Vehicle-mounted ECU information security risk identification mechanism based on edge calculation

Abstract

The invention relates to the technical field of intelligent network connection automobile information safety, in particular to a vehicle-mounted ECU information safety risk identification mechanism based on edge calculation. The method comprises the following steps: deploying a lightweight edge security node at a vehicle key ECU or gateway, collecting multi-source data in real time, and forming a time sequence data vector; based on historical normal data, an EWMA algorithm is adopted to establish a dynamically updated ECU behavior baseline, and time sequence, frequency and load features are extracted to form a comprehensive feature vector; an anomaly score is calculated through a mahalanobis distance, and lightweight anomaly detection is realized in combination with a dynamic threshold value; performing collaborative analysis among the nodes to obtain a collaborative risk score, and triggering a grading response; and incremental updating of the model is realized through Mini-batchSGD, and adaptability is guaranteed in cooperation with a baseline drift calibration mechanism. According to the invention, low-delay, high-precision and self-adaptive safety risk identification in a vehicle-mounted environment is realized, the resource occupation is low, the reliability is high, various vehicle-mounted network attacks are effectively resisted, and the driving safety is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of intelligent connected vehicle information security technology, specifically to an edge computing-based mechanism for identifying information security risks of in-vehicle ECUs. Background Technology

[0002] With the rapid development of intelligent connected vehicles, the number of onboard electronic control units (ECUs) continues to increase. Vehicle internal networks (such as CAN, LIN, and Ethernet) carry a large number of critical control commands and data exchanges, becoming the core support for the normal operation of vehicles. However, the openness and complexity of onboard networks have led to increasingly diverse and complex security threats. Attack methods such as denial-of-service attacks, replay attacks, and malicious injection attacks are emerging one after another, seriously threatening driving safety and the lives and property of drivers and passengers.

[0003] To address the aforementioned security risks, various in-vehicle information security protection solutions have been proposed in existing technologies. One such solution involves introducing cloud-based security analytics into the in-vehicle system. This involves collecting vehicle operational data and uploading it to the cloud for centralized analysis to identify potential threats. An example is the anomaly detection method based on cloud-based big data analysis disclosed in the paper "Design of Cloud Protection System for Information Security of Intelligent Connected Vehicles." However, such cloud-based solutions are highly dependent on network connectivity, resulting in unavoidable communication delays, making it difficult to meet the stringent real-time requirements of in-vehicle security scenarios.

[0004] Another common approach is to deploy a dedicated security chip or hardware security module inside the vehicle to achieve static encryption and authentication of communication data, such as the technical solution disclosed in patent CN108234132A. However, hardware security solutions have poor scalability, making it difficult to flexibly adjust protection strategies when facing rapidly evolving new attack methods, and hardware upgrades are costly.

[0005] In addition, there are local intrusion detection systems based on rule matching, which use a pre-set rule base to match and detect CAN messages to identify anomalies. However, the rule base of such systems relies on manual updates and cannot adaptively learn new attack patterns, resulting in insufficient ability to identify unknown attacks. At the same time, centralized detection mechanisms can easily become performance bottlenecks when the vehicle's internal network load is high, affecting detection efficiency and normal vehicle operation.

[0006] Edge computing, a technology that pushes computing power down to the network edge, enables local computation and data processing close to the data source, providing a new technical approach to solving the real-time and adaptability issues in vehicle information security. Therefore, there is an urgent need for an edge computing-based mechanism for identifying information security risks in vehicle ECUs to overcome the shortcomings of existing technologies. Summary of the Invention

[0007] The purpose of this invention is to provide an edge computing-based mechanism for identifying information security risks of vehicle ECUs, which solves the problems of poor real-time performance, insufficient adaptability, high resource consumption, and susceptibility to single points of failure in existing vehicle security protection solutions, and achieves low-latency, highly adaptive, lightweight, and highly reliable identification and protection of ECU information security risks in the vehicle environment.

[0008] Technical Solution: To achieve the above-mentioned objectives, this invention provides a mechanism for identifying information security risks of in-vehicle ECUs based on edge computing, comprising: [S1] Edge security node deployment: Deploy lightweight edge security nodes with independent computing and storage capabilities at key ECUs or gateways inside the vehicle; [S2] Multi-source data acquisition: The multi-source data acquisition module collects vehicle internal network data streams, ECU status information, and external communication interface data in real time to form a time-series data vector. As shown in Formula 1; Formula 1: ; in, t For timestamps, n For feature dimensions; [S3] Behavioral Modeling and Feature Extraction: Establishing a baseline model of ECU behavior based on historical normal communication data; [S3.1] Behavioral baseline modeling: For the first... i Each ECU, its feature vector sequence under normal behavior Modeled as a dynamic baseline The exponentially weighted moving average (EWMA) is used for online updates to reflect the slow evolution of ECU behavior, as shown in Equation 2: Formula 2: ; Among them, As a smoothing factor, For the first i Each ECU t Dynamic baseline at any given time, For the first i Each ECU t− The dynamic baseline at time 1; [S3.2] Feature Extraction: Simultaneously extract time-series features, frequency features, and load features to form a comprehensive feature vector. ; [S4] Lightweight anomaly detection, using a lightweight machine learning model for real-time analysis; [S4.1] Anomaly score calculation: Current observed feature vector With dynamic baseline The Mahalanobis distance is used as the anomaly score, and the anomaly score The calculation method is shown in Formula 3: Formula 3: ; in This is an estimate of the characteristic covariance matrix calculated based on historical normal data; [S4.2] Risk assessment, setting dynamic thresholds ,in As the baseline threshold, This is the load impact factor. Current network load rate, when When this occurs, it is judged as abnormal behavior; [S5] Collaborative Identification and Response: Information sharing and collaborative analysis are performed among edge security nodes. When a node... j When an anomaly is detected but the confidence level is insufficient, the signal is sent to neighboring nodes. k Broadcast anomaly rating and related characteristics, receiving node k Calculate the verification score based on its own model. A collaborative risk score is derived through weighted consensus. As shown in Formula 4: Formula 4: ; Among them, weight With nodes m The historical detection accuracy is positively correlated, and according to The numerical range triggers a graded response, such as an alarm, message rate limit, or source ECU logic isolation. [S6] Online Model Update: For samples identified as false positives or novel attacks, their feature vectors and labels are added to the local training set, and the parameters of the lightweight model are updated using Mini-batch SGD. As shown in Formula 5: Formula 5: ; in For learning rate, For loss function, For the new sample feature vector, New sample labels are provided; a baseline drift calibration mechanism is also introduced, if continuous... N One cycle If the baseline remains high but no coordinated response is triggered, the baseline update will be temporarily frozen and a global verification will be initiated.

[0009] Furthermore, the key ECUs inside the vehicle mentioned in step [S1] include the powertrain control system ECU and the chassis control system ECU deployed in the vehicle.

[0010] Furthermore, the multi-source data acquisition module described in step [S2] supports synchronous acquisition of CAN bus, LIN bus and Ethernet data.

[0011] Further, the smoothing factor described in step [S3.1] The value ranges from 0.1 to 0.3, and it is used to balance the weight of historical information and current observations.

[0012] Furthermore, the timing characteristics described in step [S3.2] include the message transmission period. The frequency characteristics include the number of messages per unit time. The load characteristics include message data entropy. .

[0013] Furthermore, the lightweight machine learning model described in step [S4] includes logistic regression, lightweight support vector machine, or shallow neural network, with the model parameter size controlled within 1000 to adapt to the resource-constrained environment of the vehicle.

[0014] Further, the triggering condition for the hierarchical response described in step [S5] is: when When an alarm is triggered, When the message rate limit is triggered, Time-triggered source ECU logic isolation, where .

[0015] Further, the learning rate described in step [S6] The value ranges from 0.001 to 0.01. The loss function is optimized through gradient descent to achieve adaptive adjustment of model parameters.

[0016] Furthermore, in the baseline drift calibration mechanism described in step [S6] N The value is set to 5-10 cycles to avoid abnormal baseline drift caused by continuous attacks.

[0017] The beneficial effects of this invention are: 1. The edge computing-based vehicle ECU information security risk identification mechanism provided by this invention achieves local data collection, processing and detection by deploying edge security nodes at key ECUs or gateways inside the vehicle. It does not rely on cloud transmission and centralized analysis, significantly reducing detection latency and meeting the real-time requirements of vehicle security scenarios. 2. The edge computing-based vehicle ECU information security risk identification mechanism provided by this invention can adapt to the slow evolution of ECU behavior and new attack patterns through dynamic baseline online update and model incremental learning mechanism, without the need for manual intervention to update the rule base, effectively improving the ability to identify unknown attacks. 3. The edge computing-based vehicle ECU information security risk identification mechanism provided by this invention adopts lightweight edge security nodes and lightweight machine learning models, with the model parameter scale controlled within 1000, adapting to the vehicle resource-constrained environment and avoiding performance impact on normal vehicle operation. 4. The edge computing-based vehicle ECU information security risk identification mechanism provided by this invention extracts multi-dimensional comprehensive features, uses Mahalanobis distance to calculate anomaly scoring and a node collaborative identification mechanism, and fully considers the complementarity of feature correlation and multi-node detection results, thereby improving the accuracy and reliability of anomaly identification. 5. The edge computing-based vehicle ECU information security risk identification mechanism provided by this invention avoids the single-point failure risk of centralized detection mechanisms through its distributed edge node deployment architecture. The hierarchical response strategy can flexibly adjust protective measures according to the risk level, minimizing the impact on normal vehicle operation while ensuring safety. Detailed Implementation

[0018] The principles and features of the present invention are described below. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0019] ECU stands for Electronic Control Unit. It is the core control module in electronic systems such as intelligent connected vehicles and industrial equipment. It is often referred to as "on-board computer" or "electronic brain" (specifically in the context of vehicles).

[0020] CAN / LIN communication modules are controller area network (CAN) / local interconnect network (LAN) communication modules. They are the "communication hubs" responsible for data transmission in automotive electronics and are specifically adapted to the two mainstream bus protocols in automotive scenarios. CAN: Controller Area Network, is a high-priority data transmission bus inside a car (such as engine status, anti-theft verification results, and anti-pinch trigger signals). It is characterized by high transmission speed (up to 1 Mbit / s in this patent), strong anti-interference ability, and support for simultaneous communication of multiple devices.

[0021] LIN: Short for Local Interconnect Network, it is a low-priority data transmission bus (such as window open / close status, instrument display signals). It is characterized by its simple structure and low cost, and serves as a supplement to the CAN bus, reducing wiring harness complexity.

[0022] PCB stands for Printed Circuit Board. It is the core "skeleton" and "nerve center" of electronic devices. It is used to carry and fix electronic components (such as chips, resistors, capacitors, inductors, etc.) and realize the electrical connection between components through the metal wires printed on the board, so that the electronic circuit forms a complete functional system.

[0023] Example 1: This example provides a vehicle ECU information security risk identification mechanism based on edge computing, applied to the security protection of the power control system ECU and chassis control system ECU of a certain type of intelligent connected vehicle. The specific implementation process is as follows: [S1] Edge security node deployment: Three lightweight edge security nodes are deployed at the vehicle power control system ECU, chassis control system ECU and vehicle gateway respectively. Each node is equipped with an ARM Cortex-M7 processor and 128MB flash memory, with independent computing and storage capabilities, and supports local data processing and model running.

[0024] [S2] Multi-source data acquisition: A multi-source data acquisition module collects real-time data streams from the vehicle's internal network, ECU status information, and external communication interface data. This module supports simultaneous acquisition of data from CAN bus, LIN bus, and Ethernet, ensuring comprehensive and compatible data acquisition. The collected data is then processed to form a time-series data vector. As shown in Formula 1: Formula 1: ; in, t A timestamp, used to mark the time point of data collection; n The feature dimension refers to the number of features in the collected data. The multi-source data acquisition module synchronously acquires data streams from the CAN bus, LIN bus, and Ethernet, including ECU control commands, sensor data, and network communication messages. It also acquires ECU operating status information (such as operating temperature and voltage) and external communication interface data (such as vehicle network communication data), forming a timing data vector. The timestamp t The acquisition interval is 10ms, and the feature dimension is... n= 12 (including 12 features such as message ID, data length, transmission time, and sensor values).

[0025] [S3] Behavioral Modeling and Feature Extraction: Based on historical normal communication data, an ECU behavioral baseline model is established, and multi-dimensional features are extracted to form a comprehensive feature vector. The specific steps include: [S3.1] Behavioral baseline modeling: For the first... i Each ECU, its feature vector sequence under normal behavior Modeled as a dynamic baseline This dynamic baseline reflects the normal operating behavior pattern of the ECU. To adapt to the slow evolution of ECU behavior, an exponentially weighted moving average (EWMA) is used to update the dynamic baseline online, and the update formula is shown in Formula 2: Formula 2: ; Among them, This is a smoothing factor, ranging from 0.1 to 0.3, used to balance the weights of historical information and current observations. The larger the value, the more significant the impact of the current observation on the baseline; For the first i Each ECU t Dynamic baseline at any given time, For the first i Each ECU t− The dynamic baseline at time 1; Historical communication data from 24 consecutive hours under normal vehicle driving conditions was selected as training data to establish the initial behavioral baseline for each ECU. A smoothing factor was set. The dynamic baseline is updated online according to Formula 2 to reflect changes in ECU behavior in real time. For example, the baseline of the powertrain control system ECU at the initial moment. It was trained based on normal data from the first hour, and then updated every 10ms based on newly collected data. Update the baseline once .

[0026] [S3.2] Feature Extraction: From time-series data vectors Extract the following features, including time-series features: message sending period. (Statistical analysis of the time interval between two consecutive message transmissions); Frequency characteristics: Number of messages per unit time. (Total number of messages sent per minute); Load characteristics: Message data entropy (Information entropy is calculated based on message data fields). The above three types of features are then fused to form a comprehensive feature vector. (Dimensions are 3).

[0027] [S4] Lightweight Anomaly Detection: Logistic regression is selected as a lightweight machine learning model (with 200 parameters) and deployed on various edge security nodes: [S4.1] Anomaly score calculation: Calculate the current observed feature vector. With dynamic baseline The Mahalanobis distance is used as an anomaly score. Mahalanobis distance can take into account the correlation between features and is more sensitive to the identification of abnormal behavior than Euclidean distance. The calculation method is shown in Formula 3: Formula 3: ; Calculate the feature covariance matrix based on historical normal data. The current comprehensive feature vector is calculated based on Formula 3. With dynamic baseline The Mahalanobis distance is used to obtain anomaly scores. ; [S4.2] Risk Assessment: Set dynamic thresholds The formula for calculating the dynamic threshold is used to determine whether the current behavior is abnormal. ,in The baseline threshold is determined based on historical normal data statistics; This is the load impact coefficient, used to adjust the degree to which network load affects the threshold. Current network load rate; when When the current ECU behavior is determined to be abnormal, the lightweight machine learning model includes logistic regression, lightweight support vector machine or shallow neural network, and the model parameter scale is controlled within 1000 to adapt to the vehicle resource-constrained environment and ensure the real-time and efficiency of the detection process. Set baseline threshold Load Influence Coefficient Based on the current network load rate (Real-time statistics of network bandwidth utilization) Dynamically adjust thresholds For example, when hour, ,like If so, it is judged as abnormal behavior.

[0028] [S5] Collaborative Identification and Response: The accuracy of anomaly identification is improved through information sharing and collaborative analysis among edge security nodes, and a graded response is executed according to the risk level. The specific process is as follows: When the edge safety node corresponding to the power control system ECU detects an anomaly However, when the confidence level is insufficient, the abnormal score and feature information are broadcast to the edge safety node and vehicle gateway node corresponding to the chassis control system ECU; the receiving node calculates the verification score based on its own model, assuming the verification score of the chassis control system ECU node. Verification score of vehicle gateway node .

[0029] Weights are determined based on the historical detection accuracy rates of each node (92% accuracy rate for the powertrain control system node, 90% accuracy rate for the chassis control system node, and 95% accuracy rate for the gateway node). , , Calculate the collaborative risk score according to Formula 4: ; Set graded response thresholds , , ,because This triggers a message rate limiting response, limiting the message sending rate of the power control system ECU to 50% of the normal rate.

[0030] [S6] Online Model Update: When an abnormal behavior is detected and manually confirmed to be a novel attack (true positive sample), the feature vector of the sample is updated. ( , , ) and labels (Abnormal) Add to local training set. Set learning rate. loss function L The cross-entropy loss function is used to update the parameters of the logistic regression model according to Formula 5, with each update batch consisting of 10 samples.

[0031] At the same time, set the number of cycles for baseline drift calibration. If abnormal scores occur within 8 consecutive cycles (80ms) All greater than If no coordinated response is triggered, the baseline update is temporarily frozen, and a global check is initiated on the three nodes to confirm whether it is a baseline drift.

[0032] Actual testing showed that the anomaly detection latency of this embodiment is less than 50ms, the accuracy rate of identifying denial-of-service attacks and malicious injection attacks reaches 98.5%, the CPU utilization rate during model operation is less than 15%, and the memory utilization rate is less than 20%, meeting the real-time and resource constraints requirements of the vehicle environment.

[0033] Example 2: The difference between this example and Example 1 is that a shallow neural network (2 hidden layers, 32 and 16 nodes respectively, and a parameter scale of 800) is selected as the lightweight machine learning model, with a smoothing factor... Learning rate Number of baseline drift calibration cycles The remaining parameters and implementation process are the same as in Example 1.

[0034] Tests showed that this embodiment achieved a 99.2% accuracy rate in identifying novel unknown attacks, with a detection latency of 60ms and a CPU utilization rate of less than 25%, making it suitable for vehicle security scenarios with high accuracy requirements.

[0035] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A mechanism for identifying information security risks of vehicle ECUs based on edge computing, characterized in that, Includes the following steps: [S1] Edge security node deployment: Deploy lightweight edge security nodes with independent computing and storage capabilities at key ECUs or gateways inside the vehicle; [S2] Multi-source data acquisition: The multi-source data acquisition module collects vehicle internal network data streams, ECU status information, and external communication interface data in real time to form a time-series data vector. As shown in Formula 1; Official 1: ; in, t For timestamps, n For feature dimensions; [S3] Behavioral Modeling and Feature Extraction: Establishing a baseline model of ECU behavior based on historical normal communication data; [S3.1] Behavioral baseline modeling: For the first... i Each ECU, its feature vector sequence under normal behavior Modeled as a dynamic baseline The exponentially weighted moving average (EWMA) is used for online updates to reflect the slow evolution of ECU behavior, as shown in Equation 2: Official 2: ; Among them, As a smoothing factor, For the first i Each ECU t Dynamic baseline at any given time, For the first i Each ECU t− The dynamic baseline at time 1; [S3.2] Feature Extraction: Simultaneously extract time-series features, frequency features, and load features to form a comprehensive feature vector. ; [S4] Lightweight anomaly detection, using a lightweight machine learning model for real-time analysis; [S4.1] Anomaly score calculation: Current observed feature vector With dynamic baseline The Mahalanobis distance is used as the anomaly score, and the anomaly score The calculation method is shown in Formula 3: Official 3: ; in This is an estimate of the characteristic covariance matrix calculated based on historical normal data; [S4.2] Risk assessment, setting dynamic thresholds ,in As the baseline threshold, This is the load impact factor. Current network load rate, when When this occurs, it is judged as abnormal behavior; [S5] Collaborative Identification and Response: Information sharing and collaborative analysis are performed among edge security nodes. When a node... j When an anomaly is detected but the confidence level is insufficient, the signal is sent to neighboring nodes. k Broadcast anomaly rating and related characteristics, receiving node k Calculate the verification score based on its own model. A collaborative risk score is derived through weighted consensus. As shown in Formula 4: Official 4: ; Among them, weight With nodes m The historical detection accuracy is positively correlated, and according to The numerical range triggers a graded response, such as an alarm, message rate limit, or source ECU logic isolation. [S6] Online Model Update: For samples identified as false positives or novel attacks, their feature vectors and labels are added to the local training set, and the parameters of the lightweight model are updated using Mini-batch SGD. As shown in Formula 5: Official 5: ; in For learning rate, For loss function, For the new sample feature vector, New sample labels are provided; a baseline drift calibration mechanism is also introduced, if continuous... N One cycle If the baseline remains high but no coordinated response is triggered, the baseline update will be temporarily frozen and a global verification will be initiated.

2. The edge computing-based vehicle ECU information security risk identification mechanism according to claim 1, characterized in that... Step [S1] The key ECUs inside the vehicle include the powertrain control system ECU and the chassis control system ECU deployed in the vehicle.

3. The edge computing-based vehicle ECU information security risk identification mechanism according to claim 1, characterized in that... Step [S2] The multi-source data acquisition module supports synchronous acquisition of CAN bus, LIN bus and Ethernet data.

4. The edge computing-based vehicle ECU information security risk identification mechanism according to claim 1, characterized in that... The smoothing factor mentioned in step [S3.1] The value ranges from 0.1 to 0.3, and it is used to balance the weight of historical information and current observations.

5. The edge computing-based vehicle ECU information security risk identification mechanism according to claim 1, characterized in that... The timing characteristics mentioned in step [S3.2] include the message transmission period. The frequency characteristics include the number of messages per unit time. The load characteristics include message data entropy. .

6. The edge computing-based vehicle ECU information security risk identification mechanism according to claim 1, characterized in that... The lightweight machine learning model described in step [S4] includes logistic regression, lightweight support vector machine or shallow neural network, and the model parameter size is controlled within 1000 to adapt to the limited in-vehicle resource environment.

7. The edge computing-based vehicle ECU information security risk identification mechanism according to claim 1, characterized in that... The triggering condition for the graded response in step [S5] is: when When an alarm is triggered, When the message rate limit is triggered, Time-triggered source ECU logic isolation, where .

8. The edge computing-based vehicle ECU information security risk identification mechanism according to claim 1, characterized in that... The learning rate mentioned in step [S6] The value ranges from 0.001 to 0.

01. The loss function is optimized through gradient descent to achieve adaptive adjustment of model parameters.

9. The edge computing-based vehicle ECU information security risk identification mechanism according to claim 1, characterized in that... In the baseline drift calibration mechanism described in step [S6] N The value is set to 5-10 cycles to avoid abnormal baseline drift caused by continuous attacks.