Vehicle information security monitoring method, device and equipment, vehicle and medium

Abstract

The present application relates to the technical field of vehicle information security, and in particular to a vehicle information security monitoring method, device, equipment, vehicle and medium. The method comprises the following steps: acquiring multi-source heterogeneous logs of a vehicle; preprocessing the multi-source heterogeneous logs, extracting log type features according to the log types based on the preprocessing results; uniformly encoding the log type features to obtain a time sequence feature sequence; inputting the time sequence feature sequence into an information security monitoring model, identifying a composite attack and outputting a cross-log attack path, which can solve the technical problem that a traditional single-source detection cannot identify a cross-layer attack chain.

Description

Technical Field

[0001] This invention relates to the field of vehicle information security technology, specifically to a vehicle information security monitoring method, device, equipment, vehicle, and medium. Background Technology

[0002] With the rapid development of intelligent connected vehicles, 5G, and V2X (Vehicle to Everything) technologies, the Internet of Vehicles (IoV) faces multi-dimensional security risks, including network intrusion, data tampering, command hijacking, and vulnerability exploitation. To ensure vehicle security, the industry generally deploys IDPS (Intrusion Detection and Prevention System) on the vehicle side to collect data such as security logs, network traffic, CAN messages, and system status and upload it to the cloud. However, current mainstream solutions adopt a "collect-as-storage" model, where the cloud only performs simple aggregation and directly presents the data to security operations personnel.

[0003] Current technologies primarily suffer from limited analytical dimensions, lacking multi-dimensional fusion analysis that integrates temporal characteristics, behavioral patterns, threat intelligence, and AI anomaly detection. Single-dimensional detection often leads to numerous false alarms, making it difficult for security personnel to distinguish genuine threats from a massive volume of alerts. Furthermore, complex attacks cannot be correlated and identified: Vehicle network attacks often exhibit cross-layer characteristics. For example, attackers might first discover vulnerabilities through network scanning, then exploit these vulnerabilities to escalate system privileges, ultimately hijacking the CAN bus to send malicious commands. Current technologies lack correlation modeling of events at the network, system, and bus layers, making it impossible to identify such complex attack chains. This results in attacks being broken down into isolated events, and traditional correlation analysis struggles with overly complex attack chains. Most importantly, it cannot be iteratively upgraded.

[0004] Taking a certain OEM as an example, the daily alarm volume reaches hundreds of thousands, with a cumulative alarm volume exceeding one million. The operations and maintenance team faces the following two dilemmas. First, alarm overload makes manual processing impossible: the massive number of alarms far exceeds the capacity for manual analysis, and a large number of alarms are simply ignored. Second, the false alarm rate is high and difficult to distinguish: due to the lack of multi-dimensional correlation analysis, a large number of false alarms are mixed with real threats, leading to the "boy who cried wolf" effect, and security personnel gradually become desensitized to alarms.

[0005] Therefore, there is an urgent need to establish a vehicle-to-everything (V2X) security assessment system that integrates "precise pre-event identification, in-event correlation analysis, and in-depth post-event tracing" to transform massive amounts of alarms into operational security intelligence. Summary of the Invention

[0006] The present invention aims to provide a vehicle information security monitoring method, device, equipment, vehicle and medium, which can solve the technical problem that traditional single-source detection cannot identify cross-layer attack chains.

[0007] To address the aforementioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a vehicle information security monitoring method, comprising: Obtain multi-source heterogeneous logs of vehicles; The multi-source heterogeneous logs are preprocessed, and log type features are extracted based on the preprocessing results according to log type. The log type features are uniformly encoded to obtain a time-series feature sequence; The time-series feature sequence is input into the information security monitoring model to identify complex attacks and output cross-log attack paths; The step of inputting the time-series feature sequence into the information security monitoring model to identify composite attacks and output cross-log attack paths includes: An input representation is constructed based on the time-series feature sequence and the log type feature; wherein the time-series feature sequence and the log type feature are fused using a gating mechanism. Based on the input representation, a dynamic bias matrix is ​​constructed to adjust the original attention score matrix, thereby obtaining the target attention score matrix; Based on the input representation and the target attention score matrix, a cross-sequence attention head is constructed and a global representation is output. The global representation is used to represent composite attack and cross-log attack paths.

[0008] In one embodiment, the fusion expression of the time-series feature sequence and the log type feature is:

[0009] in, In time The gate vector, It is the sigmoid activation function. This is the weight matrix. For bias terms, Temporal feature sequence vector With log type tags splicing operation, The fused output vector For element-wise product; The expression representing the input is:

[0010] in, This is a dense vector of log type labels after being mapped by the embedding layer. It is a time-series feature sequence vector.

[0011] In one embodiment, the expression for the target attention score matrix is:

[0012] in, For attention score matrix, For querying the matrix, The key matrix, For value matrices, Let be the dimension of the key vector. For embedding by log type The generated dynamic bias matrix.

[0013] In one embodiment, the expression for the cross-sequence attention head is:

[0014] in, For the first The first layer The output of each attention head, For the first The query matrix corresponding to each attention head. For the first The key matrix corresponding to each attention head For the first The value matrix corresponding to each attention head For the first Layer Each attention head has a unique dynamic bias matrix.

[0015] In one embodiment, the vehicle information security monitoring method further includes: The information security monitoring model is trained using a contrastive loss function, the expression of which is:

[0016] in, For the sample eigenvectors, For the sample eigenvectors, For the sample eigenvectors, The cosine similarity function is used. This is the temperature coefficient.

[0017] In a second aspect, the present invention provides a vehicle information security monitoring device, comprising: The acquisition module is used to acquire multi-source heterogeneous logs of vehicles; The processing module is used to preprocess multi-source heterogeneous logs, extract log type features based on the preprocessing results, and perform unified feature encoding on the log type features to obtain a time-series feature sequence. The cloud-based analytics module is used to input time-series feature sequences into the information security monitoring model, identify complex attacks, and output cross-log attack paths. The cloud analytics module is further configured as follows: An input representation is constructed based on the time-series feature sequence and the log type feature; wherein the time-series feature sequence and the log type feature are fused using a gating mechanism. Based on the input representation, a dynamic bias matrix is ​​constructed to adjust the original attention score matrix, thereby obtaining the target attention score matrix; Based on the input representation and the target attention score matrix, a cross-sequence attention head is constructed and a global representation is output. The global representation is used to represent composite attack and cross-log attack paths.

[0018] Thirdly, the present invention provides an electronic device including a processor, a memory, and a communication bus, wherein the communication bus is used to realize a communication connection between the processor and the memory, and the processor is used to execute a computer program stored in the memory to realize the vehicle information security monitoring method as described in the first aspect.

[0019] Fourthly, the present invention also provides a vehicle that includes the electronic equipment described in the third aspect.

[0020] Fifthly, the present invention also provides a computer-readable storage medium storing a computer program; the computer program can be executed by a processor to implement the vehicle information security monitoring method as described in the first aspect.

[0021] In summary, the present invention has at least the following beneficial technical effects: 1. This invention adopts a cross-log type attack chain correlation modeling mechanism, which treats network logs, system logs, and CAN logs as multimodal time sequences. Through the cross-modal attention network of Transformer, the temporal correlation modeling among the three is realized, which automatically discovers composite attack paths such as "port scanning-vulnerability exploitation-system privilege escalation-CAN command hijacking", thus solving the technical problem that traditional single-source detection cannot identify cross-layer attack chains.

[0022] 2. This invention is based on an adaptive attention mechanism for log types. It introduces log type embedding and dynamic bias matrix, enabling the model to adaptively adjust the attention distribution according to different categories such as abnormal behavior logs, system security logs, network attack logs, and CAN signal logs. This allows for the accurate capture of unique abnormal patterns in various log types and improves detection accuracy.

[0023] 3. This invention employs an attack chain correlation strength matrix, which calculates the correlation strength between events of different log types through cross-sequence attention heads, and outputs a dynamic attack chain graph to support security operations personnel in quickly locating the root cause of attacks.

[0024] 4. This invention enhances the discriminative power of attack chains through contrastive learning, introducing contrastive loss at the attack chain level, enabling the model to distinguish between accidental event associations and malicious attack chains, thereby reducing the false positive rate. Attached Figure Description

[0025] Figure 1 This is a flowchart of the vehicle information security monitoring method in an embodiment of the present invention; Figure 2 This is a flowchart of step S160 of the vehicle information security monitoring method according to an embodiment of the present invention.

[0026] Figure 3 This is a structural block diagram of the vehicle information security monitoring device according to an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0028] This invention provides a method for monitoring vehicle information security.

[0029] refer to Figure 1 The vehicle information security monitoring method includes the following steps: S100: Obtain multi-source heterogeneous logs of vehicles.

[0030] IDPS, installed on vehicle components such as TBOX (Telematics Box), IVI (In-Vehicle Infotainment), and CGW (Central Gateway), collects four types of core logs: abnormal behavior logs, system security logs, network attack logs, and CAN anomaly logs.

[0031] The abnormal behavior logs include records of vehicle system operations, permission changes, application startup / uninstallation, and background processes. System security logs include core log errors, vulnerability alerts, permission anomalies, file tampering, and abnormal app closures. Network attack logs include malformed packets, NIDS (Network Intrusion Detection System) alerts, port scans, and DDoS (Distributed Denial of Service) attack records. CAN anomaly logs include CANID anomalies, signal value anomalies, DLC anomalies, load rate anomalies, and periodicity anomalies.

[0032] S120: Preprocess multi-source heterogeneous logs and extract log type features based on the preprocessing results.

[0033] Preprocessing includes data anonymization, time-series alignment, and format standardization to address the heterogeneity of multi-source data.

[0034] Data anonymization is used to anonymize sensitive information such as VIN, GPS, and IP. Time alignment is used to standardize UTC (Coordinated Universal Time) millisecond timestamps and correct clock drift. Format standardization is used to standardize the JSON schema (application / schema + JSON), including common fields such as source, type, and timestamp.

[0035] When extracting log type features, abnormal behavior logs include: privilege escalation sequences, sensitive file access sequences, high / low frequency of operations, and permission change characteristics. System security logs include: CNVD vulnerability matching, discovery of unpatched vulnerabilities, sudo abuse, and file permission tampering characteristics. Network attack logs include: source / destination IP network segments, port protocols, traffic surges, attack behaviors, port scanning, and abnormal external connections. CAN signal logs include: message ID, DLC, period deviation, mutation values, threshold outages, and reserved bit checksums, and preliminary verification is performed according to DLC / period / threshold / mutation value rules.

[0036] Through the above preprocessing and feature engineering, structured and type-aware input features can be provided for cloud analysis modules and information security monitoring models, supporting accurate security risk assessment.

[0037] S140: Perform unified feature encoding on log type features to obtain a time-series feature sequence.

[0038] When using unified feature encoding, text-based features, such as attack payloads and operation commands, are embedded using a security log-specific tokenizer. Numerical features, such as frequency, period, and IP address, are embedded after discrete encoding / normalization. CAN message features are embedded using dedicated embedding for message ID, period, and data fields, preserving temporal relationships.

[0039] S160: Input the time-series feature sequence into the information security monitoring model to identify complex attacks and output cross-log attack paths.

[0040] The information security detection model employs an edge decision tree model, introducing a cross-log type attention layer. It uses the temporal feature sequences of system security logs, network attack logs, and CAN anomaly logs as multimodal input. While identifying anomalies in different log categories, it calculates the correlation strength matrix between events of different log types through attention cross-correlation, adjusting cross-log correlation attention accordingly. This enables the correlation modeling of the entire attack chain from port scanning to vulnerability exploitation to system privilege escalation to CAN command hijacking. It establishes cross-modal attention from network attack logs to system security logs to CAN anomaly logs, calculates the correlation strength matrix, automatically discovers cross-log attack paths, and can identify composite attacks.

[0041] In implementation, multi-sequence alignment is performed first, followed by cross-type attention calculation, and finally, an association strength matrix is ​​generated. Multi-sequence alignment aligns the three types of logs according to a unified time window, forming three parallel sequences. Cross-type attention calculation, based on self-attention, adds a cross-sequence attention head, enabling the information security detection model to learn the temporal dependency between "network anomaly events" and "subsequent system privilege escalation events." The association strength matrix, based on accumulated security logs and incorporating historical attack chains, outputs a cross-log association matrix, where high-weight regions identify event pairs that may constitute an attack chain.

[0042] refer to Figure 2 In one specific implementation, S160 includes the following steps: S200: Construct input representations based on time-series feature sequences and log type features.

[0043] When edge nodes upload log data, they attach log type tags (predefined categories: system_log, security_log, can_anomaly, tsp_runtime, behavior_anomaly, etc.), which are then mapped into dense vectors by the embedding layer. , For dimension ( A vector space with dimensions of ( ).

[0044] Embed the log type in each layer of the Transformer encoder. With time-series feature sequence vectors By fusing the data, a type-aware input representation can be formed:

[0045] The fusion method employs a gating mechanism:

[0046] in, In time The gate vector, It is the sigmoid activation function. This is the weight matrix. For bias terms, Temporal feature sequence vector With log type tags splicing operation, The fused output vector This is an element-wise product.

[0047] This gating mechanism dynamically controls the fusion ratio of log type features and time-series feature sequences, enabling the information security monitoring model to adaptively emphasize or weaken the impact of type information under different log types.

[0048] Constructing input representations based on time-series feature sequences and log type features is fundamental to S160. Time-series feature sequences reflect the changing patterns of events over time, while log type features highlight the characteristics of different event types. Combining these two types of features to construct input representations can comprehensively characterize the features of information security events, providing rich and valuable information for subsequent steps.

[0049] S220: Based on the input representation, construct a dynamic bias matrix to adjust the original attention score matrix and obtain the target attention score matrix.

[0050] When calculating self-attention, an embedding of log type is introduced. The generated dynamic bias matrix This is used to adjust the original attention score matrix to obtain the target attention score matrix:

[0051] in, For attention score matrix, For querying the matrix, The key matrix, For value matrices, Let be the dimension of the key vector. For embedding by log type The generated dynamic bias matrix.

[0052] Dynamic bias matrix Embedded from log types using a lightweight neural network (such as a two-layer MLP). Dynamically generated and extended to the time dimension. This dynamic bias matrix represents the prior attention levels between different time steps for a specific log type.

[0053] For example, when processing CAN anomaly logs, the information security monitoring model automatically increases the attention weight to consecutive time steps (such as the most recent 10 CAN messages) to capture sudden abnormal command sequences within a short period (such as unexpected braking commands). When processing abnormal behavior logs, the information security monitoring model increases its focus on long-term behavior patterns to detect slowly evolving attack chains (such as "privilege probing → privilege escalation attempts → sensitive operations"). When processing TSP operation logs, the information security monitoring model increases its focus on cross-session correlations to identify abnormal request patterns from the cloud or the app (such as high-frequency vehicle location queries).

[0054] The construction of a dynamic bias matrix to adjust the original attention score matrix is ​​based on the input representation. The original attention score matrix, calculated from the input representation, reflects the degree of correlation between different features. However, in information security monitoring scenarios, the importance of different time-series and log features may change under different circumstances. The construction of a dynamic bias matrix can adjust the original attention score matrix according to specific situations, highlighting the importance of key features and suppressing the influence of irrelevant features, making the attention mechanism more flexible and adaptive, thereby more accurately capturing key information in information security incidents.

[0055] S240: Based on the input representation and the target attention score matrix, construct a cross-sequence attention head and output a global representation. The global representation is used to represent composite attack and cross-log attack paths.

[0056] In multi-head attention, a subset of attention heads are dedicated to learning patterns for specific log types. The total number of attention heads is then adjusted. Classified into general headers ( ) and type-specific headers ( Attention computation of type-specific headers explicitly depends on log type embeddings. Its output is:

[0057] in, For the first The first layer The output of each attention head, For the first The query matrix corresponding to each attention head. For the first The key matrix corresponding to each attention head For the first The value matrix corresponding to each attention head For the first Layer Each attention head has its own unique dynamic bias matrix. Finally, the outputs of all attention heads are concatenated and merged to form a global representation that adapts to the log type.

[0058] By injecting log type encoding and dynamically adjusting attention weights, the information security detection model can adaptively adjust the attention distribution according to the currently analyzed log category (such as abnormal behavior logs, security logs, system security logs, CAN abnormal logs, TSP operation logs, etc.), thereby improving the accuracy of identifying potential threats in various logs.

[0059] In an optional implementation of this application, to further enhance the information security monitoring model's ability to discriminate abnormal patterns under different log types, type-aware contrastive learning loss is introduced during the training phase. For the same sample, two views are generated through data augmentation (such as time masking and feature perturbation), while retaining its log type label. The goal of contrastive learning is to make the representations of normal samples under the same log type closer to each other and the representations of normal samples under different log types farther apart in the feature space, thereby strengthening the discriminative representation of log types.

[0060] The contrastive loss function is defined as follows:

[0061] in, For the feature vector of the sample, For the sample eigenvectors, For the sample eigenvectors, The cosine similarity function is used. This is the temperature coefficient.

[0062] By setting the aforementioned loss function, the information security monitoring model can learn to distinguish between log anomalies, attacks, and false alarms, and aggregate similar logs together to prevent interference. Furthermore, the information security monitoring model can not only identify anomalies but also learn the characteristics of log types effectively, achieving greater accuracy, stability, stronger generalization against new types of attacks, resistance to noise interference, and cross-scenario applicability.

[0063] In summary, through the construction of input representations and the adjustment of the attention score matrix, the cross-sequence attention head can interact and fuse information between multiple temporal feature sequences. It can integrate information from different temporal feature sequences and log features to analyze and understand information security events from a global perspective, outputting a comprehensive global representation that reflects the information security situation. This global representation can help information security monitoring and analysis to better perform tasks such as identifying abnormal events and predicting security threats.

[0064] In an optional implementation of this application, the security monitoring model can also be optimized in a closed loop. Simply add the confirmed composite attack samples to the training set, label the attack chain, and pass the composite attack patterns identified in the cloud to the edge decision tree through knowledge distillation. Then, the IDPS policy is issued to the vehicle's IDPS through the cloud VSOC (Vehicle Safety Operations Center), thereby improving the early warning capability of the edge side against similar attacks.

[0065] In summary, by employing the Transformer model to identify complex attacks in the Internet of Vehicles (IoV), compared to traditional detection methods, the following technical challenges are primarily addressed: It solves the problem of identifying cross-layer attack chains with long temporal dependencies. Complex attacks often exhibit characteristics of large time spans and dispersed attack steps; for example, "port scanning" may have occurred minutes ago, "vulnerability exploitation" seconds ago, and "CAN command hijacking" currently occurring. Traditional sequence models such as RNNs and LSTMs suffer from the vanishing gradient problem, making it difficult to capture long temporal dependencies spanning minutes. The Transformer, through its self-attention mechanism, can directly calculate the correlation weights between any two time steps in the sequence, establishing effective connections regardless of the distance between them, thereby identifying complete attack chains spanning time windows.

[0066] This invention also provides a vehicle information security monitoring device.

[0067] refer to Figure 3 Vehicle information security monitoring device, including: The acquisition module 300 is used to acquire multi-source heterogeneous logs of vehicles.

[0068] The processing module 320 is used to preprocess multi-source heterogeneous logs, extract log type features based on the preprocessing results, and perform unified feature encoding on the log type features to obtain a time-series feature sequence.

[0069] The cloud-based analytics module 340 is used to input time-series feature sequences into the information security monitoring model, identify complex attacks, and output cross-log attack paths. The cloud analytics module 340 is further configured as follows: Input representation is constructed based on time-series feature sequences and log type features; the time-series feature sequences and log type features are fused using a gating mechanism. Based on the input representation, a dynamic bias matrix is ​​constructed to adjust the original attention score matrix, thereby obtaining the target attention score matrix; Based on the input representation and the target attention score matrix, a cross-sequence attention head is constructed and a global representation is output. The global representation is used to represent composite attack and cross-log attack paths.

[0070] Various variations and specific examples of the methods provided in the above embodiments are also applicable to the vehicle information security monitoring device of this embodiment. Through the foregoing detailed description of the vehicle information security monitoring method, those skilled in the art can clearly understand the implementation method of the vehicle information security monitoring device in this embodiment. For the sake of brevity, it will not be described in detail here.

[0071] To better execute the above-described method, embodiments of the present invention also provide an electronic device, which includes a processor and a memory. The electronic device can be installed in a vehicle.

[0072] Electronic devices can take many forms, including mobile phones, tablets, PDAs, laptops, and desktop computers.

[0073] The memory can be used to store instructions, programs, code, code sets, or instruction sets. The memory may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the vehicle information security monitoring method provided in the above embodiments, etc.; the data storage area may store data involved in the vehicle information security monitoring method provided in the above embodiments, etc.

[0074] A processor may include one or more processing cores. The processor executes instructions, programs, code sets, or instruction sets stored in memory, and calls data stored in memory to perform various functions and process data according to the present invention. The processor may be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), Central Processing Unit (CPU), controller, microcontroller, and microprocessor. It is understood that, for different devices, the electronic devices used to implement the above-described processor functions may also be other types, and the embodiments of the present invention do not specifically limit this.

[0075] This invention provides a computer-readable storage medium, including, for example, various media capable of storing program code such as a USB flash drive, portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk. This computer-readable storage medium stores a computer program that can be loaded by a processor and execute the vehicle information security monitoring method of the above embodiments.

[0076] This invention also provides a computer program product comprising a computer program tangibly embodied on a readable medium thereof, the computer program containing program code for performing any of the vehicle information security monitoring methods in the embodiments of this invention, the computer program being downloadable and installable over a network, and / or installed from a removable medium (such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc.).

[0077] The above description of the embodiments is only used to provide a detailed introduction to the technical solution of the present invention. However, the description of the above embodiments is only for the purpose of helping to understand the method and core idea of ​​the present invention, and should not be construed as a limitation of the present invention. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for monitoring vehicle information security, characterized in that, include: Obtain multi-source heterogeneous logs of vehicles; The multi-source heterogeneous logs are preprocessed, and log type features are extracted based on the preprocessing results according to log type. The log type features are uniformly encoded to obtain a time-series feature sequence; The time-series feature sequence is input into the information security monitoring model to identify complex attacks and output cross-log attack paths; The step of inputting the time-series feature sequence into the information security monitoring model to identify complex attacks and output cross-log attack paths includes: An input representation is constructed based on the time-series feature sequence and the log type feature; wherein the time-series feature sequence and the log type feature are fused using a gating mechanism. Based on the input representation, a dynamic bias matrix is ​​constructed to adjust the original attention score matrix, thereby obtaining the target attention score matrix; Based on the input representation and the target attention score matrix, a cross-sequence attention head is constructed and a global representation is output. The global representation is used to represent composite attack and cross-log attack paths.

2. The vehicle information security monitoring method as described in claim 1, characterized in that, The fusion expression of the time-series feature sequence and the log type feature is as follows: in, In time The gate vector, It is the sigmoid activation function. This is the weight matrix. For bias terms, Temporal feature sequence vector With log type tags splicing operation, The fused output vector For element-wise product; The expression representing the input is: in, This is a dense vector of log type labels after being mapped by the embedding layer. It is a time-series feature sequence vector.

3. The vehicle information security monitoring method as described in claim 2, characterized in that, The expression for the target attention score matrix is: in, For attention score matrix, For querying the matrix, The key matrix, For value matrices, Let be the dimension of the key vector. For embedding by log type The generated dynamic bias matrix.

4. The vehicle information security monitoring method as described in claim 3, characterized in that, The expression for the cross-sequence attention head is: in, For the first The first layer The output of each attention head, For the first The query matrix corresponding to each attention head. For the first The key matrix corresponding to each attention head For the first The value matrix corresponding to each attention head For the first Layer Each attention head has a unique dynamic bias matrix.

5. The vehicle information security monitoring method as described in any one of claims 1-4, characterized in that, Also includes: The information security monitoring model is trained using a contrastive loss function, the expression of which is: in, For the sample eigenvectors, For the sample eigenvectors, For the sample eigenvectors, The cosine similarity function is used. This is the temperature coefficient.

6. A vehicle information security monitoring device, characterized in that, include: The acquisition module is used to acquire multi-source heterogeneous logs of vehicles; The processing module is used to preprocess multi-source heterogeneous logs and extract log type features based on the preprocessing results. It is also used to perform unified feature encoding on log type features to obtain time-series feature sequences; The cloud-based analytics module is used to input time-series feature sequences into the information security monitoring model, identify complex attacks, and output cross-log attack paths. The cloud analytics module is further configured as follows: An input representation is constructed based on the time-series feature sequence and the log type feature; wherein the time-series feature sequence and the log type feature are fused using a gating mechanism. Based on the input representation, a dynamic bias matrix is ​​constructed to adjust the original attention score matrix, thereby obtaining the target attention score matrix; Based on the input representation and the target attention score matrix, a cross-sequence attention head is constructed and a global representation is output. The global representation is used to represent composite attack and cross-log attack paths.

7. An electronic device, characterized in that, The system includes a processor, a memory, and a communication bus. The communication bus is used to establish a communication connection between the processor and the memory. The processor is used to execute a computer program stored in the memory to implement the vehicle information security monitoring method as described in any one of claims 1-5.

8. A vehicle, characterized in that, The vehicle includes the electronic equipment as described in claim 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program; the computer program can be executed by a processor to implement the vehicle information security monitoring method as described in any one of claims 1-5.

Images