Abnormal behavior processing method, electronic equipment and vehicle

Abstract

The invention relates to an abnormal behavior processing method, electronic equipment and a vehicle, and is applied to the technical field of vehicles. The abnormal behavior processing method comprises the steps that under the condition that a resource access interface of a cabin operation system initiates an operation event, original data of the operation event is obtained through a safety monitoring program, and the safety monitoring program is mounted on a kernel layer of the cabin operation system; behavior monitoring is carried out on the operation event based on the original data through a safety protection process, a behavior monitoring result of the operation event is determined, and the safety protection process runs in a user layer of a cabin operation system; and under the condition that the behavior monitoring result is an abnormal behavior, processing the operation event through a security monitoring program or a security protection process. According to the method and the device, the problem of lack of effective interception capability for malicious behaviors of which the highest permission of the system is acquired is solved, and the processing real-time performance of abnormal behaviors and the effectiveness of cabin operating system protection are improved.

Description

Technical Field

[0001] This disclosure relates to the field of vehicle technology, and more particularly to a method for handling abnormal behavior, electronic devices, and vehicles. Background Technology

[0002] With the deepening development of automotive intelligence and connectivity, intelligent cockpit systems have evolved into complex computing platforms that integrate infotainment, vehicle control, and data interaction, making their security paramount.

[0003] In related technologies, protection against threats within the operating system mainly relies on signature-based antivirus programs or intrusion detection systems that perform post-incident analysis of system logs. However, these solutions typically run outside the operating system kernel, with monitoring and response occurring at the user level. When faced with malicious behavior occurring at the operating system kernel level and possessing the highest privileges (root), there is a lag in protection, resulting in a low ability to intercept malicious behavior. Summary of the Invention

[0004] To address the aforementioned technical problems, this disclosure provides a method for handling abnormal behavior, an electronic device, and a vehicle.

[0005] The first aspect of this disclosure provides a method for handling abnormal behavior, applied to a cockpit operating system. The method for handling abnormal behavior includes: When an operation event is initiated through the resource access interface of the cockpit operating system, the raw data of the operation event is obtained through a security monitoring program, which is mounted in the kernel layer of the cockpit operating system. Based on the raw data, a security protection process performs behavioral monitoring on the operation event to determine the behavioral monitoring result. The security protection process runs in the user layer of the cockpit operating system. If the behavioral monitoring result is abnormal behavior, the operation event is processed through the security monitoring program or the security protection process.

[0006] In some of the technical solutions disclosed herein, raw data of operational events are obtained through a security monitoring program, including: Obtain event information of the operation event, wherein the event information includes at least one of the following: the process identifier that initiated the operation event, the call identifier of the resource access interface, the call parameter information corresponding to the call identifier, and the operation result information returned by the resource access interface; perform structured processing on the event information to obtain raw data; wherein the resource access interface includes at least one of the following: process management interface, file access interface, permission management interface, and communication interface.

[0007] In some technical solutions disclosed herein, a security protection process monitors operational events based on raw data to determine the results of the operational event monitoring, including: Extract the target behavior features from the raw data; match the target behavior features with preset behavior features to determine the behavior monitoring results of the operation event.

[0008] In some technical solutions disclosed herein, the preset behavioral features include abnormal behavioral features, and the abnormal behavioral features include at least two abnormal behavioral features; the behavioral monitoring results of the operation event are determined by matching the target behavioral features with the preset behavioral features, including: Obtain the matching results between target behavior features and abnormal behavior features; if the target behavior features and abnormal behavior features match, determine the behavior monitoring result as abnormal behavior; if the target behavior features and abnormal behavior features do not match, determine the behavior monitoring result as normal behavior.

[0009] In some of the technical solutions disclosed herein, the preset behavioral characteristics include a normal behavioral baseline; The behavioral monitoring results of the operational event are determined by matching the target behavioral characteristics with preset behavioral characteristics, including: Obtain the deviation between the target behavioral characteristics and the normal behavioral baseline; if the deviation is greater than or equal to the deviation threshold, determine the behavior monitoring result as abnormal behavior; if the deviation is less than the deviation threshold, determine the behavior monitoring result as normal behavior.

[0010] In some of the technical solutions disclosed herein, operational events are processed through security monitoring programs or security protection processes, including: Operational events can be processed at the kernel level by a security monitoring program based on behavior monitoring results; or the process that initiated the operational event can be terminated at the user level by a security protection process.

[0011] In some of the technical solutions disclosed herein, operational events are processed at the kernel layer by a security monitoring program based on behavior monitoring results, including: Modify the return value of the resource access interface to cause the operation corresponding to the operation event to fail; or send a forced termination signal to the process that initiated the operation event at the kernel level to stop the process that initiated the operation event.

[0012] In some of the technical solutions disclosed herein, after the operational events are processed through security monitoring programs or security protection processes, the methods for handling abnormal behavior also include: The security monitoring program adds the process ID of the process that initiated the operation event to the kernel-level process restricted list.

[0013] A second aspect of this disclosure provides an apparatus for handling abnormal behavior, applied to a cockpit operating system, the apparatus comprising: The acquisition module is used to acquire the raw data of the operation event initiated by the resource access interface of the cockpit operating system through the security monitoring program, wherein the security monitoring program is mounted in the kernel layer of the cockpit operating system; the determination module is used to perform behavior monitoring on the operation event based on the raw data through the security protection process and determine the behavior monitoring result of the operation event, wherein the security protection process runs in the user layer of the cockpit operating system; the processing module is used to process the operation event through the security monitoring program or the security protection process if the behavior monitoring result is abnormal behavior.

[0014] In some technical solutions disclosed herein, the acquisition module is further used to acquire event information of the operation event, wherein the event information includes at least one of the following: the process identifier that initiated the operation event, the call identifier of the resource access interface, the call parameter information corresponding to the call identifier, and the operation result information returned by the resource access interface; The device for handling abnormal behavior also includes: The processing module is used to perform structured processing on event information to obtain raw data; the resource access interface includes at least one of the following: process management interface, file access interface, permission management interface, and communication interface.

[0015] In some of the technical solutions disclosed herein, the device for handling abnormal behavior further includes: The extraction module is used to extract the target behavior features from the raw data; the determination module is also used to match the target behavior features with preset behavior features to determine the behavior monitoring results of the operation event.

[0016] In some of the technical solutions disclosed herein, the preset behavioral characteristics include abnormal behavioral characteristics, and the abnormal behavioral characteristics include at least two abnormal behavioral characteristics; The acquisition module is also used to acquire the matching results between the target behavior features and the abnormal behavior features; the determination module is also used to determine the behavior monitoring result as abnormal behavior when the target behavior features and the abnormal behavior features match; the determination module is also used to determine the behavior monitoring result as normal behavior when the target behavior features and the abnormal behavior features do not match.

[0017] In some of the technical solutions disclosed herein, the preset behavioral characteristics include a normal behavioral baseline; The acquisition module is also used to acquire the deviation between the target behavioral characteristics and the normal behavioral baseline; the determination module is also used to determine the behavior monitoring result as abnormal behavior when the deviation is greater than or equal to the deviation threshold; the determination module is also used to determine the behavior monitoring result as normal behavior when the deviation is less than the deviation threshold.

[0018] In some of the technical solutions disclosed herein, the processing module is also used to process operation events at the kernel layer based on behavior monitoring results through a security monitoring program; or to terminate the initiating process of the operation event at the user layer through a security protection process.

[0019] In some of the technical solutions disclosed herein, the processing module is also used to modify the return value of the resource access interface to cause the operation corresponding to the operation event to fail; or to send a forced termination signal to the process that initiated the operation event at the kernel layer so that the process that initiated the operation event stops running.

[0020] In some of the technical solutions disclosed herein, the processing module is also used to add the process identifier corresponding to the process initiating the operation event to the process restricted list at the kernel level through a security monitoring program.

[0021] A third aspect of this disclosure provides an electronic device, comprising: a processor; and a memory for storing executable instructions; wherein the processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the abnormal behavior handling method described in the first aspect above.

[0022] A fourth aspect of this disclosure provides a vehicle that includes the electronic equipment described in the second aspect above.

[0023] The technical solution provided in this disclosure has the following advantages: By capturing raw data of operational events from resource access interfaces through a security monitoring program mounted at the kernel layer, the monitoring point is placed at the kernel-level resource access interface. This ensures that any operation attempting to access this interface cannot evade monitoring, guaranteeing the comprehensiveness of monitoring and the authenticity of the data. By deploying a security protection process at the user layer, which can monitor operational events based on raw data, the user layer leverages its powerful analytical capabilities to accurately determine the true data captured at the lower level, ensuring accurate identification. The security protection process can choose to handle abnormal operational events through either the kernel-level security monitoring program or the user-level security protection process based on the behavioral monitoring results. This allows the cockpit operating system to select the effective location for interception, ensuring that the defense action can combat malicious code with high privileges. This disclosure solves the problem of lacking effective interception capabilities against malicious behavior that has gained the highest system privileges. Kernel-level monitoring and response do not require multiple context switches and can intervene immediately, improving the real-time performance of abnormal behavior handling. By combining precise analysis at the user layer with reliable execution at the kernel layer, the effectiveness of cockpit operating system protection is improved. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0025] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this disclosure; Figure 2 This is a flowchart of a method for handling abnormal behavior provided in an embodiment of this disclosure; Figure 3 This is a schematic block diagram of a cockpit operating system provided in an embodiment of this disclosure; Figure 4 This is a schematic diagram of the structure of an abnormal behavior processing device provided in an embodiment of this disclosure; Figure 5 This is a structural block diagram of a vehicle provided in an embodiment of this disclosure. Detailed Implementation

[0027] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0028] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0029] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0030] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0031] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0032] In order to illustrate the technical solutions provided in the embodiments of this disclosure, some terms involved in the embodiments of this disclosure will be introduced below.

[0033] Cockpit Operating System: The system software that runs on the computing unit of the vehicle's intelligent cockpit domain and is responsible for managing the hardware resources in the cockpit (such as processors, memory, displays, and audio equipment) and providing services such as infotainment and vehicle control.

[0034] Resource access interface: refers to the standardized programming interface provided by the cockpit operating system kernel for user-level programs to access the core resources of the system, usually in the form of system calls.

[0035] Operation event: refers to a specific instance of resource access or operation request initiated through the resource access interface.

[0036] Kernel layer: refers to the software layer in the cockpit operating system that has the highest execution privileges and directly manages hardware and core resources.

[0037] User layer: refers to the software layer in the cockpit operating system that has restricted permissions and is used to run various applications.

[0038] In related technologies, protection against threats within the operating system primarily relies on user-level security software, such as signature-based antivirus programs or intrusion detection systems that perform post-incident analysis of system logs. These solutions typically operate outside the operating system kernel, identifying known threats by periodically checking files, processes, or analyzing log records.

[0039] However, the protective measures in related technologies have the following significant problems: user-level security software lacks real-time and effective interception capabilities for malicious acts with root privileges occurring at the operating system kernel level. Since monitoring and response both occur at the user level, it is impossible to block malicious system calls at the kernel level immediately upon their occurrence, resulting in delayed protection and difficulty in dealing with advanced threats such as fileless attacks and kernel-level threats, thus exposing the cockpit system to serious security risks.

[0040] The application scenarios of the embodiments of this disclosure are described below. See also... Figure 1 The application scenario of the abnormal behavior handling method provided in this embodiment includes a vehicle cockpit operating system 100. The cockpit operating system 100 adopts a classic layered architecture, which can be divided into a kernel layer 110 and a user layer 120 based on privileges and resource access permissions. A security monitoring program 111 is deployed in the kernel layer 110, and a security protection process 121 is deployed in the user layer 120. The security monitoring program 111 can monitor abnormal behavior in the kernel layer 110, and the security protection process 121 can handle abnormal behavior in the user layer 120.

[0041] After introducing the implementation environment and application scenarios of the embodiments of this disclosure, the technical solutions provided by the embodiments of this disclosure are described below. (See also...) Figure 2 The abnormal behavior handling method is applied to the vehicle's cockpit operating system. The vehicle is specifically an electric vehicle or a hybrid vehicle. Taking the vehicle as the executing entity, the abnormal behavior handling method includes the following steps.

[0042] S201. When an operation event is initiated through the resource access interface of the cockpit operating system, the raw data of the operation event is obtained through the security monitoring program.

[0043] The security monitoring program is mounted in the kernel layer of the cockpit operating system.

[0044] In this embodiment, an operation event is a specific instance of resource access or operation request initiated through a resource access interface. The security monitoring program is a program mounted in the kernel layer of the cockpit operating system, used to capture the raw data of the operation event at the kernel layer's resource access interface level.

[0045] Specifically, the security monitoring program is mounted on the critical resource access interface of the cockpit operating system. When an operation event is initiated through this interface, the security monitoring program is immediately triggered when the kernel executes the operation, capturing low-level information directly related to the event, such as the identity of the caller process, the specific interface called, and the parameters passed, and outputting this information as raw data. By obtaining tamper-proof event information from the highest privilege level and the lowest resource access interface of the cockpit operating system through the security monitoring program, an accurate and reliable data source is provided for subsequent analysis. Compared with related technologies that monitor at the user level, this avoids the defects of potential bypass or data forgery.

[0046] For example, the security monitoring program is an eBPF (Extended Berkeley Packet Filter program) program. The security monitoring program is loaded into the kernel layer and mounted at the hook mount point corresponding to the critical resource access interface.

[0047] S202. The operation event behavior is monitored based on the raw data through the security protection process, and the behavior monitoring results of the operation event are determined.

[0048] The security protection process runs in the user layer of the cockpit operating system.

[0049] In this embodiment, the security protection process is a user-level process running on the cockpit operating system, responsible for performing security analysis on the raw data captured by the security monitoring program.

[0050] Specifically, the security protection process running at the user layer receives raw data from the kernel layer. This process parses the raw data, extracts key behavioral features, and analyzes and matches these features according to preset security policies to determine the behavioral monitoring results of the operation event. The behavioral monitoring results determine whether the operation event is normal or abnormal. Leveraging the relatively ample computing resources and ease of implementing complex logic at the user layer, in-depth analysis of the raw data enables accurate identification of malicious behavior, including known attack patterns and unknown abnormal behaviors.

[0051] S203. In cases where the behavior monitoring results indicate abnormal behavior, the operational event shall be handled through a safety monitoring program or a safety protection process.

[0052] In this embodiment, when the behavior monitoring result indicates abnormal behavior, the operation event can be handled by either the kernel-level security monitoring program or the user-level security protection process. It is understood that, in different scenarios, either the security monitoring program or the security protection process can be chosen to handle the operation event determined to be abnormal behavior.

[0053] Specifically, for malicious processes that have gained root privileges, a security monitoring program mounted at the kernel level handles the process's operation events. Since the attacker has control of the kernel layer, any protection measures initiated from the user layer may be intercepted; therefore, the kernel-level security monitoring program eliminates the malicious process from within. When dealing with malicious processes that have not gained root privileges, a security protection process deployed at the user layer handles them.

[0054] In practical applications, the security protection process can determine abnormal behavior based on raw data. Depending on the threat level, type, target resources, and current system status of the abnormal behavior, it can choose to handle the operation event through a security monitoring program or a security protection process. This allows high-privilege malicious processes to be handled by the kernel-level security monitoring program, while low-privilege processes with complex cleanup processes are handled by the user-level privilege protection process. This enables the cockpit operating system to deal with kernel-level malicious processes and also to handle complex and low-privilege malicious processes.

[0055] In this embodiment, a security monitoring program mounted on the kernel layer captures the raw data of operation events at the resource access interface, placing the monitoring point at the kernel-level resource access interface. This ensures that any operation attempting to access this interface cannot evade monitoring, guaranteeing the comprehensiveness of the monitoring and the authenticity of the data. By deploying a security protection process at the user layer, which can monitor operation events based on raw data, the user layer leverages its powerful analytical capabilities to accurately determine the true data captured at the lower level, ensuring accurate identification. The security protection process can choose to handle abnormal behavior operation events through either the kernel-level security monitoring program or the user-level security protection process based on the behavior monitoring results. This allows the cockpit operating system to select an effective location for interception, ensuring that the defense action can counter malicious code with high privileges. This disclosure solves the problem of lacking effective interception capabilities against malicious behavior that has gained the highest system privileges. Kernel-level monitoring and response do not require multiple context switches and can intervene immediately, improving the real-time processing of abnormal behavior. By combining precise analysis at the user layer with reliable execution at the kernel layer, the effectiveness of cockpit operating system protection is enhanced.

[0056] In some embodiments of this disclosure, raw data of operational events are obtained through a security monitoring program, including: Obtain event information of the operation event, wherein the event information includes at least one of the following: the process identifier that initiated the operation event, the call identifier of the resource access interface, the call parameter information corresponding to the call identifier, and the operation result information returned by the resource access interface; perform structured processing on the event information to obtain raw data; wherein the resource access interface includes at least one of the following: process management interface, file access interface, permission management interface, and communication interface.

[0057] In this embodiment, the event information is information that the security monitoring program reads directly from the kernel layer context. This event information can characterize the underlying information of the entire operation event, thereby completely and accurately capturing all the key metadata of the operation event at the kernel layer of the operating system, providing a basis for subsequent analysis and judgment.

[0058] The following is a detailed explanation of the content in the event information: The process identifier (PID) is a unique identifier assigned to each process by the cockpit operating system kernel, distinguishing different execution entities within the cockpit operating system.

[0059] The call identifier for a resource access interface is an identifier used to distinguish the specific resource access interface being called.

[0060] The call parameter information corresponding to the call identifier is the specific data passed in when the operation event calls the resource access interface, which is used to characterize the operation details of the operation event.

[0061] The operation result information returned by the resource access interface is the result returned to the calling process after the resource access interface has completed the execution of the operation event.

[0062] In this embodiment, after the security monitoring program obtains event information, it performs structured processing on different types of event information, that is, it organizes and packages the information according to a predefined format and field order to obtain the original data in the corresponding data format. This encapsulates the scattered event information into a data packet with a fixed format, making the generated original data a data packet with a uniform format. The security protection process at the user level does not need to perform complex parsing operations on the original data.

[0063] In this embodiment of the disclosure, by obtaining event information of different categories at the kernel layer, the authenticity and completeness of the information captured from the kernel layer are improved. Furthermore, by performing structured processing on the event information of different categories, the obtained raw data is made into a standardized data format, which simplifies the parsing process of the user layer security protection process on the raw data. Thus, while ensuring that the security protection process can obtain the integrity of the raw data, it also simplifies the data processing logic at the user layer and improves the processing efficiency of the user layer.

[0064] In some embodiments of this disclosure, a security protection process performs behavioral monitoring of operational events based on raw data to determine the behavioral monitoring results of the operational events, including: Extract the target behavior features from the raw data; match the target behavior features with preset behavior features to determine the behavior monitoring results of the operation event.

[0065] In this embodiment, the target behavioral feature is a behavioral feature extracted from the raw data, which can characterize the behavioral intent of the corresponding operation event. The preset behavioral feature is a set of behavioral features that are predefined and stored in the security policy library, and is used as a comparison standard.

[0066] Specifically, after receiving raw data from the kernel layer, the security protection process running at the user layer first performs a feature extraction process to calculate more discriminative target behavior features from the raw data, thereby transforming the raw data into behavior features with security semantics. This provides a basis for judgment for subsequent policy-based behavior monitoring, enabling different operation events to be compared under the same semantic framework, thus improving the efficiency of subsequent judgments on whether the operation event belongs to abnormal behavior.

[0067] For example, the operation event is a file open event. In addition to recording the file path, the target behavior characteristics extracted by the security protection process include: "Process A attempts to write configuration files in a critical directory of the operating system during non-working hours".

[0068] In this embodiment, after the security protection process obtains the target behavioral characteristics, it matches these characteristics with preset behavioral characteristics. The matching process includes, but is not limited to, precise string matching, regular expression matching, rule engine reasoning, similarity calculation, or comparison with statistical models. The preset behavioral characteristics used in the matching process are predefined by security experts or generated by the system through self-learning; these preset behavioral characteristics can characterize known attack patterns or legitimate behavioral rules. Based on the degree of similarity or deviation of the matching results, the security protection process outputs a definitive behavioral monitoring result, indicating whether the operation event is classified as "normal behavior" or "abnormal behavior," thereby improving the accuracy of determining whether an operation event is abnormal.

[0069] In this embodiment, by extracting target behavioral features, the messy raw data is transformed into target behavioral features, which provides a data foundation for subsequent matching of target behavioral features with preset behavioral features. The process of matching target behavioral features with preset behavioral features enables the application of security policies and knowledge carried by the preset behavioral features in the user-level environment to accurately determine whether an operation event constitutes abnormal behavior, thereby improving the accuracy and efficiency of the user-level security protection process in determining whether an operation event constitutes abnormal behavior.

[0070] In some embodiments of this disclosure, preset behavioral features include abnormal behavioral features, and the abnormal behavioral features include at least two abnormal behavioral features; the behavioral monitoring result of the operation event is determined by matching the target behavioral features with the preset behavioral features, including: Obtain the matching results between target behavior features and abnormal behavior features; if the target behavior features and abnormal behavior features match, determine the behavior monitoring result as abnormal behavior; if the target behavior features and abnormal behavior features do not match, determine the behavior monitoring result as normal behavior.

[0071] In this embodiment, the abnormal behavior features are predefined behavioral features used to describe and identify the behavioral characteristics of known malicious operations or attack patterns. By matching the target behavioral features with the abnormal behavior features, it is possible to determine whether the current operation event is in an abnormal behavior state, thus avoiding the wrongful blocking of operation events that do not belong to abnormal behavior.

[0072] Specifically, after extracting the target's behavioral characteristics, the security process compares these characteristics with a database of anomalous behavioral characteristics maintained locally or remotely. This database contains at least two specific anomalous behavioral characteristics, each defining a pattern of malicious behavior. The matching process utilizes a rule engine, feature vector similarity calculation, or pattern recognition algorithm, and outputs a definitive matching result indicating whether the current target behavioral characteristic matches any anomalous behavioral characteristic in the database. If the matching result shows that the target behavioral characteristic matches any anomalous behavioral characteristic, the monitoring result for that operation event is determined to be anomalous behavior; conversely, if it does not match any of the known anomalous behavioral characteristics, the monitoring result is determined to be normal behavior.

[0073] In this embodiment of the disclosure, by comparing the target behavior characteristics of the current operation event with the abnormal behavior characteristics, the already identified attack patterns are efficiently screened. Operation events with target behavior characteristics that match the abnormal behavior characteristics are identified as abnormal behavior, and operation events with target behavior characteristics that do not match the abnormal behavior characteristics are identified as normal behavior. This improves the accuracy of the judgment and reduces the possibility of misjudging normal system process or application behavior as abnormal.

[0074] In some embodiments of this disclosure, preset behavioral characteristics include a normal behavioral baseline; the behavioral monitoring result of the operation event is determined by matching the target behavioral characteristics with the preset behavioral characteristics, including: Obtain the deviation between the target behavioral characteristics and the normal behavioral baseline; if the deviation is greater than or equal to the deviation threshold, determine the behavior monitoring result as abnormal behavior; if the deviation is less than the deviation threshold, determine the behavior monitoring result as normal behavior.

[0075] In this embodiment, the normal behavior baseline is a reference model established by learning and modeling historical behavior data generated from the long-term operation of the cockpit operating system and its legitimate applications under safe conditions. This normal behavior baseline is used to characterize the normal behavior features of the cockpit operating system. The deviation between the target behavior features and the normal behavior baseline can characterize the difference between the current operating event and the normal operating event.

[0076] For example, the normal behavior baseline defines the normal value range, combination relationship or probability distribution of various behavioral characteristics, such as system call frequency, file access pattern, and network connection period.

[0077] Specifically, after extracting the target's behavioral characteristics, the security protection process invokes a pre-loaded normal behavior baseline, which is a baseline model generated through machine learning or statistical analysis. The security protection process then uses a specific algorithm to calculate the deviation of the current target's behavioral characteristics from this baseline model. After calculating the deviation, the security protection process compares it to a pre-configured deviation threshold, which is set based on an acceptable balance between false positive and detection rates. If the calculated deviation is greater than or equal to the deviation threshold, the behavioral monitoring result of the operation event is determined to be abnormal behavior; if the deviation is less than the threshold, it is determined to be normal behavior.

[0078] It should be noted that the deviation threshold can be set according to actual needs, and the deviation threshold corresponding to different types of operation events can be different, thus setting different sensitivity of abnormal behavior detection for different operation events.

[0079] In this embodiment of the disclosure, by comparing the target behavior characteristics with a predefined normal behavior baseline to determine the degree of deviation between the two, and then comparing the degree of deviation with a deviation threshold, the system can proactively detect operational events that deviate from normal behavior, and enable the cockpit operating system to detect new malicious behaviors in a timely manner. This improves the cockpit operating system's blocking rate for new malicious behaviors and effectively avoids missed blocking due to the abnormal behavior feature database not being updated in time or the attack methods being novel.

[0080] It's important to note that in the vehicle cabin environment, mistakenly blocking a critical in-vehicle service process can lead to functional failure and security risks. Reducing false alarms is crucial for system stability and user experience. Therefore, for specific in-vehicle services related to safe driving, matching target behavioral characteristics with abnormal behavioral characteristics for anomaly detection can effectively reduce the risk of misjudging abnormal behavior. Conversely, for in-vehicle services not related to safe driving, matching target behavioral characteristics with a normal behavioral baseline can effectively avoid the possibility of missing abnormal behavior events from being blocked.

[0081] In some embodiments of this disclosure, operational events are processed through a security monitoring program or security protection process, including: Operational events can be processed at the kernel level by a security monitoring program based on behavior monitoring results; or the process that initiated the operational event can be terminated at the user level by a security protection process.

[0082] In this embodiment, when the security protection process determines that the behavior monitoring result is abnormal, the result or the internal instructions generated based on the result are passed to the security monitoring program located at the kernel layer. Upon receiving this information, the security monitoring program directly intervenes in the abnormal operation event that is occurring or has just occurred within the kernel's execution context. By utilizing the highest execution privileges at the kernel layer to process malicious behavior at its source, the cockpit protection system can handle high-privilege malicious code at the same privilege level, ensuring that defense instructions are not intercepted or bypassed by malicious processes running at the user layer, thereby achieving reliable handling of high-privilege attacks.

[0083] In this embodiment, after determining that the behavior monitoring result is abnormal, the security protection process can directly send a termination signal to the process that initiated the operation event by calling the process management application interface provided by the cockpit operating system, without relying on the kernel-level security monitoring program, to terminate the process's operation. By using the process management application interface provided by the operating system at the user level to perform cleanup actions, this method of handling abnormal behavior operation events at the user level is suitable for malicious processes with relatively complex attack logic and lacking high privileges, allowing for more complex termination and cleanup processes to be executed at the user level.

[0084] like Figure 3 As shown, the kernel layer 110 and user layer 120 of the cockpit operating system 100 are respectively equipped with a first response executor 112 and a second response executor 122. The security monitoring program 111 of the kernel layer 110 can call the first response executor 112 to handle abnormal operation events, and the security protection process 121 of the user layer 120 can call the second response executor 122 to handle abnormal operation events.

[0085] In this embodiment, by handling abnormal operation events at the kernel level, the cockpit operating system's ability to handle high-privilege malicious processes is improved. Similarly, by handling abnormal operation events at the user level, its ability to handle complex, low-privilege malicious processes is improved. By providing two response paths based on different execution levels, the cockpit operating system can select the most suitable handling method according to the actual privilege level and behavioral complexity of the threat. This further enhances its ability to effectively intercept high-privilege kernel-level threats and efficiently handle complex malware at the user level, thereby strengthening its ability to intercept various malicious behaviors of the cockpit system.

[0086] In some embodiments of this disclosure, operational events are processed at the kernel layer by a security monitoring program based on behavior monitoring results, including: Modify the return value of the resource access interface to cause the operation corresponding to the operation event to fail; or send a forced termination signal to the process that initiated the operation event at the kernel level to stop the process that initiated the operation event.

[0087] In this embodiment, when the security monitoring program decides to take blocking measures based on the behavior monitoring results, it directly modifies the return value corresponding to the operation event at the target resource access interface. Modifying the return value is suitable for abnormal behavior in which the initiating process is a legitimate process. Without terminating the initiating process, it precisely invalidates the specific malicious operation request, thereby denying only a single illegal operation and allowing the process to continue running other legitimate functions, minimizing interference with the overall system operation. For example, the file descriptor that should have returned a success message is rewritten as an error code indicating "insufficient permissions".

[0088] In this embodiment, when the security monitoring program determines that the process initiating the operation event is an illegal process, it can send a forced termination signal directly to the process that triggered the abnormal operation with kernel privileges. The forced termination signal is directly handled by the kernel layer, and the process initiating the operation event cannot prevent or ignore it. The operation event it is executing will be interrupted immediately, thereby clearing the process subject that is carrying out malicious behavior and immediately stopping the entire attack process.

[0089] In this embodiment, blocking a single malicious operation by the initiating process by modifying the return value improves processing efficiency and minimizes disruption to the cockpit operating system. This method is suitable for handling a single, clearly defined violation within the lifecycle of the initiating process. Sending a forced termination signal completely stops the malicious initiating process itself, suitable for handling processes that are continuously engaging in malicious activity or have already caused serious harm. These two methods enable the kernel layer to handle different types of malicious processes.

[0090] In some embodiments of this disclosure, after the operational events are processed by a security monitoring program or a security protection process, the method for handling abnormal behavior further includes: The security monitoring program adds the process ID of the process that initiated the operation event to the kernel-level process restricted list.

[0091] In this embodiment of the disclosure, after the security monitoring program or security protection process processes the operation event, the security monitoring program adds the process identifier corresponding to the process that initiated the operation event to a process restricted list maintained at the kernel level. This establishes a traceable kernel-level marking mechanism for processes that have initiated abnormal behavior, allowing processes that have initiated abnormal behavior to be subject to additional monitoring or restrictions in subsequent activities. Moreover, this marking mechanism does not depend on the current state of the process or the monitoring state at the user level. Even if the process continues to run after a single interception, or if the user-level security protection process restarts, the marking mechanism remains effective at the kernel level. This further improves the persistence of monitoring and restricting processes that have initiated abnormal behavior and avoids the same process repeatedly executing abnormal operation events.

[0092] For example, the process-restricted list at the kernel level can be implemented using a hash table, bitmap, or other efficient data structure.

[0093] Figure 4 This is a schematic diagram of the structure of an abnormal behavior processing device provided in an embodiment of this disclosure.

[0094] In this embodiment of the disclosure, the device for handling abnormal behavior is applied to the vehicle's cockpit operating system. For example... Figure 4 As shown, the abnormal behavior processing device 400 may include an acquisition module 401, a determination module 402, and a processing module 403.

[0095] The acquisition module 401 is used to acquire the raw data of the operation event through the security monitoring program when the operation event is initiated by the resource access interface of the cockpit operating system. The security monitoring program is mounted in the kernel layer of the cockpit operating system. The determination module 402 is used to perform behavioral monitoring of operation events based on raw data through the security protection process, and determine the behavioral monitoring results of the operation events, wherein the security protection process runs in the user layer of the cockpit operating system; The processing module 403 is used to process the operation event through a security monitoring program or security protection process when the behavior monitoring result is abnormal behavior.

[0096] In this embodiment, a security monitoring program mounted on the kernel layer captures the raw data of operation events at the resource access interface, placing the monitoring point at the kernel-level resource access interface. This ensures that any operation attempting to access this interface cannot evade monitoring, guaranteeing the comprehensiveness of the monitoring and the authenticity of the data. By deploying a security protection process at the user layer, which can monitor operation events based on raw data, the user layer leverages its powerful analytical capabilities to accurately determine the true data captured at the lower level, ensuring accurate identification. The security protection process can choose to handle abnormal behavior operation events through either the kernel-level security monitoring program or the user-level security protection process based on the behavior monitoring results. This allows the cockpit operating system to select an effective location for interception, ensuring that the defense action can counter malicious code with high privileges. This disclosure solves the problem of lacking effective interception capabilities against malicious behavior that has obtained root privileges. Kernel-level monitoring and response do not require multiple context switches and can intervene immediately, improving the real-time processing of abnormal behavior. By combining precise analysis at the user layer with reliable execution at the kernel layer, the effectiveness of cockpit operating system protection is enhanced.

[0097] In some embodiments of this disclosure, the acquisition module 401 is further configured to acquire event information of the operation event, wherein the event information includes at least one of the following: the process identifier that initiated the operation event, the call identifier of the resource access interface, the call parameter information corresponding to the call identifier, and the operation result information returned by the resource access interface; The abnormal behavior processing device 400 also includes: The processing module is used to perform structured processing on event information to obtain raw data; the resource access interface includes at least one of the following: process management interface, file access interface, permission management interface, and communication interface.

[0098] In this embodiment of the disclosure, by obtaining event information of different categories at the kernel layer, the authenticity and completeness of the information captured from the kernel layer are improved. Furthermore, by performing structured processing on the event information of different categories, the obtained raw data is made into a standardized data format, which simplifies the parsing process of the raw data by the user layer security protection process. Thus, while ensuring the integrity of the raw data that the security protection process can obtain, it also simplifies the data processing logic at the user layer and improves the processing efficiency of the user layer.

[0099] In some embodiments of this disclosure, the abnormal behavior processing apparatus 400 further includes: The extraction module is used to extract the target behavioral features from the raw data; The determination module 402 is also used to match the target behavior characteristics with preset behavior characteristics to determine the behavior monitoring results of the operation event.

[0100] In this embodiment, by extracting target behavioral features, the messy raw data is transformed into target behavioral features, which provides a data foundation for subsequent matching of target behavioral features with preset behavioral features. The process of matching target behavioral features with preset behavioral features enables the application of security policies and knowledge carried by the preset behavioral features in the user-level environment to accurately determine whether an operation event constitutes abnormal behavior, thereby improving the accuracy and efficiency of the user-level security protection process in determining whether an operation event constitutes abnormal behavior.

[0101] In some embodiments of this disclosure, the preset behavioral features include abnormal behavioral features, and the abnormal behavioral features include at least two abnormal behavioral features. The acquisition module 401 is also used to acquire the matching results between the target behavior features and the abnormal behavior features; The determination module 402 is also used to determine that the behavior monitoring result is abnormal behavior when the target behavior characteristics match the abnormal behavior characteristics; The determination module 402 is also used to determine the behavior monitoring result as normal behavior when the target behavior characteristics do not match the abnormal behavior characteristics.

[0102] In this embodiment of the disclosure, by comparing the target behavior characteristics of the current operation event with the abnormal behavior characteristics, the already identified attack patterns are efficiently screened. Operation events with target behavior characteristics that match the abnormal behavior characteristics are identified as abnormal behavior, and operation events with target behavior characteristics that do not match the abnormal behavior characteristics are identified as normal behavior. This improves the accuracy of the judgment and reduces the possibility of misjudging normal system process or application behavior as abnormal.

[0103] In some embodiments of this disclosure, the preset behavioral characteristics include a normal behavioral baseline; The acquisition module 401 is also used to acquire the deviation between the target behavioral characteristics and the normal behavioral baseline; The determination module 402 is also used to determine that the behavior monitoring result is abnormal behavior when the deviation is greater than or equal to the deviation threshold; The determination module 402 is also used to determine the behavior monitoring result as normal behavior when the deviation is less than the deviation threshold.

[0104] In this embodiment of the disclosure, by comparing the target behavior characteristics with a predefined normal behavior baseline to determine the degree of deviation between the two, and then comparing the degree of deviation with a deviation threshold, the system can proactively detect operational events that deviate from normal behavior, and enable the cockpit operating system to detect new malicious behaviors in a timely manner. This improves the cockpit operating system's blocking rate for new malicious behaviors and effectively avoids missed blocking due to the abnormal behavior feature database not being updated in time or the attack methods being novel.

[0105] In some embodiments of this disclosure, the processing module 403 is further configured to process the operation event at the kernel layer based on the behavior monitoring results by a security monitoring program; or to terminate the initiating process of the operation event at the user layer by a security protection process.

[0106] In this embodiment, by handling abnormal operation events at the kernel level, the cockpit operating system's ability to handle high-privilege malicious processes is improved. Similarly, by handling abnormal operation events at the user level, its ability to handle complex, low-privilege malicious processes is improved. By providing two response paths based on different execution levels, the cockpit operating system can select the most suitable handling method according to the actual privilege level and behavioral complexity of the threat. This further enhances its ability to effectively intercept high-privilege kernel-level threats and efficiently handle complex malware at the user level, thereby strengthening its ability to intercept various malicious behaviors of the cockpit system.

[0107] In some embodiments of this disclosure, the processing module 403 is further configured to modify the return value of the resource access interface to cause the operation corresponding to the operation event to fail; or to send a forced termination signal to the process that initiated the operation event at the kernel layer to stop the process that initiated the operation event from running.

[0108] In this embodiment, blocking a single malicious operation by the initiating process by modifying the return value improves processing efficiency and minimizes disruption to the cockpit operating system. This method is suitable for handling a single, clearly defined violation within the lifecycle of the initiating process. Sending a forced termination signal completely stops the malicious initiating process itself, suitable for handling processes that are continuously engaging in malicious activity or have already caused serious harm. These two methods enable the kernel layer to handle different types of malicious processes.

[0109] In some embodiments of this disclosure, the processing module 403 is further configured to add the process identifier corresponding to the process initiating the operation event to the process restricted list of the kernel layer through a security monitoring program.

[0110] In this embodiment of the disclosure, after the security monitoring program or security protection process processes the operation event, the security monitoring program adds the process identifier corresponding to the process that initiated the operation event to a process restricted list maintained at the kernel level. This establishes a traceable kernel-level marking mechanism for processes that have initiated abnormal behavior, allowing processes that have initiated abnormal behavior to be subject to additional monitoring or restrictions in subsequent activities. Moreover, this marking mechanism does not depend on the current state of the process or the monitoring state at the user level. Even if the process continues to run after a single interception, or if the user-level security protection process restarts, the marking mechanism remains effective at the kernel level. This further improves the persistence of monitoring and restricting processes that have initiated abnormal behavior and avoids the same process repeatedly executing abnormal operation events.

[0111] It should be noted that, Figure 4 The abnormal behavior processing device 400 shown can execute the various steps in the above method embodiments and realize the various processes and effects in the above method embodiments, which will not be elaborated here.

[0112] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure.

[0113] like Figure 5 As shown, the electronic device may include a processor 501 and a memory 502 storing computer program instructions.

[0114] In this embodiment of the disclosure, Figure 5 The electronic devices shown include terminals, which specifically include in-vehicle terminals, computers, or tablets, etc., without limitation.

[0115] Specifically, the processor 501 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this disclosure.

[0116] Memory 502 may include a large-capacity storage device for information or instructions. For example, and not limitingly, memory 502 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 502 may include removable or non-removable (or fixed) media. Where appropriate, memory 502 may be internal or external to the integrated gateway device. In a particular embodiment, memory 502 is a non-volatile solid-state memory. In a particular embodiment, memory 502 includes read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (Electrically Programmable ROM, EPROM), an electrically erasable programmable PROM (EEPROM), an electrically alterable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0117] The processor 501 reads and executes computer program instructions stored in the memory 502 to perform the steps of the abnormal behavior handling method provided in the embodiments of this disclosure.

[0118] In one example, the electronic device may also include a transceiver 503 and a bus 505. Wherein, as... Figure 5 As shown, the processor 501, memory 502 and transceiver 503 are connected via bus 505 and communicate with each other.

[0119] Bus 505 may include hardware, software, or both. For example, and not limitingly, a bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 505 may include one or more buses.

[0120] This disclosure also provides a vehicle that includes the electronic equipment described in any of the above embodiments, and thus has all the beneficial technical effects of the electronic equipment described in any of the above embodiments, which will not be repeated here.

[0121] This disclosure also provides a computer-readable storage medium that can store a computer program that, when executed by a processor, causes the processor to implement the abnormal behavior handling method provided in this disclosure.

[0122] When a computer program is executed by a processor, it can perform the following steps: When an operation event is initiated through the resource access interface of the cockpit operating system, the raw data of the operation event is obtained through a security monitoring program, which is mounted in the kernel layer of the cockpit operating system. Based on the raw data, a security protection process performs behavioral monitoring on the operation event to determine the behavioral monitoring result. The security protection process runs in the user layer of the cockpit operating system. If the behavioral monitoring result is abnormal behavior, the operation event is processed through the security monitoring program or the security protection process.

[0123] In some embodiments of this disclosure, raw data of operational events are obtained through a security monitoring program, including: Obtain event information of the operation event, wherein the event information includes at least one of the following: the process identifier that initiated the operation event, the call identifier of the resource access interface, the call parameter information corresponding to the call identifier, and the operation result information returned by the resource access interface; perform structured processing on the event information to obtain raw data; wherein the resource access interface includes at least one of the following: process management interface, file access interface, permission management interface, and communication interface.

[0124] In some embodiments of this disclosure, a security protection process performs behavioral monitoring of operational events based on raw data to determine the behavioral monitoring results of the operational events, including: Extract the target behavior features from the raw data; match the target behavior features with preset behavior features to determine the behavior monitoring results of the operation event.

[0125] In some embodiments of this disclosure, preset behavioral features include abnormal behavioral features, and the abnormal behavioral features include at least two abnormal behavioral features; the behavioral monitoring result of the operation event is determined by matching the target behavioral features with the preset behavioral features, including: Obtain the matching results between target behavior features and abnormal behavior features; if the target behavior features and abnormal behavior features match, determine the behavior monitoring result as abnormal behavior; if the target behavior features and abnormal behavior features do not match, determine the behavior monitoring result as normal behavior.

[0126] In some embodiments of this disclosure, the preset behavioral characteristics include a normal behavioral baseline; The behavioral monitoring results of the operational event are determined by matching the target behavioral characteristics with preset behavioral characteristics, including: Obtain the deviation between the target behavioral characteristics and the normal behavioral baseline; if the deviation is greater than or equal to the deviation threshold, determine the behavior monitoring result as abnormal behavior; if the deviation is less than the deviation threshold, determine the behavior monitoring result as normal behavior.

[0127] In some embodiments of this disclosure, operational events are processed through a security monitoring program or security protection process, including: Operational events can be processed at the kernel level by a security monitoring program based on behavior monitoring results; or the process that initiated the operational event can be terminated at the user level by a security protection process.

[0128] In some embodiments of this disclosure, operational events are processed at the kernel layer by a security monitoring program based on behavior monitoring results, including: Modify the return value of the resource access interface to cause the operation corresponding to the operation event to fail; or send a forced termination signal to the process that initiated the operation event at the kernel level to stop the process that initiated the operation event.

[0129] In some embodiments of this disclosure, after the operational events are processed by a security monitoring program or a security protection process, the method for handling abnormal behavior further includes: The security monitoring program adds the process ID of the process that initiated the operation event to the kernel-level process restricted list.

[0130] The aforementioned storage medium may, for example, include a memory 502 containing computer program instructions, which can be executed by a processor 501 to complete the abnormal behavior handling method provided in the embodiments of this disclosure. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as read-only memory (ROM), random access memory (RAM), external cache memory, compact disc ROM (CD-ROM), magnetic tape, floppy disk, flash memory, and optical data storage devices. By way of illustration and not limitation, RAM is available in various forms, such as static random access memory (SRAM) and dynamic random access memory (DRAM).

[0131] This disclosure also provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a processor, they implement the abnormal behavior handling method provided in this disclosure and can achieve the various processes and effects in the above embodiments of this disclosure, which will not be elaborated here.

[0132] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for handling abnormal behavior, characterized in that, Applied to a cockpit operating system, the method includes: When an operation event is initiated by the resource access interface of the cockpit operating system, the raw data of the operation event is obtained through a security monitoring program, wherein the security monitoring program is mounted on the kernel layer of the cockpit operating system. The security protection process performs behavioral monitoring on the operation event based on the raw data to determine the behavioral monitoring result of the operation event, wherein the security protection process runs in the user layer of the cockpit operating system; If the behavior monitoring result indicates abnormal behavior, the operation event will be processed through the security monitoring program or the security protection process.

2. The method for handling abnormal behavior according to claim 1, characterized in that, The process of obtaining the raw data of the operation event through the security monitoring program includes: Obtain event information of the operation event, wherein the event information includes at least one of the following: process identifier that initiated the operation event, call identifier of the resource access interface, call parameter information corresponding to the call identifier, and operation result information returned by the resource access interface; The event information is structured to obtain the raw data; The resource access interface includes at least one of the following: process management interface, file access interface, permission management interface, and communication interface.

3. The method for handling abnormal behavior according to claim 1, characterized in that, The step of performing behavioral monitoring on the operation event based on the raw data through a security protection process to determine the behavioral monitoring result of the operation event includes: Extract the target behavioral features from the raw data; The behavior monitoring result of the operation event is determined by matching the target behavior characteristics with preset behavior characteristics.

4. The method for handling abnormal behavior according to claim 3, characterized in that, The preset behavioral features include abnormal behavioral features, and the abnormal behavioral features include at least two abnormal behavioral features. The step of matching the target behavioral features with preset behavioral features to determine the behavioral monitoring result of the operation event includes: Obtain the matching results between the target behavior features and the abnormal behavior features; If the target behavior feature matches the abnormal behavior feature, the behavior monitoring result is determined to be the abnormal behavior. If the target behavioral characteristics do not match the abnormal behavioral characteristics, the behavioral monitoring result is determined to be normal behavior.

5. The method for handling abnormal behavior according to claim 3, characterized in that, The preset behavioral characteristics include a normal behavioral baseline; The step of matching the target behavioral features with preset behavioral features to determine the behavioral monitoring result of the operation event includes: Obtain the deviation between the target behavioral feature and the normal behavioral baseline; If the deviation is greater than or equal to the deviation threshold, the behavior monitoring result is determined to be the abnormal behavior; If the deviation is less than the deviation threshold, the behavior monitoring result is determined to be the normal behavior.

6. The method for handling abnormal behavior according to any one of claims 1 to 5, characterized in that, The processing of the operation event through the security monitoring program or the security protection process includes: The security monitoring program processes the operation events at the kernel layer based on the behavior monitoring results; or The security protection process terminates the initiation process of the operation event at the user level.

7. The method for handling abnormal behavior according to claim 6, characterized in that, The process of handling the operation event at the kernel layer based on the behavior monitoring results by the security monitoring program includes: Modify the return value of the resource access interface to cause the operation corresponding to the operation event to fail; or The kernel layer sends a forced termination signal to the process that initiated the operation event, so that the process that initiated the operation event stops running.

8. The method for handling abnormal behavior according to any one of claims 1 to 5, characterized in that, After the operation event is processed by the security monitoring program or the security protection process, the method for handling abnormal behavior further includes: The security monitoring program adds the process identifier corresponding to the process that initiated the operation event to the process restricted list in the kernel layer.

9. An electronic device, characterized in that, include: processor; Memory, used to store executable instructions; The processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the abnormal behavior handling method according to any one of claims 1 to 8.

10. A vehicle, characterized in that, include: The electronic device according to claim 9.

Images