An in-vehicle network cross-subsystem attack chain reconstruction method based on IDS alarm tracking and tracing

Abstract

The application discloses a vehicle-mounted network cross-subsystem attack chain reconstruction method based on IDS alarm tracking and tracing. The method takes the IDS alarms of hosts, vehicle-mounted Ethernet and CAN (Controller Area Network) and vehicle states as inputs, performs semantic normalization and time window alignment on the alarms, and generates a standardized event stream. Then, candidate event pairs are generated on the gateway ECU (Electronic Control Unit) side, and are checked according to time difference threshold, communication topology reachability, semantic compatibility relationship and kinematics consistency rules to establish effective directed association edges to incrementally build an alarm tracking graph. Finally, a time-monotonic directed acyclic graph is extracted from the tracking graph as an attack chain, and chain digest information is output.

Description

Technical Field

[0001] This invention relates to the field of communication and information security technology for intelligent connected vehicles, specifically to a method for reconstructing cross-subsystem attack chains in vehicle networks based on IDS alarm tracing and source tracing. It is applicable to the structured reconstruction and path analysis of malicious behavior between multiple subsystems and belongs to the intersection of automotive network security and network behavior tracing. Background Technology

[0002] Intrusion detection and attack chain tracing in vehicular networks are of paramount importance in ensuring the security of intelligent vehicles. From early work focusing solely on anomaly detection on a single bus (M. Müter and N. Asaj. 2011. Entropy-based anomaly detection for in-vehicle networks. IEEE Intelligent Vehicles Symposium (IV), Baden-Baden, Germany. IEEE. pp. 1110-1115) to packet signature matching methods targeting specific attack types (Miller, C., and Valasek, C. 2015. Remote exploitation of an unaltered passenger vehicle. Black Hat USA), vehicular network security detection has consistently been a hot research topic. Subsequently, a large body of research focused on statistical anomaly detection models on in-vehicle buses (such as CAN and FlexRay) (Zhang, H., Meng, X., Zhang, X., and Liu, Z. 2020. CANsec: A practical in-vehicle controller area network security evaluation tool. Sensors (Basel, Switzerland), 20.) and models based on physical signal consistency detection (Cho Kyong-Tak and Shin Kang G. 2016. Fingerprinting electronic control units for vehicle intrusion detection. Proceedings of the 25 thThe USENIX Conference on Security Symposium (Austin, TX, USA) (SEC'16). USENIX Association, USA, 911–927, and host behavior analysis deployments (E. Seo, HM Song and HK Kim. 2018. GIDS: GAN-based Intrusion Detection System for In-Vehicle Network. 16th Annual Conference on Privacy, Security and Trust (PST), Belfast, Ireland, IEEE, pp. 1-6) have gradually promoted the transition from single-point anomaly detection to multi-source behavior understanding. With the rise of in-vehicle Ethernet and central computing platforms, more and more attack methods are showing multi-stage and multi-subsystem collaborative characteristics, prompting research focus to further shift to the identification and tracking of "cross-subsystem attack chains".

[0003] Another related approach is based on IDS alarm aggregation and causal tracing mechanisms. By aggregating alarms generated at different stages of the same attack process in terms of time or content, it attempts to reconstruct the evolution of the attack chain. This direction can be traced back to enterprise network intrusion detection systems in the late 20th and early 21st centuries, such as the alarm aggregation method based on similar features proposed by Julisch, K. 2003. Clustering intrusion detection alarms to support root cause analysis. ACMTransactions on Information and System Security (TISSEC), 6(4), 443–471. This method identifies recurring attack structures in the system through frequent pattern mining and simplifies them into root cause patterns. Its basic assumption is that "attacker behavior has a stable template." By vectorizing the metadata of alarms (such as IP address, port number, alarm type), a distance metric in a low-dimensional space can be constructed and used for cluster analysis. However, this type of method has serious semantic expression defects when dealing with modern vehicle network environments: the vehicle subsystems are not IP-style flat communication structures, but multi-protocol heterogeneous bus systems, and each subsystem has independent communication semantics and time references. Therefore, it is not meaningful to directly use vector distance or tuple aggregation as causal determination.

[0004] Subsequently, many works have attempted to improve the ability to reconstruct causal chains. For example, Valdes, A., and Skinner, K.2001. Probabilistic alert correlation. In International Workshop on Recent Advances in Intrusion Detection (RAID), Springer, 54–68. proposed an alarm correlation method based on a probabilistic model, which establishes a causal probability chain between different alarms through a Bayesian network to improve the interpretability of multi-stage attack chains. This method requires defining the attack graph template a priori and training confidence parameters on historical data. However, this faces two challenges in vehicular networks: (1) vehicular attacks lack large-scale labeled data to train causal graph parameters; (2) vehicular attack paths are highly dependent on the current vehicle state (such as whether AEB (Automatic Emergency Braking) is activated or whether ADAS is online), making static template graphs unable to adapt to dynamically changing real-world application scenarios. Furthermore, as demonstrated by (Ning, P., Cui, Y., and Reeves, DS 2002. Constructing attack scenarios through correlation of intrusion alerts. In Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS), ACM, 245–254.), a graph structure based on attack premise and consequence logic was constructed to automatically generate attack chain paths in the alert flow. They proposed the "precondition-consequence graph" model, which can logically connect multiple alert nodes to identify complex attack structures. This approach inspired a large number of subsequent attack graph-based tracing systems. However, such models typically rely on the following premises: (1) all alert events are structured and homogeneous inputs; (2) the system has a complete attack knowledge base; and (3) the attack path topology can be defined in advance. These assumptions are difficult to hold in vehicular networks: CAN alarms originate from low-level ID frame patterns, Ethernet alarms originate from service / session level data, and Host IDS may be based on system calls and process logs; the three lack a unified structure, have misaligned semantic levels, and are difficult to integrate into a unified attack graph.

[0005] Furthermore, standard alert aggregation methods, such as (Dain, O., and Cunningham, RK 2001. Using a heterogeneous alert stream into scenarios. In Proceedings of the 2001 ACM Workshop on Data Mining for Security Applications, Springer, 103–122.), typically base their attack chain construction on a single time window or fixed logical rules, lacking modeling of the physical constraints of the vehicle system's operation. For example, even if the temporal sequence of alerts is reasonable, if kinematic consistency is not met (e.g., a change in steering angle is not accompanied by the expected CAN braking signal), it should not be considered part of the same attack chain. This type of "physical feasibility" determination mechanism is completely absent in traditional methods.

[0006] Recently, several new methods for vehicular networks have begun to incorporate graph models and deep learning to improve detection efficiency and granularity. For example, DGIDS, which dynamically constructs graphs from CAN messages to achieve near real-time intrusion detection (Song, J., Qin, G., Liang, Y., Yan, J., and Sun, M., 2024. DGIDS: Dynamic graph-based intrusiondetection system for CAN, Computers & Security, 147, 104076)(Mahdavi, E., Fanian, A., and Amini, F., 2020. A real-time alert correlation method basedon code-books for intrusion detection systems, Computers & Security, 89, 101661)(Haas, S., and Fischer, M., 2019. On the alert correlation process for the detection of multi-step attacks and a graph-based realization, ACM SIGAPP Applied Computing Review, 19(1), (5–19), and StatGraph, which achieves fine-grained identification through multi-view statistical graph learning (Wang, K., Jiang, Q., Wang, B., Zhang, H., and Wu, Y., 2023.STATGRAPH: Effective in-vehicle intrusion detection via multi-viewstatistical graph learning, arXiv:2311.07056). However, these methods are mainly aimed at anomaly detection of a single subsystem (such as CAN) and do not provide the ability to trace alarm sources and reconstruct attack chains across hosts / Automotive Ethernet / CAN.In the field of general networking, there are also studies on multi-step attack scenario reconstruction and link extraction based on IDS alerts (Mao, B., Liu, J., Lai, Y., and Sun, M., 2021. MIF: A multi-step attackscenario reconstruction and attack chains extraction method based on multi-information fusion, Computer Networks, 193, 108340) (Lyu, H., Liu, J., Lai, Y., Mao, B., and Huang, X., 2024. AGCM: A multi-stage attack correlation and scenario reconstruction based on attack graph and clustering models, Computer Communications, 224, 302–313), as well as studies on alert correlation using graph learning (Cheng, Q., Wu, C., and Zhou, S., 2021. Discovering attack scenarios via intrusion alertcorrelation using graph convolutional networks, IEEE Communications Letters, 25(5)). (1564–1567), and recent work has emerged that explicitly models the "alarm path" as a spatiotemporal sequence for reconstruction (Wang, C., and Cui, B., 2025. An attack scenario reconstruction technology based on alert correlation analysis, CNSSE '25: Proceedings of the 2025 5th International Conference on Computer Network Security and Software Engineering, 374-379). However, the above methods usually assume a unified IP semantics and time base, without considering the vehicular communication topology and vehicle kinematics, thus making it difficult to directly adapt to the cross-subsystem attack chain reconstruction requirements of the vehicular environment. Summary of the Invention

[0007] The purpose of this invention is to address the following technical problems existing in current vehicle network alarm tracing and source identification: Inconsistent semantic descriptions and field formats of IDS alarms generated by different subsystems (Host, Automotive Ethernet, Controller Area Network (CAN)) make consistent cross-subsystem modeling difficult; significant differences in time granularity and arrival delays between alarms from different subsystems make simple time-based sorting or aggregation prone to false or missed associations; existing alarm association methods often lack vehicle communication topology constraints and vehicle kinematic context constraints, easily generating physically impossible or structurally unreachable "pseudo-attack chains," making it difficult to clearly and stably reconstruct multi-stage attack paths and support vehicle-side threat localization and forensic analysis. This invention provides a method for reconstructing cross-subsystem attack chains in vehicle networks based on IDS alarm tracing and source identification.

[0008] The technical problem to be solved by this invention is: without changing the vehicle communication protocol and the existing functions of the ECU, how to establish a unified and comparable event representation based solely on multi-subsystem IDS alarms and vehicle status information, and how to constrain the alarms in terms of time, topology, semantics and kinematics within an online sliding window, thereby constructing a maintainable alarm tracing graph and extracting multi-stage attack chains across subsystems to achieve clear and interpretable tracing and attribution.

[0009] To solve the above technical problems, the present invention adopts the following technical solution: a method for reconstructing cross-subsystem attack chains in vehicular networks based on intrusion detection system (IDS) alarm tracing, comprising the following steps: (1) Event preprocessing and buffer alignment IDS alarms from the host, automotive Ethernet, and CAN subsystem are collected. The IDS alarms are then subjected to structured parsing and semantic normalization. A sliding time window and circular buffer mechanism are used for time alignment and out-of-order tolerance. Vehicle kinematic state parameters are added to the normalized alarm events to form a unified standardized event stream, providing consistent input for subsequent link generation.

[0010] (2) Link generation and verification On the gateway electronic control unit (ECU), candidate event pairs are generated for the standardized event stream within the sliding time window, and the candidate event pairs are verified in sequence according to the time window constraint, the vehicle communication topology reachability constraint, the semantic compatibility constraint and the vehicle kinematic consistency constraint; only the event pairs that pass the verification are established with directed association edges, and the association edge set is incrementally updated and expired is removed within the sliding window to form an alarm tracking graph that can be maintained online.

[0011] (3) Attack chain extraction and output A directed acyclic subgraph satisfying temporal monotonicity and topological connectivity is extracted from the alarm tracking graph to generate a set of multi-stage attack chains across subsystems. The attack chains are then structured, labeled, and output for use by the vehicle safety management, threat localization, and forensic analysis modules.

[0012] Further, step (1) includes the following sub-steps: (1.1) Alarm collection and semantic normalization Raw IDS alarms are obtained from the host, vehicle Ethernet, and CAN subsystems. Based on their respective data dictionaries, unified semantic mapping is performed to obtain a standardized event set. Among them, CAN subsystem alarms are parsed with the DBC (CAN Database Description File) provided by the OEM to obtain functional-level semantic tags by parsing message identifiers and signal information. Host subsystem alarms are mapped to standard semantic tags based on entity fields such as processes, files, or sockets. Vehicle Ethernet subsystem alarms form standard semantic tags based on communication endpoints, session, and service metadata.

[0013] (1.2) Buffer window alignment and context enhancement Each subsystem is configured with a circular buffer and a sliding time window. The standardized events are processed with window-based time alignment and out-of-order tolerance. The comparable timing of events is unified by the window boundary. At least one of the vehicle speed, acceleration, steering angle, braking state, AEB state, and torque request state is added to the standardized events as vehicle kinematic state parameters to obtain a context-enhanced standardized event stream.

[0014] (1.3) Rules and Structure Preset Pre-set the vehicle communication topology information, semantic compatibility relationship and vehicle kinematic consistency rules for link determination, initialize the windowed event index structure and alarm tracking graph data structure, and provide a unified source of constraints for candidate generation and verification in step (2).

[0015] Furthermore, step (2) includes the following sub-steps: (2.1) Generation of candidate events For the current event within the sliding time window, retrieve the preceding events within the window that satisfy the preset time constraints to form a set of candidate event pairs.

[0016] (2.2) Candidate association verification and edge construction For each event pair in the candidate event pair set, vehicle communication topology reachability verification, semantic compatibility verification, and vehicle kinematic consistency verification are performed sequentially. When the event pair passes the above verifications simultaneously, a directed association edge from the predecessor event to the current event is established in the alarm tracking graph, and the rule entries that pass the verification and the necessary context summary are recorded.

[0017] (2.3) Incremental update and expiration removal The current event and its verified directed associated edges are incrementally added to the alarm tracking graph, and expired event nodes and their associated edges that exceed the sliding time window are removed in order to control the graph size and maintain online maintenance capabilities.

[0018] (2.4) Link solidification and indexing The valid associated edges within the window are stored and indexed, and the source subsystem of the associated edge, the type of constraint that has passed the verification, and the summary field are recorded for quick querying and subsequent attack chain extraction.

[0019] Furthermore, step (3) includes the following sub-steps: (3.1) Candidate chain extraction In the alarm tracing graph, a directed acyclic subgraph is extracted according to time order and topological connectivity to form a set of candidate attack chains.

[0020] (3.2) Chain labeling and integration The candidate attack chains are labeled with their cross-subsystem coverage, rule verification pass status and context summary, and overlapping chains are merged or pruned to obtain a stable set of attack chains.

[0021] (3.3) Results Output and Integration It outputs a set of attack chains and their structured metadata, supporting integration with vehicle security management, alarm handling strategies, and forensic analysis modules.

[0022] To achieve the above objectives, the present invention also provides a device for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing, comprising one or more processors for implementing the above-described method for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing.

[0023] To achieve the above objectives, the present invention also provides an electronic device, including a memory and a processor, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-described method for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing.

[0024] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method for reconstructing cross-subsystem attack chains in vehicular networks based on IDS alarm tracing.

[0025] To ensure consistency in terminology and parameter meanings throughout the text, the key parameters used in this paper are defined as follows: The length of the sliding time window is denoted as... The maximum time difference threshold for allowing correlation between events from different subsystems is denoted as . The upper bound of the maximum allowed number of hops in topology reachability checks is denoted as . Semantic compatibility relationships are determined by a semantic compatibility matrix or a rule function. The set of vehicle kinematic state predicates is uniformly denoted as... (The entire text is for reference only) This set (representing the set) is used to perform vehicle kinematics consistency verification; when graph size constraints are used, the upper limits of node in-degree / out-degree are denoted as follows: and The minimum attack chain length threshold is denoted as... .

[0026] The technical solution of this invention can be summarized as follows: (1) A standardized event modeling and windowing alignment mechanism for vehicle heterogeneous subsystems is proposed. Through semantic normalization, buffer alignment and vehicle kinematic context enhancement, a unified and comparable standardized event flow is constructed. (2) A link generation and verification method combining time constraints, vehicle communication topology reachability constraints, semantic compatibility constraints and vehicle kinematic consistency constraints is proposed, and the alarm tracking graph is incrementally maintained and expired is removed within a sliding window; (3) A process for extracting and structured outputting attack chains across subsystems is proposed. By extracting directed acyclic subgraphs from alarm tracing graphs and integrating them with annotations, interpretable tracing and source tracing results can be generated and the system can be connected.

[0027] Compared with the prior art, the present invention has at least the following beneficial effects: (1) By performing unified semantic normalization and windowed time alignment on IDS alarms of multiple subsystems, comparable event streams can be formed without relying on strict synchronization of the global clock, thereby reducing false associations caused by time granularity differences and arrival jitter. (2) By introducing topological reachability constraints for vehicle communication and combining semantic compatibility relationships, gating and delimiting candidate associations can effectively eliminate pseudo links that are topologically unreachable or functionally incompatible, thereby improving the structural credibility of attack chain reconstruction. (3) By using the vehicle's kinematic state as context and a set of kinematic predicates Consistency verification can suppress physically impossible correlations and improve the physical feasibility and interpretability of attack chains; (4) Through the incremental update and expired removal mechanism in the sliding window, the alarm tracking graph can be kept under control and online maintenance and continuous tracking and tracing can be supported on the gateway side; (5) This invention relies solely on existing IDS alarms and vehicle status data to reconstruct cross-subsystem attack chains, making it easy to adapt to different vehicle models and platforms through DBC and host / Ethernet metadata, and has good engineering deployability. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the overall process of the present invention, showing the end-to-end process of input data (IDS alarms and vehicle status of Host / Ethernet / CAN) through step (1) event preprocessing and buffer alignment, step (2) link generation and verification (constructing alarm tracing graph), and step (3) attack chain extraction and output, to obtain a set of cross-subsystem attack chains. Figure 1 The "unified semantic label" refers to unifying the alarm types (rule name / rule number) triggered by rules in various subsystems into a unified "alarm type identifier".

[0029] Figure 2 This diagram illustrates the topology constraints and event localization of in-vehicle communication, showing the connection relationships between the Host domain, Ethernet domain, and CAN domain through the gateway ECU, as well as event localization. With topological reachability determination Its role in link verification. Topological reachability is used to determine... arrive Does there exist a policy constraint that satisfies the number of hops and does not exceed 100? Allowed paths; policy constraints may include VLAN / ACL / diagnostic pass-through, etc.

[0030] Figure 3 This is a schematic diagram of the edge admission check, showing candidate event pairs. The order of constraint checks when establishing associated edges is as follows: time constraints, topological reachability, semantic compatibility, and kinematic consistency; a directed edge is established only if all four constraints pass. And write it into the alarm tracking graph. . Figure 3 The meanings of the parameters are as follows: The length of the sliding window; For subsystems Maximum allowable time difference between associations; This is the upper bound of the maximum number of hops in the topology; For semantic compatibility determination; This is the set of predicates for the vehicle's kinematic state.

[0031] Figure 4 (a) Stage 1 of the alarm tracing graph construction example shows a small number of standardized event nodes that newly enter within a sliding window and the initial associated edges established through verification, illustrating the basic process of "incremental graph construction". Figure 4(a) Only a small number of nodes and edges are shown as an example; the actual system uses a sliding window. Internal alarm tracking graph Perform incremental maintenance and remove expired items. Figure 4 (b) Phase 2 of the alarm tracing graph construction example shows the new edges established after adding downstream events, verified by time / topology / semantics / kinematic rules, and presents the "final DAG and extraction attack chain" in the same graph.

[0032] Figure 5 This is a diagram illustrating the structured fields of the attack chain output, showing the set of output attack chains. The summary information field is used for vehicle-mounted processing and evidence collection integration.

[0033] Figure 6 This is a schematic diagram of the structure of the device of the present invention.

[0034] Figure 7 This is a schematic diagram of an electronic device according to the present invention. Detailed Implementation

[0035] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0036] To enable those skilled in the art to clearly and completely understand and implement this invention, the overall deployment, input and output, key data structures, step-by-step operation flow, and related symbol parameters of the method are described in detail below, in conjunction with the technical concept of this invention. The scope of protection of this invention is not limited to the following embodiments; any equivalent substitutions made to the order of steps, parameter values, and data structure implementation details without departing from the concept of this invention should fall within the scope of protection of this invention.

[0037] Explanation of terms and symbols To avoid ambiguity, this article uses a unified terminology for the same thing and explains each parameter that appears in the formula; the same parameter represents only one meaning throughout the article.

[0038] 1. IDS Alarms: Raw alarm records output by the intrusion detection systems of each subsystem.

[0039] 2. Standardized Events: Structured events obtained after semantic normalization, time alignment, and context enhancement of IDS alarms, denoted as... .

[0040] 3. Standardized Event Flow: A standardized sequence of events ordered by the gateway reference time, denoted as... .

[0041] 4. Alarm Tracking Graph: A directed graph maintained within a sliding time window, where nodes are standardized events and edges represent the sequential relationships verified by rules, denoted as... .

[0042] 5. Vehicle Communication Topology: A constraint diagram describing the connection relationship between the vehicle's ECU and the media, denoted as... .

[0043] 6. : No. A standardized event, uniformly represented as in Used as an event identifier; For the event source subsystem domain (Host / Automotive Ethernet / CAN); To unify semantic tags; For gateway reference timestamps (aligned unified time); For topological positioning; For event attributes and evidence fields; This is the vehicle's kinematic state vector.

[0044] 1. : event A unified timestamp (gateway reference time) is used for windowed maintenance and causal order determination.

[0045] 2. : Length of the sliding time window (in seconds), with the window endpoint at the current reference time. time .

[0046] 3. Subsystem pair The maximum associated delay threshold (in seconds) is used to limit the time difference that can be associated.

[0047] 4. Topological constraint graph, where For a set of nodes (Host / ECU / Gateway). This is a collection of communication media / switching domains (HOST pseudo-media, CAN bus segment, ETH switching domain). This is the set of connecting edges.

[0048] 5. The upper bound of the maximum hop count for a topological path, used to determine the hop count of reachable paths.

[0049] 6. Semantic compatibility determination function / matrix, when Semantic tags and Allow for dependencies between preceding and following relationships.

[0050] 7. Vehicle kinematic state predicate set (used consistently throughout the text) express), ; For the first A kinematic consistency rule.

[0051] 8. The upper limit of the in-degree / out-degree of each event node in the graph, used to suppress forks and control the graph size (optional parameter).

[0052] 9. The minimum number of edges required for a valid attack chain, used to filter out chains that are too short.

[0053] System Deployment and Input / Output In one embodiment, the present invention is deployed on the ECU side of the vehicle gateway and connected to the alarm output interfaces of three types of subsystems, including the host subsystem, the automotive Ethernet subsystem, and the controller area network subsystem (CAN). The input of the present invention is the IDS alarms and vehicle status data of the three types of subsystems; the output is a set of cross-subsystem attack chains and their structured digest information.

[0054] 1. Input: Original IDS alarms (Host / Ethernet / CAN) and vehicle kinematics status data (such as vehicle speed, acceleration, steering angle, AEB / braking status, torque request status, etc.).

[0055] 2. Output: Attack chain set Each chain It is a time-monotonic sequence of events or a list of edges, with subsystem coverage, time span, rule entries passed, and summary fields.

[0056] The method flow of this invention strictly satisfies "step (1) outputs a standardized event flow". This serves as the input for step (2); step (2) outputs the alarm tracking graph. The end-to-end link relationship, which serves as the input for step (3), avoids the problem of fragmented and unimplementable technical solutions.

[0057] Preliminary preparations: Vehicle communication topology modeling and event topology localization To ensure the structural interpretability of cross-subsystem link generation, this invention establishes vehicle communication topology constraints and provides event topology localization capabilities before link generation.

[0058] Vehicle communication topology constraint diagram The vehicle communication structure is abstracted into a two-part constraint diagram. ,in For the set of computing / control nodes, For communication media / switching domains, This sets up the connection edges; and configures policy attributes (such as VLAN / ACL / diagnostic pass-through constraints) and optional cost attributes (such as hop count / delay upper bound) for each edge.

[0059] Event topology location function Define topological location functions for standardized events : 1. Host event: Locates the corresponding ECU's Host node based on process / file / socket ownership; 2. CAN Events: Combining the message ID / signal name obtained from DBC parsing with the gateway routing information, locate the possible set of transmitting / receiving ECUs; 3. Ethernet Events: Based on endpoint, session, and service metadata, locate the set of ECU / gateway nodes participating in the session.

[0060] Location results As an input field for subsequent topological reachability verification, it, along with time constraints, semantic compatibility, and kinematic consistency, determines whether to allow the establishment of associated edges.

[0061] Topological reachability determination (hop count bound) Define a topological reachability determination function Used to determine in the topological graph Does the above satisfy the policy constraint and have a hop count not exceeding 100? Path: in Indicates from arrive An allowed path exists; otherwise, no. And directly remove the event pair.

[0062] Methodology: Attack chain reconstruction based on alarm tracing graph This invention proposes a method for reconstructing cross-subsystem attack chains in vehicle networks based on IDS alarm tracing and source tracing. Its implementation includes the following steps: step (1) event preprocessing and buffer alignment; step (2) link generation and verification; step (3) attack chain extraction and output.

[0063] Step (1): Event preprocessing and buffer alignment Step (1) Complete the unified modeling and windowing alignment of alarms on the gateway ECU side, and output the standardized event flow. This serves as the sole input for step (2). This step includes the following sub-steps: (1.1) Alarm collection and semantic normalization Raw IDS alarms are obtained from the Host, Automotive Ethernet, and CAN subsystems respectively, and mapped to unified semantic tags according to their respective data dictionaries. .in: 1. CAN Alarm: The message ID and signal are parsed using the DBC provided by the OEM to obtain the functional-level semantic tag; 2. Host Alerts: Mapping entity fields such as processes, files, and sockets to standard semantic tags; 3. Ethernet Alerts: Based on endpoint, session, service identifier, and payload metadata, they are mapped to standard semantic tags.

[0064] After normalization, event candidate records with unified semantic fields are generated.

[0065] (1.2) Time alignment and sliding window organization Each alarm is assigned a unique timestamp, using the gateway reference clock as the unified time base. And organize the events into a sliding window. Define the set of events within the window: in For window length, This serves as the current reference time. This windowed organization allows alarms from different subsystems to be compared within the same timeframe, providing a unified criterion for subsequent "time constraints."

[0066] (1.3) Buffer Management and Kinematic Context Enhancement A circular buffer is configured for each subsystem to temporarily store events within a window; events exceeding the window are evicted to ensure online maintainability. Additionally, a vehicle kinematic state vector is attached to each event. ,For example: in For vehicle speed, For acceleration / deceleration, For steering angle, In braking state, It is in AEB status. For torque request status (the above components can be cropped based on vehicle-available data; but...) The meaning remains consistent throughout the text.

[0067] (1.4) Output of topology location field Based on the topology model in the preliminary preparation Parsing information to perform event calculations And write the event metadata so that topology reachability verification can be performed in step (2).

[0068] (1.5) Anomaly and Degradation Strategies When the semantic dictionary is missing or encrypted traffic makes some fields unavailable, a degradation mapping strategy is adopted (e.g., replacing fine-grained semantics with endpoint pairs, directionality and session liveness features); when there are multiple candidates for topology positioning, a limited number of candidates are retained and further converged in the topology determination in step (2); when the buffer is overloaded, events with higher security importance or stronger correlation with existing chains are retained first to ensure the stability of link reconstruction.

[0069] (1.6) Output Interface Output by Standardized event stream for sorting , as input for step (2); thus, the unified representation and alignment of "from original alarm to associative event" is completed.

[0070] Step (2): Link generation and verification (building an alarm tracing graph) Step (2) Perform candidate association generation and rule verification on standardized events within the sliding window. Only establish directed association edges for event pairs that simultaneously satisfy "time constraints, topological reachability, semantic compatibility, and kinematic consistency", thereby forming an alarm tracking graph. This step includes the following sub-steps: (2.1) Generation of candidate event pairs (time constraints) For any event pair within the window The requirements are that the time sequence and maximum delay constraints must be met first: in For subsystems The maximum association delay threshold (in seconds) is used only to limit the time difference that can be associated, and its meaning remains unique throughout the text.

[0071] (2.2) Topological reachability verification For candidate event pairs that pass the time constraint, calculate (See the preliminary preparation section). If If the event is not specified, the event will be excluded and will not proceed to subsequent verification.

[0072] (2.3) Semantic compatibility verification For candidate event pairs that pass topological verification, based on the unified semantic compatibility matrix / rules Verification required: in Indicates permission Formation of phased evolution or functional / protocol compatibility relationships; This indicates that it is not allowed and will be removed.

[0073] (2.4) Vehicle kinematic consistency verification (predicate set) (This is the only way to express it) For candidate event pairs that pass semantic verification, based on the vehicle kinematic state predicate set Perform consistency verification: in For a single kinematic consistency rule, for example, for "braking-related events", it can constrain the deceleration / braking state / AEB state to meet the expected range within a certain time; for "steering-related events", it can constrain the relationship between steering angle change and vehicle speed change to meet the vehicle dynamic feasibility. Throughout the text, only the "set of kinematic state predicates" is used, and no other symbols are used to represent the same set.

[0074] (2.5) Admission determination and edge construction of related edges The above four types of constraints are combined into an associated edge admission decision function: when At that time, a system is established in the alarm tracking graph consisting of... point to Directed associative edges And record the rule entries (time / topology / semantics / kinematics) and necessary context summary of the edge; when The border should not be built at this time.

[0075] (2.6) Incremental update and expired removal (window pruning) With reference time The process involves incrementally adding newly entered events and their associated edges that have passed the admission process; and removing expired event nodes and their associated edges that have exceeded the window. in This only indicates the length of the sliding time window; the exclusion rules remain consistent throughout the text.

[0076] (2.7) Bifurcation control (optional: degree constraint) To suppress excessive forking and ensure graph interpretability, an in-degree / out-degree cap can be applied to each node. When the in-degree of a node exceeds At that time, priority should be given to preserving the time difference. Smaller, less topologically hop-count associated edges; when the out-degree exceeds The same principle applies to cutting. The text only indicates "upper limit".

[0077] At this point, step (2) outputs the alarm tracking graph. , as input for step (3).

[0078] Step (3): Attack chain extraction and output Step (3) in the alarm tracking graph Extract directed acyclic subgraphs that satisfy temporal order and connectivity, form a set of attack chains, and output them. This step includes the following sub-steps: (3.1) Root node identification and candidate subgraph generation Within the window, identify nodes with an in-degree of zero or those pointed to only by nodes outside the window as the root node set, and construct candidate connected subgraphs by traversing along the directed edges in monotonic time order. Since step (2) only allows By constructing edges in the direction of the tracing graph, the time directionality is naturally satisfied, which facilitates subsequent DAG extraction.

[0079] (3.2) Acyclicity and Conflict Resolution If structural conflicts occur during implementation due to repeated alarms or edge pruning strategies, loop detection is performed and conflicting edges are removed according to the principle of "prioritizing the retention of edges with smaller time differences, fewer topological hops, and more rule entries", so that the output subgraph is a directed acyclic structure.

[0080] (3.3) Determination of chain validity Impose validity constraints on the obtained candidate directed acyclic subgraphs: the chain length must be at least 1. (Counted by the number of edges), and satisfying the cross-subsystem coverage requirement. Define a chain. The set of covered subsystems is The validity of the chain is determined as follows: in Indicates the number of edges in the chain. The minimum number of edges threshold, This refers to the set of subsystems involved in the chain (Host / Automotive Ethernet / CAN).

[0081] (3.4) Chain annotation and summary output For each valid attack chain, a structured result is output, including: the chain's time span, the set of subsystems involved, the root event and the termination event, the edge count, and the rule entry label (time / topology / semantics) for each edge. When the window slides and the chain is not yet closed, its current form is preserved and it continues to expand incrementally in subsequent windows, enabling continuous tracking and tracing of ongoing attacks.

[0082] Example: Offline tracing and source tracking deployment In another embodiment, the present invention is deployed on a general-purpose computing platform to reconstruct historical alarm logs offline. The inputs are IDS alarm logs from the Host, Automotive Ethernet, and CAN subsystems, as well as vehicle status logs. A standardized event stream is generated according to step (1). Construct an alarm tracing graph according to step (2). Then, following step (3), extract and output the attack chain for post-event auditing, forensic analysis, and parameter analysis. , , and Offline calibration.

[0083] Corresponding to the aforementioned embodiments of the method for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing, the present invention also provides embodiments of a device for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing.

[0084] See Figure 6 The vehicular network cross-subsystem attack chain reconstruction device based on IDS alarm tracing and source tracing provided in this embodiment includes one or more processors for implementing the vehicular network cross-subsystem attack chain reconstruction method based on IDS alarm tracing and source tracing in the above embodiment.

[0085] The embodiment of the vehicular network cross-subsystem attack chain reconstruction device based on IDS alarm tracing and source identification, as described in this invention, can be applied to any device with data processing capabilities, such as a computer. The device embodiment can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution. From a hardware perspective, such as... Figure 6The diagram shown is a hardware structure diagram of any device with data processing capabilities, used for the vehicle network cross-subsystem attack chain reconstruction device based on IDS alarm tracing and source tracing according to the present invention. (Except for...) Figure 6 In addition to the processor, memory, network interface, and non-volatile memory shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0086] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0087] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0088] Corresponding to the aforementioned embodiments of the vehicular network cross-subsystem attack chain reconstruction method based on IDS alarm tracing, this application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the vehicular network cross-subsystem attack chain reconstruction method based on IDS alarm tracing as described above. Figure 7 The diagram shown is a hardware structure diagram of any device with data processing capabilities for the reconstruction method of cross-subsystem attack chain of vehicular network based on IDS alarm tracing provided in this application embodiment, except for... Figure 7 In addition to the processor, memory, DMA controller, disk, and non-volatile memory shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0089] Corresponding to the aforementioned embodiments of the method for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing, this embodiment of the invention also provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the method for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing in the above embodiments.

[0090] The computer-readable storage medium can be an internal storage unit of any data processing device described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be any data processing device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0091] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0092] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A method for reconstructing cross-subsystem attack chains in vehicular networks based on IDS alarm tracing, characterized in that, Includes the following steps: (1) Event preprocessing and buffer alignment: IDS alarms from the host subsystem, vehicle Ethernet subsystem and CAN subsystem are collected, the IDS alarms are semantically normalized, and time alignment is performed through the buffer window mechanism. At the same time, vehicle kinematic state parameters are added to the normalized alarm events to form a unified standardized event flow. (2) Link generation and verification: On the gateway electronic control unit (ECU), candidate associations are generated for event pairs in the standardized event stream within the sliding time window. The candidate associations are verified based on time window constraints, vehicle communication topology reachability constraints, semantic compatibility constraints, and vehicle kinematic consistency constraints. Directed association edges are established for the verified event pairs. Incremental updates and expired removal are performed on the association edge set to form an alarm tracking graph. (3) Attack chain extraction and output: Extract a directed acyclic subgraph that satisfies the time order monotonicity and topological connectivity from the alarm tracing graph, generate a multi-stage attack chain set across subsystems, and output the attack chain set as the tracing result.

2. The method for reconstructing cross-subsystem attack chains in vehicular networks based on IDS alarm tracing and source identification as described in claim 1, characterized in that, Step (1) includes the following sub-steps: (1.1) Alarm collection and semantic normalization: The original IDS alarms are obtained from the host subsystem, the vehicle Ethernet subsystem and the CAN subsystem respectively, and the semantics are uniformly mapped according to their respective data dictionaries. Among them, the CAN subsystem alarms are parsed by parsing the message identifier and signal information through the CAN database description file DBC provided by the original equipment manufacturer to obtain the functional level semantic label. The host subsystem alarms are mapped to standard semantic labels based on entity fields such as process, file or socket. The vehicle Ethernet subsystem alarms are mapped to standard semantic labels based on communication endpoint, service identifier, session information or payload metadata. (1.2) Buffer window alignment and context enhancement: Configure a circular buffer and a sliding time window for each subsystem to complete window-based time alignment, and retain or eliminate buffer overflow scenarios according to preset priority rules. At the same time, attach at least one of vehicle speed, acceleration, steering angle, automatic emergency braking (AEB) status, braking status or torque request status as kinematic state parameters to the alarm event to obtain a standardized event with context enhancement. (1.3) Rules and structure pre-setting: Pre-set the vehicle communication topology information, semantic compatibility relationship and vehicle kinematic consistency rules for link determination, and initialize the data structure for incremental construction and maintenance of alarm tracking graph.

3. The method for reconstructing cross-subsystem attack chains in vehicular networks based on IDS alarm tracing and source identification as described in claim 2, characterized in that, Step (2) includes the following sub-steps: (2.1) Generation of candidate event pairs: Select the current event within the sliding time window and retrieve the predecessor events within the window that satisfy the preset time constraints to form a set of candidate event pairs; (2.2) Candidate association verification and edge construction: For each event pair in the candidate event pair set, the vehicle communication topology reachability verification, semantic compatibility verification and vehicle kinematic consistency verification are performed in sequence. When the event pair passes the above verification at the same time, a directed association edge from the predecessor event to the current event is established in the alarm tracking graph. (2.3) Incremental update and expired removal: The current event and its verified directed associated edges are incrementally added to the alarm tracking graph, and expired event nodes and their related edges that exceed the sliding time window are removed to control the graph size. (2.4) Subgraph output: Output a snapshot of the tracking subgraph within the sliding time window for subsequent attack chain extraction.

4. The method for reconstructing cross-subsystem attack chains in vehicular networks based on IDS alarm tracing and source identification as described in claim 3, characterized in that, Step (3) includes the following sub-steps: (3.1) Candidate attack chain construction: Identify the root event node in the alarm tracing graph and traverse along the directed associated edges in chronological order to construct a candidate connected subgraph; (3.2) Acyclic processing: Cycle detection is performed on the candidate connected subgraphs, and the associated edges that cause cycles are deleted according to the preset conflict resolution rules to obtain a directed acyclic subgraph; (3.3) Chain validity determination: Apply minimum length constraints and cross-subsystem coverage constraints to the directed acyclic subgraph to filter out valid attack chains; (3.4) Chain labeling and output: Label the effective attack chains with the information of the subsystems involved, the time span, and the rule labels of the related edges that have passed the verification, and output the attack chain set.

5. A device for reconstructing cross-subsystem attack chains in vehicular networks based on IDS alarm tracing, characterized in that, It includes one or more processors for implementing the method for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing as described in any one of claims 1-4.

6. An electronic device comprising a memory and a processor, characterized in that, The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the method for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing and source tracing as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method for reconstructing cross-subsystem attack chains of vehicular networks based on IDS alarm tracing as described in any one of claims 1-4.

Images