An attack tracing method for vehicle-mounted intrusion detection, an electronic device and a program product

Abstract

The application relates to the technical field of intelligent networked vehicles, and proposes an attack tracing method for vehicle-mounted intrusion detection, an electronic device and a computer program product. The method comprises the following steps: when it is determined that a vehicle is subjected to an attack behavior according to current communication data of the vehicle, a knowledge graph constructed based on the current communication data is acquired, the knowledge graph has obtained a node embedding vector of each node and an edge embedding vector of each edge through graph embedding processing; according to the node embedding vector and the edge embedding vector, an abnormal score and a centrality score of each node in the knowledge graph are respectively determined, and an abnormal score of each edge in the knowledge graph is respectively determined; and according to the abnormal score and the centrality score of each node in the knowledge graph and the abnormal score of each edge in the knowledge graph, an attack path of the attack behavior is determined. By using the method, the specific attack path can be traced back when it is determined that the vehicle is subjected to the attack behavior, so that the interpretability of the intrusion detection result is improved.

Description

Technical Field

[0001] This application relates to the field of intelligent connected vehicle technology, and in particular to an attack tracing method, electronic device and computer program product for vehicle intrusion detection. Background Technology

[0002] With the rapid development of intelligent connected vehicle technology, vehicles can achieve various functions such as autonomous driving, remote vehicle control, and over-the-air updates through in-vehicle communication networks, greatly enriching the user experience. However, this highly interconnected architecture also significantly expands the attack surface of vehicles. Attackers can exploit remote vulnerabilities to launch man-in-the-middle attacks, hijack the vehicle's communication channels with the outside world, steal sensitive data, or tamper with critical commands, seriously threatening the safety of passengers and public transportation. To address these issues, the mainstream solution is to use an in-vehicle intrusion detection system (IDS). This system can monitor attacks on vehicles in a timely manner and formulate corresponding countermeasures to ensure the security of the vehicle system. However, existing intrusion detection systems lack effective attack attribution mechanisms, typically only providing a simple judgment of whether an attack has occurred, without tracing the attack path, resulting in a lack of interpretability in intrusion detection results. Summary of the Invention

[0003] In view of this, embodiments of this application provide an attack tracing method, electronic device, and computer program product for vehicle intrusion detection, which can trace the specific attack path when it is determined that a vehicle has been attacked, thereby improving the interpretability of intrusion detection results.

[0004] The first aspect of this application provides an attack tracing method for vehicle intrusion detection, including:

[0005] When it is determined that the vehicle has been attacked based on the vehicle's current communication data, a knowledge graph constructed based on the current communication data is obtained. The knowledge graph has obtained the node embedding vector of each node and the edge embedding vector of each edge through graph embedding processing.

[0006] The anomaly score and centrality score of each node in the knowledge graph are determined separately, as are the anomaly scores of each edge in the knowledge graph. The anomaly score of each node is determined based on the distance between the node embedding vector of the corresponding node and the nearest normal node cluster center. The centrality score of each node is determined based on the degree centrality of the corresponding node in the knowledge graph. The anomaly score of each edge is determined based on the distance between the edge embedding vector of the corresponding edge and the nearest normal edge cluster center. The normal node cluster center and the normal edge cluster center are learned from the normal sample embedding vectors of the corresponding non-aggressive behaviors through clustering.

[0007] The attack path of the attack behavior is determined based on the anomaly score and centrality score of each node in the knowledge graph, as well as the anomaly score of each edge in the knowledge graph.

[0008] In the technical solution of this application embodiment, when it is determined that a vehicle is under attack based on its current communication data, a knowledge graph constructed based on the current communication data is obtained. This knowledge graph has obtained the node embedding vector of each node and the edge embedding vector of each edge through graph embedding processing. Then, the anomaly score and centrality score of each node in the knowledge graph are determined, as well as the anomaly score of each edge in the knowledge graph. The anomaly score of each node is determined based on the distance between the node embedding vector of the corresponding node and the nearest normal node cluster center. The centrality score of each node is determined based on the degree centrality of the corresponding node in the knowledge graph. The anomaly score of each edge is determined based on the distance between the edge embedding vector of the corresponding edge and the nearest normal edge cluster center. The normal node cluster center and normal edge cluster center are learned from the normal sample embedding vectors of the corresponding non-attack behavior through clustering. Then, based on the anomaly score and centrality score of each node in the knowledge graph, and the anomaly score of each edge in the knowledge graph, the attack path of the attack behavior is determined. In the above process, since the anomaly score is determined based on the distance between the embedding vector of a node or edge and the center of the normal cluster, the anomaly score of each node or edge can be used to characterize the deviation between the behavior pattern of the corresponding node or edge and normal behavior. Since the centrality score of each node is determined based on the degree centrality of the corresponding node in the knowledge graph, and degree centrality means counting the number of directly adjacent neighbor nodes of a node, the centrality score of each node can be used to characterize the activity level and structural importance of the corresponding node in the knowledge graph. Therefore, by analyzing the anomaly score and centrality score of each node and the anomaly score of each edge in the knowledge graph, it is possible to determine which nodes and edges have behavior patterns that deviate significantly from normal behavior, and which nodes have higher activity levels and structural importance. These nodes and edges are more likely to be related to attack behavior, thus allowing for the tracing of specific attack paths and improving the interpretability of intrusion detection results.

[0009] In one implementation of this application, the attack path of the attack behavior is determined based on the anomaly score and centrality score of each node in the knowledge graph, and the anomaly score of each edge in the knowledge graph, including:

[0010] Based on the anomaly score and centrality score of each node in the knowledge graph, as well as the anomaly score of each edge in the knowledge graph, a suspicious subgraph is constructed. The suspicious subgraph consists of a set of suspicious nodes and a set of suspicious edges.

[0011] From the suspicious subgraph, identify all candidate paths whose length does not exceed the first threshold;

[0012] For each candidate path, the total anomaly score of the candidate path is determined based on the anomaly scores and centrality scores of each node contained in the candidate path, as well as the anomaly scores of each edge contained in the candidate path.

[0013] From all candidate paths, select the top k candidate paths with the highest total anomaly score exceeding the second threshold as attack paths, where k ≥ 1.

[0014] In one implementation of this application, a suspicious subgraph is constructed based on the anomaly score and centrality score of each node in the knowledge graph, and the anomaly score of each edge in the knowledge graph, including:

[0015] For each node in the knowledge graph, if the anomaly score of the node exceeds the third threshold and the centrality score exceeds the fourth threshold, then the node is selected into the suspicious node set.

[0016] For each node in the suspicious node set, if the abnormal score of the edge connecting to that node exceeds the third threshold, then the edge connecting to that node is selected into the suspicious edge set.

[0017] In one implementation of this application, the total anomaly score of the candidate path is determined based on the anomaly scores and centrality scores of each node included in the candidate path, and the anomaly scores of each edge included in the candidate path, including:

[0018] For each node in the candidate path, perform a weighted summation of the outlier score and centrality score of that node to obtain the weighted score of that node;

[0019] The total abnormal score of the candidate path is obtained by summing the weighted scores of each node in the candidate path with the abnormal scores of each edge in the candidate path.

[0020] In one implementation of this application, the knowledge graph is constructed in the following way:

[0021] Based on the analyzed and refined known threat information, identify the various security-related entities from the current communication data;

[0022] Decode the application layer protocol from the current communication data and aggregate the fragmented data packets contained in the current communication data into a communication session with complete semantics;

[0023] Application-layer semantic analysis is performed on communication sessions to capture the temporal dependencies and contextual relationships between events involved in the communication sessions. Combined with each entity, the entity-relationship-entity triples with security significance are inferred, and each triple constitutes a knowledge graph.

[0024] In one implementation of this application, based on the analyzed and refined known threat information, various security-related entities are identified from the current communication data, including:

[0025] Convert the current communication data into a text data stream in a unified format;

[0026] Candidate entities are extracted from text data streams using a trained deep semantic understanding model;

[0027] Based on known threat information, select each entity from the candidate entities.

[0028] In one implementation of this application, the graph embedding process of the knowledge graph includes:

[0029] By using reinforcement learning methods, the optimal return parameters and optimal input / output parameters of the Node2Vec algorithm adapted to knowledge graphs are determined.

[0030] Based on the optimal return parameters and optimal input / output parameters, the Node2Vec algorithm is used to perform graph embedding processing on the knowledge graph.

[0031] In one implementation of this application, the optimal return parameters and optimal input / output parameters of the Node2Vec algorithm adapted to the knowledge graph are determined using a reinforcement learning method, including:

[0032] The structure of the knowledge graph is used as the state and input to a trained policy network. The optimal return parameters and optimal input / output parameters are determined by the actions output by the policy network. The policy network is an agent trained using reinforcement learning. The actions output by the policy network are a pair of return parameters and input / output parameters determined based on the input state. The reward for the policy network during training is the detection accuracy of the embedded vector data generated by executing the Node2Vec algorithm using the determined pair of return parameters and input / output parameters in the downstream intrusion detection task.

[0033] A second aspect of this application provides an attack tracing device for vehicle intrusion detection, comprising:

[0034] The knowledge graph acquisition module is used to acquire a knowledge graph constructed based on the current communication data when it is determined that the vehicle has been attacked. The knowledge graph has obtained the node embedding vector of each node and the edge embedding vector of each edge through graph embedding processing.

[0035] The score determination module is used to determine the anomaly score and centrality score of each node in the knowledge graph, and to determine the anomaly score of each edge in the knowledge graph. The anomaly score of each node is determined based on the distance between the node embedding vector of the corresponding node and the nearest normal node cluster center. The centrality score of each node is determined based on the degree centrality of the corresponding node in the knowledge graph. The anomaly score of each edge is determined based on the distance between the edge embedding vector of the corresponding edge and the nearest normal edge cluster center. The normal node cluster center and the normal edge cluster center are learned from the normal sample embedding vectors of the corresponding non-aggressive behaviors through clustering.

[0036] The attack path determination module is used to determine the attack path of the attack behavior based on the anomaly score and centrality score of each node in the knowledge graph, as well as the anomaly score of each edge in the knowledge graph.

[0037] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the attack tracing method for vehicle intrusion detection as provided in the first aspect of this application.

[0038] A fourth aspect of this application provides a computer program product that, when run on an electronic device, causes the electronic device to execute the attack tracing method for vehicle intrusion detection as provided in the first aspect of this application.

[0039] A fifth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the attack tracing method for vehicle intrusion detection as provided in the first aspect of this application.

[0040] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0041] Figure 1 This is a flowchart of an attack tracing method for vehicle intrusion detection provided in an embodiment of this application;

[0042] Figure 2 This is a schematic diagram of the overall architecture of the attack tracing method for vehicle intrusion detection provided in this application embodiment;

[0043] Figure 3 This is a schematic diagram of the structure of an attack tracing device for vehicle intrusion detection provided in an embodiment of this application;

[0044] Figure 4This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0045] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application can also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail. Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance.

[0046] As the market for intelligent connected vehicles continues to expand, the interaction between vehicle systems and external networks is becoming increasingly frequent, making vehicle systems more vulnerable to external intrusion threats and posing significant security risks. Currently, intrusion detection systems can monitor attacks on vehicles to some extent and can improve vehicle system security by developing corresponding countermeasures. However, existing intrusion detection systems typically only provide a simple judgment of whether an attack has occurred, without tracing the attack path, resulting in a lack of interpretability in the intrusion detection results.

[0047] To address the aforementioned technical problems of existing intrusion detection systems, this application proposes an attack tracing method, electronic device, and computer program product for vehicle-mounted intrusion detection. This method can trace the specific attack path when an attack is detected on a vehicle, thereby improving the interpretability of intrusion detection results. For more specific technical implementation details of this application's embodiments, please refer to the various method embodiments described below.

[0048] It should be understood that the implementing entity of the various method embodiments proposed in this application can be various types of electronic devices, such as mobile phones, tablets, wearable devices, vehicle gateways, vehicle terminals, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), large-screen TVs, etc. The embodiments of this application do not impose any restrictions on the specific type of electronic device.

[0049] Please see Figure 1 This application illustrates an attack tracing method for vehicle intrusion detection provided by an embodiment of the present application, comprising:

[0050] 101. When it is determined that the vehicle is under attack based on the vehicle's current communication data, obtain the knowledge graph constructed based on the current communication data. The knowledge graph has obtained the node embedding vector of each node and the edge embedding vector of each edge through graph embedding processing.

[0051] The technical solution of this application embodiment can realize vehicle intrusion detection, and when the intrusion detection result is that the vehicle has been attacked, it can also realize attack tracing, that is, it can generate the corresponding attack path, so as to improve the interpretability of the intrusion detection result. The following describes the technical implementation of vehicle intrusion detection.

[0052] First, the vehicle's current communication data is acquired. In order to improve the ability to detect complex attack behaviors, this application embodiment acquires communication data from various different data sources, including but not limited to: CAN bus data, HTTP traffic data, Bluetooth data, and vehicle log data.

[0053] After obtaining the vehicle's current communication data, a knowledge graph specifically for vehicle-to-everything (V2X) security is constructed based on this data. In one implementation of this application, the knowledge graph is constructed in the following manner:

[0054] (1) Based on the known threat information extracted from the analysis, identify the various security-related entities from the current communication data;

[0055] (2) Decode the application layer protocol from the current communication data and aggregate the fragmented data packets contained in the current communication data into a communication session with complete semantics;

[0056] (3) Perform application layer semantic analysis on the communication session, capture the temporal dependencies and contextual relationships between events involved in the communication session, and infer each triple of entity-relationship-entity with security significance by combining each entity. Each triple constitutes a knowledge graph.

[0057] Since the structure of the vehicle-to-everything (V2X) security knowledge graph is a "entity-relationship-entity" triple, the key step in constructing the knowledge graph is to perform entity identification and relation extraction processing from multi-source current communication data. For entity identification, based on the analyzed and refined known threat information, various security-related entities can be identified from the current communication data, such as IP addresses, ports, vehicle components, and operation types. For relation extraction, it can be divided into four steps: protocol parsing, session reconstruction, application-layer semantic analysis, and temporal and contextual modeling. First, protocol parsing is performed to decode the application-layer protocol from the current communication data. Then, session reconstruction is performed to aggregate fragmented data packets from the current communication data into a communication session with complete semantics. Next, application-layer semantic analysis is performed to identify event information such as operation types, parameter structures, and interaction intentions within the session. Finally, temporal and contextual modeling is performed to capture the temporal dependencies and contextual relationships between events involved in the communication session based on the identified event information, and to infer the security-meaning entity-relationship-entity triples by combining each entity. These triples constitute a knowledge graph, thus completing the knowledge graph construction process.

[0058] An example of a real triple is “10.42.0.208—Send Data—59.82.43.205” (entity—relationship—entity). Taking HTTP traffic data as an example, the relationship extraction process for this real triple is as follows:

[0059] Protocol parsing: The HTTP protocol was parsed from the raw HTTP traffic packets, revealing a GET request; Session reconstruction: Multiple packets belonging to the same session were reassembled to reconstruct the complete HTTP request; Application layer semantic analysis: It was identified that this was an IP address sending data to another IP address; Timing and context modeling: Combining the context, it was found that the request did not originate from a normal source, but from an unknown external IP address, and was repeatedly sent multiple times within a short period of time, which is highly likely to be a malicious attack. Finally, this event was modeled as the triple "10.42.0.208—sending data—59.82.43.205".

[0060] In one implementation of this application, based on the analyzed and refined known threat information, various security-related entities are identified from the current communication data, including:

[0061] (1) Convert the current communication data into a text data stream in a unified format;

[0062] (2) Extract candidate entities from the text data stream using a trained deep semantic understanding model;

[0063] (3) Select each entity from the candidate entities based on the known threat information.

[0064] The entity identification process described above can utilize structured or semi-structured external security knowledge bases to analyze and extract various known threat information, such as CVE numbers and affected software versions in vulnerability databases. This known threat information, known as threat intelligence, is used to assist in identifying potential malicious attacks. By employing a deep semantic understanding model based on a Transformer encoder and fusing this threat intelligence, it is possible to accurately identify various security-related entities from multi-source, heterogeneous current communication data. The specific steps include: converting the current communication data into a unified format text data stream, such as preprocessing multi-source heterogeneous data like CAN messages and HTTP logs into a unified format text sequence or structured event stream; extracting candidate entities from the text data stream using a trained deep semantic understanding model, for example, using a deep semantic understanding model based on the Transformer encoder architecture to extract each candidate entity from the formatted text data stream, including IP addresses and access paths. The Transformer encoder architecture excels at processing sequence data, understanding context, and capturing long-distance dependencies, making it suitable for accurately extracting candidate entities; combining threat intelligence, selecting each entity from the candidate entities. If a candidate entity appears in the threat intelligence, it is assigned a higher threat score. Finally, the candidate entities with higher threat scores are output and added to a structured knowledge graph entity list related to vehicle network security. This yields the final entities used to create the knowledge graph.

[0065] After creating the knowledge graph, it needs to be graph embedded to obtain low-dimensional embedding vector data. For example, the Node2Vec algorithm can be used to perform graph embedding on the knowledge graph. The Node2Vec algorithm generates a sequence of nodes through random walks, and then uses the Skip-gram model to learn the node embeddings, thereby obtaining the node embedding vector of each node in the knowledge graph, as well as the edge embedding vector of each edge in the knowledge graph.

[0066] The random walk strategy is controlled by the return parameter p and the input / output parameters q. Existing Node2Vec algorithms require manual selection of fixed values ​​for p and q at the start of the walk. However, since the input graph structures differ for different graph embedding tasks, using fixed p and q values ​​is incompatible with all graph embedding tasks, ultimately leading to poor performance on some tasks and the inability to obtain high-quality low-dimensional embedding vectors. To address this issue, this application proposes a method that automatically selects the optimal p and q values ​​based on the input graph structure, thus obtaining high-quality low-dimensional embedding vectors for various graph embedding tasks. The specific operation process is described below.

[0067] In one implementation of this application, the graph embedding process of the knowledge graph includes:

[0068] (1) By using reinforcement learning methods, determine the optimal return parameters and optimal input / output parameters of the Node2Vec algorithm that is compatible with knowledge graphs;

[0069] (2) The Node2Vec algorithm is used to embed the knowledge graph according to the optimal return parameters and the optimal input and output parameters.

[0070] The processing method of this application embodiment is to model the selection of return parameter p and input / output parameters q as a reinforcement learning problem. Through reinforcement learning methods, the optimal return parameter p* and optimal input / output parameters q* of the Node2Vec algorithm adapted to the input graph structure (i.e., knowledge graph) are determined. Then, according to the optimal return parameter p* and optimal input / output parameters q*, the Node2Vec algorithm is used to perform graph embedding processing on the knowledge graph created above. Then, the Skip-gram model is used to learn node embeddings, which can generate high-quality low-dimensional embedding vectors that can better reflect the characteristics of attack behavior, reducing the computational resource consumption of downstream intrusion detection and attack tracing processing. The generated low-dimensional embedding vectors include the node embedding vector of each node in the knowledge graph and the edge embedding vector of each edge in the knowledge graph. Reinforcement learning is a machine learning method whose core idea is to allow an agent to learn the optimal policy through trial and error in continuous interaction with the environment. The agent will take a certain action based on the current state, and the environment will give a reward and move to a new state. The goal of the agent is to maximize the long-term cumulative reward by continuously adjusting the policy. The following describes how to obtain the optimal return parameter p* and the optimal input and output parameters q* through reinforcement learning.

[0071] In one implementation of this application, the optimal return parameters and optimal input / output parameters of the Node2Vec algorithm adapted to the knowledge graph are determined using a reinforcement learning method, including:

[0072] The structure of the knowledge graph is used as the state and input to a trained policy network. The optimal return parameters and optimal input / output parameters are determined by the actions output by the policy network. The policy network is an agent trained using reinforcement learning. The actions output by the policy network are a pair of return parameters and input / output parameters determined based on the input state. The reward for the policy network during training is the detection accuracy of the embedded vector data generated by executing the Node2Vec algorithm using the determined pair of return parameters and input / output parameters in the downstream intrusion detection task.

[0073] This application defines four key elements in reinforcement learning as follows: Agent, a policy network; State, the current structure of the knowledge graph; Action, outputting a pair of (p, q) parameters; and Reward, the detection accuracy of the embedded vector data generated after executing the Node2Vec algorithm using (p, q) in downstream intrusion detection tasks. The training process of reinforcement learning involves the policy network continuously optimizing and updating through policy gradient methods to maximize the accumulated reward. The ultimately trained policy network can automatically recommend the optimal pair of (p, q) parameters based on the input knowledge graph. The training process of this policy network mainly includes: parameter initialization, randomly initializing the parameters θ of the policy network; interactive sampling, inputting the current knowledge graph structure as state s into the policy network, the policy network outputs an action a = (p, q), and using the output (p, q) as the values ​​of parameters p and q in the Node2Vec algorithm to generate corresponding embedding vector data, which is then input into a downstream lightweight intrusion detection model to obtain the detection accuracy on the validation set as the reward r; policy update, using the obtained (s, a, r) ​​samples, updating the parameters θ of the policy network through gradient ascent, with the goal of maximizing the expected reward E[r]; iteration, repeating interactive sampling and policy update until the values ​​of (p, q) for the same input converge, thus obtaining the trained policy network. After the policy network is trained, the knowledge graph created above is input as state into the policy network, and the optimal return parameter p* and optimal input / output parameter q* that fit the input graph structure can be determined through the actions output by the policy network.

[0074] After obtaining the node embedding vector of each node and the edge embedding vector of each edge in the knowledge graph through graph embedding processing, these node embedding vectors and edge embedding vectors are input into a trained lightweight intrusion detection model to determine whether a vehicle has been attacked. Specifically, considering that the multilayer perceptron (MLP) facilitates the construction of an end-to-end trainable model by stacking several fully connected layers with non-linear activations, it can automatically learn discriminative features from the original input data and optimize parameters through supervised learning, ultimately achieving high-precision classification tasks. Its simple structure is suitable for systems like vehicle intrusion detection with limited computing resources. Therefore, the above intrusion detection model preferably adopts the multilayer perceptron. For example, a large number of labeled (attack behavior or normal behavior) sample embedding vectors (including node embedding vectors and edge embedding vectors) can be pre-collected as a training set to train a 3-layer lightweight multilayer perceptron model to learn different pattern features of normal behavior and attack behavior. The specific model parameters are shown in Table 1 below.

[0075] Table 1

[0076]

[0077] The source of sample embedding vectors can be historical vehicle communication data (including communication data of normal behavior and communication data of attack behavior). After obtaining a large amount of historical vehicle communication data, a sample knowledge graph corresponding to this historical communication data is constructed according to the method described above. Then, graph embedding processing is performed on the sample knowledge graph as described above to obtain a large number of high-quality low-dimensional embedding vectors, including node embedding vectors and edge embedding vectors. Afterwards, experts manually label these embedding vectors with corresponding tags (normal behavior or attack behavior) to obtain sample embedding vectors. After training a multilayer perceptron model based on the sample embedding vectors, a node embedding vector / edge embedding vector from the knowledge graph corresponding to the current communication data is input into the multilayer perceptron model for classification processing. This outputs a probability value used to determine whether the input node embedding vector / edge embedding vector belongs to attack behavior. It is understandable that if the classification results of all node embedding vectors / edge embedding vectors in the knowledge graph corresponding to the current communication data are normal behavior, then the vehicle is determined not to be under attack. If, in the knowledge graph corresponding to the current communication data, there is at least one node embedding vector / edge embedding vector whose classification result is attack behavior, then the vehicle is determined to be under attack.

[0078] The above describes the technical implementation of vehicle intrusion detection. The following describes the technical implementation of attack tracing.

[0079] 102. Determine the anomaly score and centrality score of each node in the knowledge graph, and determine the anomaly score of each edge in the knowledge graph. The anomaly score of each node is determined based on the distance between the node embedding vector of the corresponding node and the nearest normal node cluster center. The centrality score of each node is determined based on the degree centrality of the corresponding node in the knowledge graph. The anomaly score of each edge is determined based on the distance between the edge embedding vector of the corresponding edge and the nearest normal edge cluster center. The normal node cluster center and the normal edge cluster center are learned from the normal sample embedding vectors of the corresponding non-aggressive behaviors through clustering.

[0080] When it is determined that the vehicle has not been attacked, there is no need to perform attack tracing operations. Only when it is determined that the vehicle has been attacked will the attack tracing operations described below be performed to determine the specific attack path of the attack.

[0081] When performing attack attribution analysis, it is necessary to determine the anomaly score and centrality score of each node in the knowledge graph, as well as the anomaly score of each edge. Specifically, the anomaly score of each node can be determined based on the distance between the node's embedding vector and the nearest normal node cluster center. Similarly, the anomaly score of each edge can be determined based on the distance between the edge's embedding vector and the nearest normal edge cluster center. Each normal node cluster center and each normal edge cluster center is learned through clustering from the normal sample embedding vectors of the corresponding non-attack behaviors. For example, the Euclidean distance from each node embedding vector / edge embedding vector to the nearest normal cluster center can be calculated, as shown in the formula below:

[0082]

[0083] in, e i Indicates the first i Each node embedding vector / edge embedding vector has a dimension of . d c represents the value learned through clustering from the embedding vectors of samples corresponding to normal behavior. k A set of normal cluster centers, each of which c k It is the center of a normal behavior cluster.

[0084] The greater the distance between a node embedding vector / edge embedding vector and the nearest normal cluster center, the greater the deviation between the behavior pattern of the node / edge corresponding to that embedding vector and normal behavior. Therefore, the anomalous score of the node / edge corresponding to that embedding vector / edge is determined to be higher. Conversely, the smaller the distance between a node embedding vector / edge embedding vector and the nearest normal cluster center, the smaller the deviation between the behavior pattern of the node / edge corresponding to that embedding vector and normal behavior. Therefore, the anomalous score of the node / edge corresponding to that embedding vector / edge is determined to be lower.

[0085] The centrality score of each node can be determined based on its degree centrality in the knowledge graph. Degree centrality measures the number of direct connections a node has with other nodes, i.e., the number of its directly adjacent neighbors, reflecting its activity or influence within the local network. Each node's centrality score characterizes its activity and structural importance in the knowledge graph. A higher degree centrality value indicates a more "core" or "active" node in the network, resulting in a higher centrality score. Conversely, a lower degree centrality value indicates a more "marginal" or "inactive" node in the network, resulting in a lower centrality score.

[0086] Degree centrality is simple to calculate and highly interpretable. By calculating the degree centrality of each node in a knowledge graph, we can identify hubs and active nodes in the knowledge graph. This is an important indicator for measuring the importance of node structure. The specific formula for calculating degree centrality is as follows:

[0087]

[0088] in, C D ( v i ) indicates the first i Degree centrality of each node, n It refers to the number of nodes in a knowledge graph. A The adjoint matrix representing the knowledge graph. A ij =1 indicates a node i With nodes j Connected, A ij =0 indicates a node i With nodes j Not connected.

[0089] Since edges do not have the concept of degree centrality, there is no need to calculate the centrality score of each edge in the knowledge graph. Therefore, we can now calculate the anomaly score of each node, the centrality score of each node, and the anomaly score of each edge in the knowledge graph.

[0090] 103. Based on the anomaly score and centrality score of each node in the knowledge graph, and the anomaly score of each edge in the knowledge graph, determine the attack path of the attack behavior.

[0091] By analyzing the anomaly score, centrality score, and anomaly score of each edge in the knowledge graph, we can identify which nodes and edges deviate significantly from normal behavior, and which nodes have higher activity and structural importance. These nodes and edges (i.e., nodes and edges with higher anomaly and centrality scores) are more likely to be associated with attack behavior, and the specific attack path can be traced accordingly. The specific generation method of the attack path is described below.

[0092] In one implementation of this application, the attack path of the attack behavior is determined based on the anomaly score and centrality score of each node in the knowledge graph, and the anomaly score of each edge in the knowledge graph, including:

[0093] (1) Based on the anomaly score and centrality score of each node in the knowledge graph, and the anomaly score of each edge in the knowledge graph, construct a suspicious subgraph. The suspicious subgraph consists of a set of suspicious nodes and a set of suspicious edges.

[0094] (2) From the suspicious subgraph, identify all candidate paths whose length does not exceed the first threshold;

[0095] (3) For each candidate path, determine the total abnormal score of the candidate path based on the abnormal scores and centrality scores of each node contained in the candidate path, as well as the abnormal scores of each edge contained in the candidate path.

[0096] (4) Select the top k candidate paths with the highest total anomaly score that exceeds the second threshold from all candidate paths as attack paths, where k≥1.

[0097] When generating attack paths, firstly, based on the anomaly score and centrality score of each node and the anomaly score of each edge in the knowledge graph, suspicious nodes and edges are identified. The suspicious nodes form a suspicious node set, and the suspicious edges form a suspicious edge set. These sets together constitute a suspicious subgraph. The suspicious subgraph, partitioned from the knowledge graph, likely contains a portion of the graph structure from which the attack path is found. Compared to traversing the entire knowledge graph to find attack paths, first partitioning the knowledge graph into a suspicious subgraph and then searching for attack paths within it effectively improves the efficiency and accuracy of attack path finding while reducing computational resource consumption. After constructing the suspicious subgraph, considering that attack links in a relatively closed environment like an in-vehicle network are usually not very long, and to limit the search space and prevent excessively long search paths, a first threshold can be set. L , L This is a maximum path length, for example, it can be set to 4, which means the maximum path length is 4 nodes. Starting from each node in the suspicious subgraph, enumerate all paths whose length does not exceed the first threshold. LThe paths are selected as candidate paths. Then, for each candidate path, the total anomaly score is determined based on the anomaly scores and centrality scores of each node and edge within that path. Generally, the higher the anomaly scores and centrality scores of each node and edge within a candidate path, the higher its total anomaly score. Finally, candidate paths with a total anomaly score exceeding a second threshold (e.g., 10) are selected from all candidate paths and ranked in descending order of total anomaly score. The top-ranked candidate paths are the high-confidence attack paths. In practice, the top k candidate paths with the highest total anomaly scores exceeding the second threshold can be selected as attack paths, where k ≥ 1. For example, assuming the second threshold is 10 and k is 3, the top 3 candidate paths with the highest total anomaly scores are selected from all candidate paths with total anomaly scores exceeding 10 as the final identified attack paths. The attack paths obtained in this way clearly show the starting point, jump process and ending point of the attack behavior, which can ensure the efficiency and low computational cost of the path detection process.

[0098] In one implementation of this application, a suspicious subgraph is constructed based on the anomaly score and centrality score of each node in the knowledge graph, and the anomaly score of each edge in the knowledge graph, including:

[0099] (1) For each node in the knowledge graph, if the anomaly score of the node exceeds the third threshold and the centrality score exceeds the fourth threshold, then the node is selected into the suspicious node set.

[0100] (2) For each node in the suspicious node set, if the abnormal score of the edge connecting the node exceeds the third threshold, the edge connecting the node will be selected into the suspicious edge set.

[0101] When constructing the suspicious subgraph, thresholds can be set for both the anomaly score and the centrality score. The threshold set for the anomaly score is called the third threshold, typically set to 0.8, and the threshold set for the centrality score is called the fourth threshold, typically set to 2.5. After setting these two thresholds, each node in the knowledge graph is traversed. If the anomaly score of a node exceeds the third threshold and its centrality score exceeds the fourth threshold, then the node is selected into the suspicious node set Vanom; otherwise, it is not selected. After traversing all nodes in the knowledge graph, the suspicious node set Vanom is determined. Next, each node in the suspicious node set Vanom is traversed. If the anomaly score of an edge connecting to that node exceeds the third threshold, then that edge is selected into the suspicious edge set Eanom; otherwise, it is not selected. After traversing all nodes in the suspicious node set Vanom, the suspicious edge set Eanom is determined. This yields the suspicious subgraph composed of the suspicious node set Vanom and the suspicious edge set Eanom. For example, suppose a node A in a knowledge graph has an anomaly score of 0.85 and a centrality score of 15, and another node B has an anomaly score of 0.3 and a centrality score of 2. The anomaly score threshold (i.e., the third threshold) is 0.8, and the centrality score threshold (i.e., the fourth threshold) is 2.5. Then only node A, whose anomaly score and centrality score both exceed the threshold, will be selected into the suspicious node set Vanom. As for the edges connected to node A, if their own anomaly score also exceeds the anomaly score threshold, they will be selected into the suspicious edge set Eanom, and so on.

[0102] In one implementation of this application, the total anomaly score of the candidate path is determined based on the anomaly scores and centrality scores of each node included in the candidate path, and the anomaly scores of each edge included in the candidate path, including:

[0103] (1) For each node in the candidate path, perform a weighted summation of the outlier score and centrality score of the node to obtain the weighted score of the node;

[0104] (2) Calculate the sum of the weighted scores of each node in the candidate path and the abnormal scores of each edge in the candidate path to obtain the total abnormal score of the candidate path.

[0105] To calculate the total anomaly score of a candidate path, first, for each node in the candidate path, perform a weighted summation of its anomaly score and centrality score to obtain its weighted score. Then, sum the weighted scores of all nodes in the candidate path with the anomaly scores of all edges in the candidate path to obtain the total anomaly score of the candidate path. For example, assuming a candidate path contains 3 nodes n1, n2, n3 and 2 edges e1, e2, the total anomaly score of the candidate path can be calculated using the following formula:

[0106]

[0107] Where S represents the total abnormal score, A n This represents the anomaly score of a node. C n A represents the centrality score of a node. e Indicates the outlier score of the edge. α and γ It is an adjustable weighting coefficient. Since the core objective of attack attribution tracing is to find the most anomalous path, anomalous scores can be assigned higher weights, for example, by setting a weighting coefficient. α = γ= 0.7. In the above formula, the first part represents the weighted score of each node in the candidate path, and the second part represents the anomaly score of each edge in the candidate path. By summing the two parts, the total anomaly score of the candidate path can be accurately calculated.

[0108] In the technical solution of this application embodiment, since the anomaly score is determined based on the distance between the embedding vector of a node or edge and the center of a normal cluster, the anomaly score of each node or edge can be used to characterize the deviation between the behavior pattern of the corresponding node or edge and normal behavior. Since the centrality score of each node is determined based on the degree centrality of the corresponding node in the knowledge graph, and the degree centrality means counting the number of directly adjacent neighbor nodes of a node, the centrality score of each node can be used to characterize the activity level and structural importance of the corresponding node in the knowledge graph. Therefore, by analyzing the anomaly score and centrality score of each node in the knowledge graph, as well as the anomaly score of each edge in the knowledge graph, it is possible to determine which nodes and edges have a larger deviation from normal behavior, and which nodes have higher activity and structural importance. These nodes and edges are more likely to be related to attack behavior, and thus the specific attack path can be traced, thereby improving the interpretability of intrusion detection results.

[0109] As an example, Figure 2 This is a schematic diagram of the overall architecture of the vehicle intrusion detection attack tracing method provided in this application embodiment. Figure 2First, a knowledge graph is constructed. After acquiring heterogeneous vehicle communication data from multiple sources, including HTTP traffic data, Bluetooth data, and vehicle log data, entity recognition and relation extraction are performed on this communication data to obtain entity-relation-entity triples, thus constructing the corresponding knowledge graph. Next, graph embedding processing is performed on the knowledge graph. Here, the knowledge graph is first input into an agent trained using reinforcement learning methods. The agent outputs optimal return parameters and optimal input / output parameters that fit the current knowledge graph. Then, the Node2Vec algorithm is run according to these optimal return and input / output parameters to generate high-quality low-dimensional embedding vectors. Afterward, the intrusion detection stage begins. The generated low-dimensional embedding vectors (including node embedding vectors and edge embedding vectors) are input into a pre-trained 3-layer lightweight multilayer perceptron model for classification, which can determine whether each low-dimensional embedding vector belongs to normal behavior or attack behavior. If at least one low-dimensional embedding vector belongs to the attack behavior, the attack tracing process is initiated. Based on the anomaly score and centrality score of each node, as well as the anomaly score of each edge, a suspicious anomaly subgraph is constructed. Then, the attack paths with higher total anomaly scores are found from the subgraph.

[0110] In summary, the technical solution of this application, by fusing multi-source heterogeneous data to construct a knowledge graph and utilizing reinforcement learning to optimize embedding, comprehensively captures the characteristics of complex attacks. In a real multi-vehicle intrusion detection experiment, the detection accuracy for HTTPMitM attacks reached 99.17%, with a recall rate and F1-score both reaching 98.48%, demonstrating excellent vehicle intrusion detection performance. Furthermore, this technical solution employs a lightweight neural network detection model and an efficient graph embedding mechanism, resulting in extremely fast system inference speed, with an average inference latency of only 0.33ms and CPU memory overhead of only 0.3MB, indicating extremely low resource consumption and fully meeting the deployment requirements of vehicle environments. In addition, this technical solution also possesses interpretable attack tracing capabilities. It can not only detect attack behavior but also automatically reconstruct the complete multi-stage attack path, clearly identifying key evidence such as the attacker's forged IP addresses and hijacked communication sessions. This greatly improves the interpretability and practicality of the detection results, providing direct evidence for subsequent security responses.

[0111] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0112] The above mainly describes an attack tracing method for vehicle-mounted intrusion detection. The following will describe an attack tracing device for vehicle-mounted intrusion detection.

[0113] Please see Figure 3 This application illustrates an attack tracing device for vehicle intrusion detection provided in an embodiment of the present application, comprising:

[0114] The knowledge graph acquisition module 301 is used to acquire a knowledge graph constructed based on the current communication data when it is determined that the vehicle has been attacked based on the current communication data of the vehicle. The knowledge graph has obtained the node embedding vector of each node and the edge embedding vector of each edge through graph embedding processing.

[0115] The score determination module 302 is used to determine the anomaly score and centrality score of each node in the knowledge graph, and to determine the anomaly score of each edge in the knowledge graph. The anomaly score of each node is determined based on the distance between the node embedding vector of the corresponding node and the nearest normal node cluster center. The centrality score of each node is determined based on the degree centrality of the corresponding node in the knowledge graph. The anomaly score of each edge is determined based on the distance between the edge embedding vector of the corresponding edge and the nearest normal edge cluster center. The normal node cluster center and the normal edge cluster center are learned from the normal sample embedding vectors of the corresponding non-aggressive behaviors through clustering.

[0116] The attack path determination module 303 is used to determine the attack path of the attack behavior based on the abnormal score and centrality score of each node in the knowledge graph, as well as the abnormal score of each edge in the knowledge graph.

[0117] In one implementation of this application, the attack path determination module includes:

[0118] The Suspicious Subgraph Construction Unit is used to construct a suspicious subgraph based on the anomaly score and centrality score of each node in the knowledge graph, as well as the anomaly score of each edge in the knowledge graph. The suspicious subgraph consists of a set of suspicious nodes and a set of suspicious edges.

[0119] The candidate path determination unit is used to determine all candidate paths whose length does not exceed a first threshold from the suspicious subgraph;

[0120] The path anomaly score determination unit is used to determine the total anomaly score of each candidate path based on the anomaly score and centrality score of each node contained in the candidate path, as well as the anomaly score of each edge contained in the candidate path.

[0121] The attack path selection unit is used to select the top k candidate paths with the highest total anomaly score exceeding the second threshold from all candidate paths, and to use them as attack paths, where k≥1.

[0122] In one implementation of this application, the suspicious subgraph construction unit includes:

[0123] The suspicious node selection sub-unit is used to select each node in the knowledge graph if its anomaly score exceeds the third threshold and its centrality score exceeds the fourth threshold.

[0124] The suspicious edge selection sub-unit is used to select the edge connecting to each node in the suspicious node set into the suspicious edge set if the abnormal score of the edge connecting to that node exceeds the third threshold.

[0125] In one implementation of this application, the path anomaly score determination unit includes:

[0126] The weighted score calculation subunit is used to perform a weighted summation of the outlier score and centrality score of each node in the candidate path to obtain the weighted score of the node.

[0127] The path anomaly score calculation subunit is used to calculate the sum of the weighted scores of each node in the candidate path and the anomaly scores of each edge in the candidate path to obtain the total anomaly score of the candidate path.

[0128] In one implementation of this application, the vehicle-mounted intrusion detection attack tracing device further includes:

[0129] The entity recognition module is used to identify security-related entities from the current communication data based on the analyzed and refined known threat information.

[0130] The session reconstruction module is used to decode the application layer protocol from the current communication data and aggregate the fragmented data packets contained in the current communication data into a communication session with complete semantics.

[0131] The knowledge graph construction module is used to perform application-layer semantic analysis on communication sessions, capture the temporal dependencies and contextual relationships between events involved in the communication session, and infer the entity-relationship-entity triples with security significance by combining each entity. The triples constitute the knowledge graph.

[0132] In one implementation of this application, the entity recognition module includes:

[0133] The data conversion unit is used to convert the current communication data into a text data stream in a unified format;

[0134] The entity extraction unit is used to extract candidate entities from the text data stream using a trained deep semantic understanding model.

[0135] The entity selection unit is used to select entities from the candidate entities by combining known threat information.

[0136] In one implementation of this application, the vehicle-mounted intrusion detection attack tracing device further includes:

[0137] The optimal parameter determination module is used to determine the optimal return parameters and optimal input / output parameters of the Node2Vec algorithm adapted to the knowledge graph through reinforcement learning methods.

[0138] The graph embedding processing module is used to perform graph embedding processing on the knowledge graph using the Node2Vec algorithm according to the optimal return parameters and the optimal input and output parameters.

[0139] In one implementation of this application, the optimal parameter determination module includes:

[0140] The policy network processing unit takes the structure of the knowledge graph as its state and inputs it into the trained policy network. It determines the optimal return parameters and optimal input / output parameters based on the actions output by the policy network. The policy network is an agent trained using reinforcement learning. The actions output by the policy network are a pair of return parameters and input / output parameters determined based on the input state. The reward for the policy network during training is the detection accuracy of the embedded vector data generated after executing the Node2Vec algorithm using the determined pair of return parameters and input / output parameters in the downstream intrusion detection task.

[0141] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the attack tracing method for vehicle intrusion detection described in any of the above embodiments.

[0142] This application also provides a computer program product that, when run on an electronic device, causes the electronic device to execute the attack tracing method for vehicle intrusion detection as described in any of the above embodiments.

[0143] Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 4 in this embodiment includes: a processor 40, a memory 41, and a computer program 42 stored in the memory 41 and executable on the processor 40. When the processor 40 executes the computer program 42, it implements the steps in the embodiments of the above-described vehicle intrusion detection attack tracing methods, for example... Figure 1 Steps 101-103 are shown. Alternatively, when the processor 40 executes the computer program 42, it implements the functions of each module / unit in the above-described device embodiments, for example, implementing... Figure 3 The functions of modules 301-303 of the device shown.

[0144] The computer program 42 can be divided into one or more modules / units, which are stored in the memory 41 and executed by the processor 40 to complete this application. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program 42 in the electronic device 4.

[0145] The processor 40 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0146] The memory 41 can be an internal storage unit of the electronic device 4, such as a hard disk or memory. The memory 41 can also be an external storage device of the electronic device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. Furthermore, the memory 41 can include both internal and external storage units of the electronic device 4. The memory 41 is used to store the computer program and other programs and data required by the electronic device. The memory 41 can also be used to temporarily store data that has been output or will be output.

[0147] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0148] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0149] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0150] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0151] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units through some interfaces, and may be electrical, mechanical, or other forms.

[0152] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0153] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0154] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0155] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for tracing the attack source of vehicle-mounted intrusion detection, characterized in that, include: When it is determined that the vehicle has been attacked based on the vehicle's current communication data, a knowledge graph constructed based on the current communication data is obtained. The knowledge graph has obtained the node embedding vector of each node and the edge embedding vector of each edge through graph embedding processing. The anomaly score and centrality score of each node in the knowledge graph are determined, as are the anomaly score of each edge in the knowledge graph. The anomaly score of each node is determined based on the distance between its node embedding vector and the nearest normal node cluster center. The centrality score of each node is determined based on its degree centrality in the knowledge graph. The anomaly score of each edge is determined based on the distance between its edge embedding vector and the nearest normal edge cluster center. The normal node cluster centers and normal edge cluster centers are learned from the normal sample embedding vectors of corresponding non-aggressive behaviors through clustering. Based on the anomaly score and centrality score of each node in the knowledge graph, and the anomaly score of each edge in the knowledge graph, a suspicious subgraph is constructed, which consists of a set of suspicious nodes and a set of suspicious edges. From the suspicious subgraph, determine all candidate paths whose length does not exceed a first threshold; For each candidate path, the total anomaly score of the candidate path is determined based on the anomaly scores and centrality scores of each node contained in the candidate path, as well as the anomaly scores of each edge contained in the candidate path. From all the candidate paths, select the top k candidate paths with the highest total anomaly score exceeding the second threshold as the attack paths, where k ≥ 1.

2. The method as described in claim 1, characterized in that, The step of constructing a suspicious subgraph based on the anomaly score and centrality score of each node in the knowledge graph, and the anomaly score of each edge in the knowledge graph, includes: For each node in the knowledge graph, if the anomaly score of the node exceeds the third threshold and the centrality score exceeds the fourth threshold, then the node is selected into the set of suspicious nodes. For each node in the set of suspicious nodes, if the abnormal score of the edge connecting to that node exceeds the third threshold, then the edge connecting to that node is selected into the set of suspicious edges.

3. The method as described in claim 1, characterized in that, The step of determining the total anomaly score of the candidate path based on the anomaly scores and centrality scores of each node contained in the candidate path, as well as the anomaly scores of each edge contained in the candidate path, includes: For each node in the candidate path, perform a weighted summation of the outlier score and centrality score of that node to obtain the weighted score of that node; The total abnormal score of the candidate path is obtained by summing the weighted scores of each node in the candidate path with the abnormal scores of each edge in the candidate path.

4. The method as described in claim 1, characterized in that, The knowledge graph is constructed in the following way: Based on the analyzed and refined known threat information, identify the various security-related entities from the current communication data; Decode the application layer protocol from the current communication data, and aggregate the fragmented data packets contained in the current communication data into a communication session with complete semantics; The communication session is subjected to application-layer semantic analysis to capture the temporal dependencies and contextual relationships between the events involved in the communication session, and the entity-relationship-entity triples with security significance are inferred in combination with the various entities. The triples constitute the knowledge graph.

5. The method as described in claim 4, characterized in that, The process of identifying security-related entities from the current communication data based on the analyzed and refined known threat information includes: Convert the current communication data into a text data stream in a unified format; Candidate entities are extracted from the text data stream using a trained deep semantic understanding model; Based on the known threat information, each entity is selected from the candidate entities.

6. The method according to any one of claims 1 to 5, characterized in that, The graph embedding process of the knowledge graph includes: By using reinforcement learning methods, the optimal return parameters and optimal input / output parameters of the Node2Vec algorithm adapted to the knowledge graph are determined. Based on the optimal return parameters and the optimal input / output parameters, the Node2Vec algorithm is used to perform graph embedding processing on the knowledge graph.

7. The method as described in claim 6, characterized in that, The step of determining the optimal return parameters and optimal input / output parameters of the Node2Vec algorithm adapted to the knowledge graph through reinforcement learning methods includes: The structure of the knowledge graph is used as the state and input to a trained policy network. The optimal return parameter and the optimal input / output parameter are determined by the action output by the policy network. The policy network is an agent trained using reinforcement learning. The action output by the policy network is a pair of return parameters and input / output parameters determined based on the input state. The reward for the policy network during training is the detection accuracy of the embedded vector data generated after executing the Node2Vec algorithm using the determined pair of return parameters and input / output parameters in the downstream intrusion detection task.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the attack tracing method for vehicle intrusion detection as described in any one of claims 1 to 7.

9. A computer program product, characterized in that, When the computer program product is run on an electronic device, the electronic device performs the attack tracing method for vehicle intrusion detection as described in any one of claims 1 to 7.

Images