deep learning-based AI detection module (i.e., integrating a target deep learning network), an anomaly detector, and a behavior analyzer, and adopts a neural network architecture to achieve accurate identification of attack patterns.

[0096] The intelligent decision-making layer can include a threat assessment engine, a response decision module, and a policy optimizer, and realizes the dynamic adjustment of threat level assessment and protection strategy based on reinforcement learning algorithms (i.e., the intelligent decision-making layer integrates a target reinforcement learning network).

[0097] The application layer can provide security management apps, remote monitoring platforms, and Over-The-Air Upgrade (OTA) upgrade services, offering users and administrators an intuitive security management interface.

[0098] In this embodiment, deep learning algorithms are deeply integrated into the security protection system of the vehicle-mounted communication terminal (T-BOX) to achieve automatic learning of attack patterns and real-time adjustment of protection strategies. Through multimodal data fusion technology, the system can comprehensively analyze security data from different sources, improving the accuracy and comprehensiveness of threat detection. Simultaneously, considering the unique characteristics of the vehicle environment, the system employs techniques such as model quantization and knowledge distillation to optimize algorithm complexity, ensuring efficient security protection under limited computing resources.

[0099] The dynamic resource scheduling mechanism intelligently allocates computing resources based on system load and security requirements, ensuring the priority execution of critical security tasks. The adaptive response mechanism can automatically adjust protection strategies based on threat level and system status, maximizing system availability while ensuring security.

[0100] like Figure 3 As shown in some embodiments of this application, a device for generating a protection strategy for an in-vehicle communication terminal is provided. The device includes a data acquisition module 1100, a feature extraction module 1200, an attack detection module 1300, a level assessment module 1400, and a strategy generation module 1500. Specifically: The data acquisition module 1100 is used to acquire multi-source heterogeneous data from the vehicle communication terminal; Feature extraction module 1200 is used to extract features from the multi-source heterogeneous data to obtain feature vectors; The attack detection module 1300 is used to input the feature vector into the target deep learning network, identify the attack mode currently suffered by the vehicle communication terminal through the target deep learning network, and output the attack detection result. The level assessment module 1400 is used to input the attack detection results and the status information of the vehicle communication terminal into the target reinforcement learning network, evaluate the security threat level of the attack mode through the target reinforcement learning network, and output the security threat level. The strategy generation module 1500 is used to generate a target protection strategy for the vehicle-mounted communication terminal based on the security threat level.

[0101] It should be noted that the device for generating a vehicle communication terminal protection strategy provided in this embodiment and the method for generating a vehicle communication terminal protection strategy described above are based on the same inventive concept. Therefore, the relevant content of the method for generating a vehicle communication terminal protection strategy described above also applies to the content of the device for generating a vehicle communication terminal protection strategy. Therefore, it will not be repeated here.

[0102] like Figure 4 This application also provides an electronic device, which includes: At least one memory; At least one processor; At least one program; The program is stored in memory, and the processor executes at least one program to implement the above-described method for generating a vehicle communication terminal protection strategy.

[0103] This electronic device can be any smart terminal, including mobile phones, tablets, personal digital assistants (PDAs), and in-vehicle computers.

[0104] The electronic devices according to embodiments of this application will now be described in detail.

[0105] The processor 1600 can be implemented using a general-purpose central processing unit (CPU), microprocessor, application specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention. The memory 1700 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 1700 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the program code is stored in the memory 1700 and is called and executed by the processor 1600 to execute a method for generating a vehicle communication terminal protection strategy according to an embodiment of the present invention.

[0106] The input / output interface 1800 is used to implement information input and output. The communication interface 1900 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 2000 transmits information between various components of the device (e.g., processor 1600, memory 1700, input / output interface 1800, and communication interface 1900); The processor 1600, memory 1700, input / output interface 1800 and communication interface 1900 are connected to each other within the device via bus 2000.

[0107] This invention also provides a storage medium, which is a computer-readable storage medium storing computer-executable instructions for causing a computer to execute the above-described method for generating a protection strategy for an in-vehicle communication terminal.

[0108] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0109] The embodiments described in this invention are intended to more clearly illustrate the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0110] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present invention, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0111] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0112] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0113] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0114] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0116] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0117] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0118] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0119] The above is a detailed description of the preferred embodiments of this application. However, the embodiments of this application are not limited to the above-described implementation methods. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the embodiments of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of the embodiments of this application.

Claims

1. A method for generating a protection policy of an in-vehicle communication terminal, characterized by, The method comprises the following steps: acquiring multi-source heterogeneous data of a vehicle-mounted communication terminal; extracting features from the multi-source heterogeneous data to obtain a feature vector; inputting the feature vector into a target deep learning network, identifying an attack mode currently suffered by the vehicle-mounted communication terminal through the target deep learning network, and outputting an attack detection result; inputting the attack detection result and state information of the vehicle-mounted communication terminal into a target reinforcement learning network, evaluating a security threat level of the attack mode through the target reinforcement learning network, and outputting the security threat level; generating a target protection strategy for the vehicle-mounted communication terminal according to the security threat level.

2. The method of claim 1, wherein the vehicle-mounted communication terminal protection policy is generated based on the vehicle-mounted communication terminal protection policy information. The multi-source heterogeneous data comprises at least one of vehicle bus data, network interface data, and vehicle-mounted sensor data; The vehicle bus data comprises at least one of an identifier field, a data field, and a cycle deviation of a bus signal frame; The network interface data comprises at least one of five-tuple data, a data packet length distribution, and a load entropy value sequence; The vehicle-mounted sensor data comprises at least one of inertial measurement data and positioning data.

3. The method of claim 2, wherein the vehicle-mounted communication terminal protection policy is generated based on the vehicle-mounted communication terminal protection policy information. The feature extraction from the multi-source heterogeneous data to obtain the feature vector comprises the following steps: frame structure analysis and timing feature extraction are performed on the vehicle bus data to obtain first-type features; traffic statistical feature and entropy value feature extraction are performed on the network interface data to obtain second-type features; motion state feature extraction is performed on the vehicle-mounted sensor data to obtain third-type features; the first-type features, the second-type features, and the third-type features are normalized and spliced to obtain the feature vector.

4. The method of claim 1, wherein the vehicle-mounted communication terminal protection policy is generated based on a type of the vehicle-mounted communication terminal. The target deep learning network is trained through the following steps: first training data is acquired, the first training data comprising historical multi-source heterogeneous data and an attack mode label corresponding to the historical multi-source heterogeneous data; an initial teacher network is iteratively trained through the first training data to obtain a target teacher network; a network maximum parameter quantity is determined according to hardware information of the vehicle-mounted communication terminal; an initial student network is constructed according to the network maximum parameter quantity; the parameter quantity of the initial student network is less than or equal to the network maximum parameter quantity; a target student network is obtained by training the initial student network through the target teacher network using a knowledge distillation method, and the target student network is taken as the target deep learning network.

5. The method for generating a protection strategy of a vehicle-mounted communication terminal according to claim 1, wherein the target reinforcement learning network is trained through the following steps: a simulation training environment, an initial reinforcement learning network, and second training data are acquired; the simulation training environment is used to simulate state changes of the vehicle-mounted communication terminal according to an attack mode and a protection strategy, and the second training data comprises historical attack detection results and state information of a vehicle-mounted communication terminal corresponding to the historical attack detection results; the second training data is input into the initial reinforcement learning network, and a protection strategy action is output through the initial reinforcement learning network; the protection strategy action is executed in the simulation training environment to obtain feedback information and a reward value of the protection strategy action in the simulation training environment; and Determine a loss function value based on the feedback information, the reward value, and the executed protection policy action; Adjust parameters of the initial reinforcement learning network based on the loss function value to obtain the target reinforcement learning network.

6. The method of claim 1, wherein the vehicle-mounted communication terminal protection policy is generated based on a type of the vehicle-mounted communication terminal. The generating the target protection policy of the vehicle-mounted communication terminal according to the security threat level comprises: Selecting a corresponding basic protection policy from a preset policy library according to the security threat level; Adjusting the basic protection policy according to the state information of the vehicle-mounted communication terminal to obtain the target protection policy of the vehicle-mounted communication terminal.

7. The method of claim 1, wherein the vehicle-mounted communication terminal protection policy is generated based on a type of the vehicle-mounted communication terminal. After the generating the target protection policy of the vehicle-mounted communication terminal according to the security threat level, the method further comprises: Determining a protection execution frequency according to the security threat level; the protection execution frequency is positively correlated with the security threat level; Executing the target protection policy according to the protection execution frequency.

8. An apparatus for generating a protection policy of an in-vehicle communication terminal, characterized by comprising: The device comprises: A data acquisition module configured to acquire multi-source heterogeneous data of a vehicle-mounted communication terminal; A feature extraction module configured to perform feature extraction on the multi-source heterogeneous data to obtain a feature vector; An attack detection module configured to input the feature vector into a target deep learning network, identify an attack mode currently suffered by the vehicle-mounted communication terminal through the target deep learning network, and output an attack detection result; A level evaluation module configured to input the attack detection result and state information of the vehicle-mounted communication terminal into a target reinforcement learning network, evaluate a security threat level of the attack mode through the target reinforcement learning network, and output the security threat level; A policy generation module configured to generate a target protection policy of the vehicle-mounted communication terminal according to the security threat level.

9. An electronic device, comprising: The memory is configured to store instructions executable by the at least one control processor, and the at least one control processor is configured to execute the instructions to enable the at least one control processor to perform the method for generating a protection policy of a vehicle-mounted communication terminal according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is configured to store computer-executable instructions for causing a computer to perform the method for generating a protection policy of a vehicle-mounted communication terminal according to any one of claims 1-7.

Images