Automobile network security processing method, system and device and storage medium
By analyzing and cleaning abnormal data from intelligent connected vehicles, using multiple analysis models to identify hacker attacks and calculate risk levels, and selecting appropriate handling strategies, the problem of not being able to distinguish the degree of threat in existing technologies has been solved, thereby improving the efficiency of network security processing and data protection capabilities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-30
- Publication Date
- 2026-03-31
AI Technical Summary
In existing technologies, cybersecurity processing methods for intelligent connected vehicles cannot differentiate and process abnormal data in a timely manner based on its threat level, resulting in potential threats not being responded to in a timely manner, which may lead to information leakage or security incidents.
By acquiring abnormal data, we analyze and clean it, and use rule analysis, correlation analysis, statistical analysis and AI analysis models to determine whether it is data from a hacker attack, calculate the risk assessment level, and select the appropriate processing strategy based on the level.
It enables responses and processing at different times based on the level of threat, avoiding the impact of high-threat abnormal data on vehicle safety and improving the efficiency of network security processing and data protection capabilities.
Smart Images
Figure CN121770764A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of intelligent connected vehicle protection, specifically relating to a method, system, device and storage medium for automotive network security processing. Background Technology
[0002] Intelligent connected vehicles assist drivers by employing a domain-centralized electronic and electrical architecture installed within the vehicle. This architecture divides the vehicle into functional blocks, each led by a domain controller. Communication within each functional domain utilizes different types of communication buses based on the required communication speeds for different functions. Communication between functional domains is achieved through Ethernet, which offers higher transmission speeds. A diagram of this domain-centralized electronic and electrical architecture is shown in the figure. The domain controller is primarily responsible for transmitting communication between the domain and the cloud, between domains, and within the domain itself. The ECUs within a domain are only responsible for executing commands for their respective actuators and can be controlled using controllers with communication capabilities. Communication within the vehicle and between the vehicle and external systems is vulnerable to cyberattacks, potentially leading to data theft and serious consequences.
[0003] In related technologies, network security for intelligent connected vehicles mainly involves vehicle manufacturers receiving abnormal data during the operation of intelligent connected vehicles, sorting the received abnormal data according to the time of receipt, and then processing the abnormal data according to the sorting order.
[0004] The aforementioned technologies sort the received abnormal data by time, but cannot distinguish the importance of the abnormal data to the vehicle. Some abnormal data may pose a serious threat to the vehicle's operational safety or the leakage of personal information, but due to the waiting time, it cannot be processed in a timely manner, resulting in information leakage or security incidents. Summary of the Invention
[0005] The technical problem to be solved by the present invention is to provide a method, system, device and storage medium for automotive network security processing, which can respond to and process abnormal data at different times according to the different threat levels, so as to avoid high-threat abnormal data from threatening the vehicle.
[0006] A method for handling automotive cybersecurity includes:
[0007] Acquire abnormal data received by the car;
[0008] The abnormal data was analyzed to determine its source.
[0009] The abnormal data is cleaned to obtain cleaned data;
[0010] The cleaned data is input into a preset analysis model to determine whether the cleaned data is hacker attack data. The preset analysis model includes one or more of the following: rule analysis model, correlation analysis model, statistical analysis model, and AI analysis model.
[0011] If the cleaned data is hacker attack data, then calculate the attack risk assessment level of the abnormal data source;
[0012] Select the corresponding treatment strategy based on the risk assessment level.
[0013] Optionally, acquiring the abnormal data received by the vehicle includes:
[0014] Retrieve the car's message queue;
[0015] Based on the message queue, threat warning information, anomaly record information, and vulnerability warning information are extracted from the message queue as the anomaly data.
[0016] Optionally, the analysis of the abnormal data to determine the sources of the abnormal data includes:
[0017] Extract keywords from the abnormal data;
[0018] The source of the abnormal data is determined by matching the keywords from the keyword database.
[0019] Optionally, the calculation of the risk assessment level of the abnormal data source after the attack includes:
[0020] Obtain the device weight of the abnormal data source and the path weight of the transmission path to the abnormal data source;
[0021] Based on the device weight and path weight, the risk assessment level of the abnormal data source being attacked is calculated.
[0022] Optionally, the device weights for obtaining the source of abnormal data include:
[0023] The asset value of the abnormal data source is obtained, which includes the value of personal information and hardware assets that would affect the safety of the entire vehicle after being attacked.
[0024] The device weights of abnormal data sources are obtained based on the value of the personal information and the value of the hardware assets.
[0025] Optionally, selecting the corresponding processing strategy based on the risk assessment level includes:
[0026] Determine whether the risk assessment level is the highest level;
[0027] If the risk assessment level is the highest, the isolation procedure shall be initiated immediately;
[0028] If the risk assessment level is not the highest level, then the corresponding processing strategy is selected according to the risk assessment level.
[0029] Optionally, the step of selecting the corresponding processing strategy based on the risk assessment level includes:
[0030] Based on the risk assessment level, the response time and the analysis time for the abnormal data are obtained;
[0031] The response time and the analysis time are used as the processing strategy.
[0032] A vehicle network security processing system, comprising:
[0033] The acquisition module is used to acquire abnormal data received by the vehicle;
[0034] The analysis module is used to analyze the abnormal data and determine the source of the abnormal data;
[0035] The cleaning module is used to clean the abnormal data to obtain cleaned data;
[0036] The judgment module is used to input the cleaned data into a preset analysis model to determine whether the cleaned data is hacker attack data. The preset analysis model includes one or more of the following: rule analysis model, correlation analysis model, statistical analysis model, and AI analysis model.
[0037] An evaluation module is used to calculate the risk assessment level of the source of the abnormal data if the cleaned data is hacker attack data.
[0038] The monitoring module is used to select the corresponding processing strategy based on the risk assessment level.
[0039] A terminal device includes a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads and executes the computer program, it employs a vehicle network security processing method.
[0040] A computer-readable storage medium storing a computer program, which, when loaded and executed by a processor, employs a method for handling automotive network security.
[0041] The beneficial effects of this invention are as follows: After receiving abnormal data, the abnormal data is analyzed to identify the components involved in the abnormal data intrusion. The abnormal data is then cleaned and input into a preset analysis model to determine whether the abnormal data is from a hacker attack. If it is, the risk assessment level is calculated based on the source and transmission path of the abnormal data and its impact on the components. The vehicle manufacturer adopts different processing strategies based on the risk assessment level. The higher the risk assessment level, the shorter the response time and processing time, thus avoiding the impact on vehicle operation safety or the leakage of important information due to excessively long waiting times for abnormal data with high risk assessment levels. Attached Figure Description
[0042] Figure 1 This is a flowchart illustrating a method for handling automotive network security according to the present invention. Detailed Implementation
[0043] A method for handling automotive network security, such as Figure 1 As shown, the present invention includes:
[0044] S100: Obtain abnormal data received by the vehicle.
[0045] Specifically, abnormal data refers to intrusion data into the car from the outside. Abnormal data may affect the normal driving of the car and steal data stored in the car.
[0046] S110. Analyze the abnormal data to find the source of the abnormal data.
[0047] Specifically, the source of abnormal data refers to the parts of the vehicle that are attacked by abnormal data, including different components inside the vehicle and the control center.
[0048] S120. Perform data cleaning on the abnormal data to obtain cleaned data.
[0049] Specifically, cleaning outlier data includes checking and deleting duplicate records to ensure that each data point is unique and avoids interference with the analysis results; identifying missing values in the data and taking appropriate measures, such as imputation (using the mean and median, etc.) or deletion of missing records, to ensure data integrity; and standardizing the data format.
[0050] S130. Input the cleaned data into the preset analysis model to determine whether the cleaned data is hacker attack data. The preset analysis model includes one or more of the following: rule analysis model, correlation analysis model, statistical analysis model, and AI analysis model.
[0051] Specifically, the rule-based analysis model detects security threats by filtering abnormal records from log data through trigger rules. The data source can be either raw logs or abnormal records. Rule expressions support multi-level nesting to ensure strict adherence to trigger conditions. Rule analysis should output information such as security alert name, threat level, alert type, and attack chain stage.
[0052] Correlation Analysis Model: Correlation analysis performs field and logical associations on multi-source data and historical data to discover advanced threats and security risks hidden in related events. It enables the elimination of false alarms, inference of event sources, and redefinition of security event levels. It supports both horizontal and vertical correlation of security events. Horizontal correlation enables the analysis of multi-source data, combining alarm data from multiple devices and raw data to discover latent advanced threats that single-point detection cannot detect. Vertical correlation enables the analysis of historical data, combining historical data to discover persistent latent threats.
[0053] Statistical analysis models: Statistical analysis collects statistics on the characteristics of security events and behaviors, calculates the quantitative characteristics of various events and behaviors such as status, frequency, and occurrence cycle, and obtains the distribution, main characteristics, time series trends, existence of outliers, and event summary results of event data. Simultaneously, threshold filtering identifies abnormal indicators, enabling the detection of malicious behaviors such as brute-force attacks and port scanning. Statistical analysis can be directly used for event nature determination, interpretation, and decision-making.
[0054] AI Analysis Model: The AI learning model incorporates multiple cluster learning algorithm prototypes, including time series algorithms, classification algorithms, and clustering algorithms. It can learn and analyze any indicator data, continuously build and update baseline information, adaptively detect anomalies and deviations, and enhance the ability to detect unknown threats.
[0055] The cleaned data is input into a preset analysis model for data analysis and comparison. Based on the analysis results of the preset analysis model, it is determined whether the cleaned data is hacker attack data.
[0056] S140. If the cleaned data is data from a hacker attack, calculate the risk assessment level of the source of the abnormal data being attacked.
[0057] Specifically, the risk assessment level of an attack on a source of abnormal data is determined by the degree to which the attacked components would affect the overall vehicle safety or the importance of the leaked personal information. A higher risk assessment level indicates a greater impact on vehicle safety or more significant leaked personal information.
[0058] S150. Select the corresponding treatment strategy based on the risk assessment level.
[0059] Specifically, the handling strategy is as follows: after discovering that the abnormal data is hacker attack data and assessing the risk level of the abnormal data, the vehicle company's response time and processing time for the abnormal data are as follows: the response time is the initial acceptance time of the abnormal data after receiving it, and the processing time is the time within which the vulnerability analysis and repair of the abnormal data are completed.
[0060] In one embodiment of this example, step S100, which involves acquiring the abnormal data received by the vehicle, includes:
[0061] S200, retrieve the car's message queue.
[0062] S210. Based on the message queue, extract threat warning information, anomaly record information, and vulnerability warning information as anomaly data from the message queue.
[0063] Specifically, in the data receiving phase, a message queue is a system used for asynchronous data transfer, allowing for efficient communication and data transfer between different systems or components. The main function of a message queue is to pass messages or data between multiple systems or applications so that appropriate processing can be performed upon receiving events or data.
[0064] Abnormal data includes threat warnings, abnormal logs, and vulnerability warnings. Data that does not conform to normal vehicle operation can also be extracted from the original logs as abnormal data.
[0065] In one embodiment of this example, step S110 involves analyzing the abnormal data to determine the sources of the abnormal data, including:
[0066] S300, Extract keywords from abnormal data.
[0067] Specifically, keyword matching refers to the analysis of various received data (such as threat warnings, anomaly records, raw logs, vulnerability warnings, etc.) to identify information related to specific keywords. The main purpose of this process is to efficiently filter and locate records related to potential threats or attacks. Keywords include vehicle model, parts, and user identifiers.
[0068] S310. Match the keywords from the keyword database to obtain the source of the abnormal data.
[0069] Specifically, the keyword database stores records that identify specific events, objects, or users, including preset keywords such as vehicle models, parts, and user identifiers.
[0070] The system matches keywords against a keyword database. If a match is found, it can determine which type of vehicle and which part the abnormal data likely pertains to. For example, upon receiving an alert message: "Vehicle model XYZ, parts ABC exhibit an abnormality," the system will extract "Vehicle model XYZ" and "parts ABC" from the message and compare them against predefined keywords (such as a specific vehicle model or parts list). If a match is found, the information regarding vehicle model XYZ and parts ABC will be input into the threat detection phase.
[0071] In one embodiment of this example, step S140, which calculates the risk assessment level of the source of the abnormal data after it has been attacked, includes:
[0072] S400: Obtain the device weight of the abnormal data source and the path weight of the transmission path to the abnormal data source.
[0073] Specifically, component weight represents the importance of a component to vehicle security or personal information after being attacked, while path weight evaluates which interfaces or communication channels an attacker can use to enter the ECU (Electronic Control Unit). ECUs are devices in modern cars used to control various electronic systems. Identifying attack paths helps assess the cybersecurity vulnerabilities of each ECU and pinpoint critical risk points. By understanding which paths could lead to the most severe consequences, security teams can prioritize addressing the most risky components.
[0074] S410. Calculate the risk assessment level of the source of abnormal data being attacked based on the device weight and path weight.
[0075] Specifically, the risk assessment level is obtained by multiplying the device weight by the path weight. If a device is reached by multiple paths, the average value is used as the final result. Each risk assessment level has a preset range. The value within the preset range represents the calculated value by multiplying the device weight by the path weight. The risk assessment level can be obtained by taking the range of each risk assessment level corresponding to the calculated value.
[0076] In one embodiment of this example, step S400, which involves obtaining the device weight of the abnormal data source, includes:
[0077] S500: Obtain the asset value of the abnormal data source. The asset value includes the value of personal information and hardware assets that would affect the safety of the entire vehicle after an attack.
[0078] Personal information refers to data related to an individual's identity, which may be stored, processed, or transmitted in a vehicle's electronic systems. In a car, personal information may include: driver identification information such as name, address, and contact information; vehicle usage information including driving habits, driving routes, and service history; user preference settings such as seat adjustments, audio settings, and navigation history; and payment information: if the vehicle supports online payments or stores credit card information, it may store payment-related data. If this information falls into the wrong hands, it could lead to privacy breaches or even financial fraud.
[0079] Hardware asset value refers to the physical components of a vehicle's electronic systems, whose security directly affects the vehicle's functionality and safety. If an attacker gains control of a critical ECU, it could lead to serious consequences such as loss of vehicle control and accidents.
[0080] S510: Based on the value of personal information and the value of hardware assets, obtain the device weight of the abnormal data source.
[0081] Specifically, the device weight is obtained by comprehensively evaluating the value of personal information and the value of hardware assets. This can be done by assigning different weights to the value of personal information and the value of hardware assets, or by using a preset weight table to digitize the value of personal information and the value of hardware assets, and then looking up the corresponding device weight in the weight table using the values of personal information and hardware assets.
[0082] In one embodiment of this example, step S150, which involves selecting the corresponding processing strategy based on the risk assessment level, includes:
[0083] S600, Determine whether the risk assessment level is the highest level.
[0084] Specifically, the highest level is the level that poses a serious threat to vehicle operation or is related to important personal information.
[0085] S610. If the risk assessment level is the highest level, the isolation procedure shall be initiated immediately.
[0086] S620. If the risk assessment level is not the highest level, then select the corresponding treatment strategy according to the risk assessment level.
[0087] Specifically, if the risk assessment level is the highest, an isolation procedure will be initiated first to attempt to isolate the attack data, and then the vehicle manufacturer will handle it immediately. If it is not the highest level, different responses will be made according to the corresponding handling strategy.
[0088] In one embodiment of this example, step S150, which involves selecting the corresponding processing strategy based on the risk assessment level, includes:
[0089] S700: Based on the risk assessment level, the response time and the analysis time for abnormal data are obtained.
[0090] S710, Response time and analysis time are used as processing strategies.
[0091] Specifically, in cases other than the highest level, after receiving the risk assessment level corresponding to the anomaly, the vehicle manufacturer needs to respond to the received anomaly data. The response time is the time when the normal company receives the anomaly data and begins to take action on it, and the analysis time is the time required to analyze the anomaly data.
[0092] Risk assessment levels are categorized as low, medium, high, and highest. At a low risk level, the vehicle manufacturer is required to respond within 72 hours, complete vulnerability analysis within 14 days, and complete remediation within 90 days. At a medium risk level, the vehicle manufacturer is required to respond within 48 hours, complete vulnerability analysis within 5 days, and complete remediation within 14 days. At a high risk level, the vehicle manufacturer is required to respond within 24 hours, complete vulnerability analysis within 48 hours, and complete remediation within 7 days.
[0093] This application also discloses a terminal device, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads and executes the computer program, it employs a vehicle network security processing method.
[0094] The terminal device can be a computer device such as a desktop computer, a laptop computer, or a cloud server. The terminal device includes, but is not limited to, a processor and a memory. For example, the terminal device may also include input / output devices, network access devices, and buses.
[0095] The processor can be a central processing unit (CPU). Of course, depending on the actual use, it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc., and this application does not limit it in this regard.
[0096] The memory can be an internal storage unit of the terminal device, such as a hard disk or RAM of the terminal device, or an external storage device of the terminal device, such as a plug-in hard disk, smart memory card (SMC), secure digital card (SD), or flash memory card (FC) equipped on the terminal device. Furthermore, the memory can be a combination of internal storage units and external storage devices of the terminal device. The memory is used to store computer programs and other programs and data required by the terminal device. The memory can also be used to temporarily store data that has been output or will be output. This application does not limit this.
[0097] In this terminal device, a vehicle network security processing method from the above embodiments is stored in the terminal device's memory and loaded and executed on the terminal device's processor for convenient use.
[0098] This application also discloses a computer-readable storage medium, which stores a computer program, wherein when the computer program is executed by a processor, it employs a vehicle network security processing method described in the above embodiments.
[0099] The computer program can be stored in a computer-readable medium. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or certain middleware. The computer-readable medium includes any entity or device capable of carrying computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the computer-readable medium includes, but is not limited to, the above-mentioned components.
[0100] The above-described automotive network security processing method is stored in the computer-readable storage medium and loaded and executed on the processor to facilitate the storage and application of the method.
[0101] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of protection of this application is limited to these examples; under the concept of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of one or more embodiments of this application as described above, which are not provided in detail for the sake of brevity.
[0102] One or more embodiments in this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of this application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments in this application should be included within the protection scope of this application.
Claims
1. A method for automotive network security processing, characterized by, The method comprises the following steps: acquiring abnormal data received by a vehicle; analyzing the abnormal data to obtain an abnormal data source; cleaning the abnormal data to obtain cleaned data; inputting the cleaned data into a preset analysis model to determine whether the cleaned data is hacker attack data, wherein the preset analysis model comprises one or more of a rule analysis model, a correlation analysis model, a statistical analysis model, and an AI analysis model; if the cleaned data is hacker attack data, calculating a risk evaluation level of the abnormal data source after being attacked; selecting a corresponding processing strategy according to the risk evaluation level.
2. The automotive network security processing method of claim 1, wherein, The step of acquiring abnormal data received by a vehicle comprises the following steps: acquiring a message queue of the vehicle; extracting threat warning information, abnormal record information, and vulnerability warning information from the message queue as the abnormal data according to the message queue.
3. The automotive network security processing method of claim 1, wherein, The step of analyzing the abnormal data to obtain an abnormal data source comprises the following steps: extracting a keyword of the abnormal data; matching the keyword with a keyword database to obtain the abnormal data source.
4. The automotive network security processing method of claim 1, wherein, The step of calculating a risk evaluation level of the abnormal data source after being attacked comprises the following steps: acquiring a device weight of the abnormal data source and a path weight of a transmission path to the abnormal data source; calculating the risk evaluation level of the abnormal data source after being attacked according to the device weight and the path weight.
5. The automotive network security processing method of claim 4, wherein the security processing is performed by the security processing unit. The step of acquiring a device weight of the abnormal data source comprises the following steps: acquiring an asset value of the abnormal data source, wherein the asset value is a personal information value and a hardware asset value that will affect the safety of the vehicle after being attacked; obtaining the device weight of the abnormal data source according to the personal information value and the hardware asset value.
6. The automotive network security processing method of claim 1, wherein, The step of selecting a corresponding processing strategy according to the risk evaluation level comprises the following steps: determining whether the risk evaluation level is the highest level; if the risk evaluation level is the highest level, immediately starting an isolation program; if the risk evaluation level is not the highest level, selecting a corresponding processing strategy according to the risk evaluation level.
7. The automotive network security processing method of claim 1, wherein, The step of selecting a corresponding processing strategy according to the risk evaluation level comprises the following steps: obtaining a response time and an analysis time of the abnormal data according to the risk evaluation level; using the response time and the analysis time as the processing strategy.
8. An automotive cyber security processing system, characterized by, The method comprises the following steps: an acquiring module for acquiring abnormal data received by a vehicle; an analysis module for analyzing the abnormal data to obtain an abnormal data source; a cleaning module for cleaning the abnormal data to obtain cleaned data; a judgment module for inputting the cleaned data into a preset analysis model to determine whether the cleaned data is hacker attack data, wherein the preset analysis model comprises one or more of a rule analysis model, a correlation analysis model, a statistical analysis model, and an AI analysis model; an evaluation module for calculating a risk evaluation level of the abnormal data source after being attacked if the cleaned data is hacker attack data; a monitoring module for selecting a corresponding processing strategy according to the risk evaluation level. 9.A terminal device, comprising a memory and a processor, characterized in that, The memory stores a computer program capable of running on the processor, and the processor loads and executes the computer program to adopt the processing method in any one of claims 1 to 7.
10. A computer-readable storage medium having stored therein a computer program, characterized in that, The computer program is loaded and executed by the processor to adopt the processing method in any one of claims 1 to 7.