Vehicle-based intrusion detection method, device, system and storage medium

Abstract

The application discloses a kind of based on vehicle's intrusion detection method, device, system and storage medium, method includes: based on eBPF program running in vehicle operating system kernel, the log data of target system event is captured, and based on the log data captured, construct sequence to be detected;The semantic vector conversion is carried out to sequence to be detected, obtain target semantic vector;Based on the center vector of preset target class cluster, determine the target semantic distance between target semantic vector and the center vector of each target class cluster;Based on preset sliding time window, obtain the N first historical semantic vector closest to current time, and based on each first historical semantic vector and the center vector of each target class cluster, determine target threshold, N is positive integer;Target threshold is compared with each target semantic distance, and based on the result of comparison determines the intrusion behavior type corresponding to sequence to be detected.This scheme improves the accuracy of vehicle intrusion behavior detection.

Description

Technical Field

[0001] This invention relates to the field of vehicle technology, and in particular to a vehicle-based intrusion detection method, device, system, and storage medium. Background Technology

[0002] In recent years, intelligent connected vehicle technology has developed rapidly, and vehicles have gradually evolved into highly interconnected and complex systems. This has led to increasingly prominent data security risks. Once a vehicle is compromised, consequences such as data leakage, critical system malfunctions, and even loss of vehicle control can occur, seriously threatening driving safety. Therefore, how to accurately and comprehensively detect vehicle intrusions is a pressing technical problem that needs to be solved. Summary of the Invention

[0003] This invention provides a vehicle-based intrusion detection method, device, system, and storage medium.

[0004] In a first aspect, embodiments of the present invention provide a vehicle-based intrusion detection method, comprising: The eBPF program, which runs in the vehicle operating system kernel, captures log data of events in the target system and constructs a sequence to be detected based on the captured log data. The sequence to be detected is subjected to semantic vector transformation to obtain the target semantic vector corresponding to the sequence to be detected; Based on the center vector of a preset target cluster, the target semantic distance between the target semantic vector and the center vector of each target cluster is determined, wherein the preset target clusters include normal behavior clusters and known attack behavior clusters; Based on a preset sliding time window, the first historical semantic vectors corresponding to the N first historical detection sequences closest to the current time are obtained, and the target threshold is determined based on each first historical semantic vector and the center vector of each target cluster, where N is a positive integer; The target threshold is compared with the semantic distance of each target, and the intrusion behavior type corresponding to the sequence to be detected is determined based on the comparison result.

[0005] In some implementations, constructing the sequence to be detected based on the captured log data includes: Extract the triplet information corresponding to each target system event from the log data, wherein the triplet information includes the following fields: user identification information, system call information, and operation behavior information; The triplet information corresponding to each target system event is arranged in chronological order and then segmented according to a preset sequence length to obtain the sequence to be detected.

[0006] In some implementations, the step of performing semantic vector transformation on the sequence to be detected to obtain a target semantic vector corresponding to the sequence to be detected includes: The sequence to be detected is processed by a preset semantic vector generation model to obtain the first semantic vector of each field in the sequence to be detected. The first semantic vector of each field is fused with attention weighting to obtain the second semantic vector of the sequence to be detected. For each dimension of the second semantic vector, the target value under that dimension is adjusted based on the center point value and boundary point value corresponding to that dimension to obtain the target semantic vector. The center point value and boundary point value under each dimension are obtained by performing data distribution feature analysis on the M second historical semantic vectors corresponding to the M second historical detection sequences, where M is a positive integer.

[0007] In some implementations, adjusting the target value for each dimension of the second semantic vector based on the center point value and boundary point value corresponding to that dimension includes: For each dimension of the second semantic vector, if the target value under that dimension is less than or equal to the boundary point value corresponding to that dimension, the target value is adjusted based on the center point value, the difference between the target value and the center point value; For each dimension of the second semantic vector, if the target value in that dimension is greater than the boundary point value corresponding to that dimension, the target value is adjusted based on the difference between the boundary point value, the target value, and the center point value.

[0008] In some implementations, the center point values ​​and boundary point values ​​for each dimension are determined through the following steps: For each dimension, M values ​​of the second historical semantic vectors under that dimension are obtained, and data distribution feature analysis is performed on the M values. The first quantile value is taken as the center point value corresponding to the dimension, and the second quantile value is taken as the boundary point value corresponding to the dimension. The percentage corresponding to the first quantile value is less than the percentage corresponding to the second quantile value.

[0009] In some implementations, the preset target cluster is constructed through the following steps: Obtain the historical sequence set of the vehicle, and perform semantic vector transformation on each historical sequence in the historical sequence set to obtain the target historical semantic vector corresponding to each historical sequence. The historical sequence set includes historical sequences corresponding to the normal behavior of the vehicle and historical data corresponding to known attack behaviors. The range of clustering parameters of DBSCAN is determined, the range of clustering parameters is sampled to obtain multiple combinations of first clustering parameters, and based on each combination of first clustering parameters, the target historical semantic vector of each historical sequence in the historical sequence set is clustered to obtain the first clustering result under each combination of first clustering parameters. Based on the adjusted RAND index corresponding to each first clustering result, the target interval of the clustering parameters is determined, and a grid search is performed based on the target interval to determine multiple combinations of second clustering parameters. Based on each combination of second clustering parameters, the target historical semantic vector of each historical sequence in the historical sequence set is clustered to obtain the second clustering result under each combination of second clustering parameters. Based on the adjusted Rand index corresponding to each second clustering result, the cluster contained in the second clustering result with the highest adjusted Rand index is taken as the target cluster.

[0010] In some implementations, determining the target threshold based on each first historical semantic vector and the center vector of each target cluster includes: For each first historical semantic vector, determine the semantic distance between the first historical semantic vector and the center vector of each target cluster, and select the minimum semantic distance from all semantic distances; Based on the minimum semantic distance corresponding to each first historical semantic vector, the mean distance and the standard deviation of the distance are determined, and the target threshold is determined based on the mean distance and the standard deviation of the distance.

[0011] Secondly, embodiments of the present invention provide a vehicle-based intrusion detection device, comprising: The data acquisition module is used to capture log data of target system events based on the eBPF program running in the vehicle operating system kernel, and to construct the sequence to be detected based on the captured log data. A semantic vector generation module is used to perform semantic vector transformation on the sequence to be detected to obtain a target semantic vector corresponding to the sequence to be detected. The first processing module is used to determine the target semantic distance between the target semantic vector and the center vector of each target cluster based on the center vector of the preset target clusters, wherein the preset target clusters include normal behavior clusters and known attack behavior clusters; The second processing module is used to obtain the first historical semantic vectors corresponding to the N first historical detection sequences closest to the current time based on a preset sliding time window, and to determine the target threshold based on each first historical semantic vector and the center vector of each target cluster, where N is a positive integer; The third processing module is used to compare the target threshold with the semantic distance of each target, and determine the intrusion behavior type corresponding to the sequence to be detected based on the comparison result.

[0012] Thirdly, embodiments of the present invention provide a vehicle-based intrusion detection system, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the above-described vehicle-based intrusion detection method.

[0013] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-described vehicle-based intrusion detection method.

[0014] The above-described one or more technical solutions in the embodiments of this application have at least the following technical effects: The vehicle-based intrusion detection method provided in this application involves capturing log data of target system events using an eBPF program running in the vehicle's operating system kernel, constructing a sequence to be detected based on the captured log data, performing semantic vector transformation on the sequence to be detected to obtain a target semantic vector corresponding to the sequence to be detected, determining the target semantic distance between the target semantic vector and the center vector of each target cluster based on the center vector of a preset target cluster, wherein the preset target clusters include normal behavior clusters and known attack behavior clusters, obtaining the first historical semantic vectors corresponding to the N closest first historical detection sequences to the current time based on a preset sliding time window, and determining a target threshold based on each first historical semantic vector and the center vector of each target cluster, where N is a positive integer, comparing the target threshold with each target semantic distance, and determining the intrusion behavior type corresponding to the sequence to be detected based on the comparison result. This solution captures log data using the eBPF program, enabling non-intrusive data collection. Furthermore, it calculates the target semantic distance between the target semantic vector corresponding to the sequence to be detected and the center vector of a preset target cluster. This target semantic distance is then compared with a dynamically changing target threshold to determine whether the target semantic vector belongs to an existing normal behavior cluster or a known attack cluster. If the target semantic vector does not belong to any existing target cluster, it can be considered an unknown attack, thus effectively identifying the intrusion behavior type of the sequence to be detected. Additionally, the dynamically changing target threshold in this solution takes into account threshold drift under different vehicle states, avoiding misjudgments of intrusion behavior types caused by fixed thresholds, thereby improving the accuracy of intrusion behavior detection. Attached Figure Description

[0015] Figure 1 This is a schematic flowchart illustrating a vehicle-based intrusion detection method provided in an embodiment of this specification. Figure 2 A schematic diagram of the functional modules of a vehicle-based intrusion detection device provided in the embodiments of this specification; Figure 3 This is a schematic diagram of a vehicle-based intrusion detection system provided as an embodiment of this specification. Detailed Implementation

[0016] The overall technical solution of this specification embodiment is as follows: Log data of target system events is captured based on an eBPF program running in the vehicle operating system kernel, and a sequence to be detected is constructed based on the captured log data; semantic vector transformation is performed on the sequence to be detected to obtain a target semantic vector corresponding to the sequence; based on the center vector of a preset target cluster, the target semantic distance between the target semantic vector and the center vector of each target cluster is determined, wherein the preset target clusters include normal behavior clusters and known attack behavior clusters; based on a preset sliding time window, the first historical semantic vectors corresponding to the N closest first historical detection sequences to the current time are obtained, and a target threshold is determined based on each first historical semantic vector and the center vector of each target cluster, where N is a positive integer; the target threshold is compared with each target semantic distance, and the intrusion behavior type corresponding to the sequence to be detected is determined based on the comparison result.

[0017] The scheme implemented in this specification captures log data using an eBPF program, enabling non-intrusive data collection. Furthermore, by calculating the target semantic distance between the target semantic vector corresponding to the sequence to be detected and the center vector of a preset target cluster, and comparing this target semantic distance with a dynamically changing target threshold, it is determined whether the target semantic vector belongs to an existing normal behavior cluster or a known attack cluster. If the target semantic vector does not belong to any existing target cluster, it can be considered an unknown attack, thus effectively determining the intrusion behavior type of the sequence to be detected. In addition, the dynamically changing target threshold in this scheme can take into account threshold drift under different vehicle states, avoiding misjudgments of intrusion behavior types caused by fixed thresholds, thereby improving the accuracy of intrusion behavior detection.

[0018] To better understand the above technical solutions, the technical solutions of the embodiments of this specification will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of this specification and the specific features in the embodiments are detailed descriptions of the technical solutions of the embodiments of this specification, rather than limitations on the technical solutions of this specification. Unless otherwise specified, the embodiments of this specification and the technical features in the embodiments can be combined with each other.

[0019] First, it should be clarified that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0020] This specification provides an embodiment of a vehicle-based intrusion detection method, such as... Figure 1 As shown, the method includes the following steps: Step S101: Capture the log data of target system events based on the eBPF program running in the vehicle operating system kernel, and construct the sequence to be detected based on the captured log data; Step S102: Perform semantic vector transformation on the sequence to be detected to obtain the target semantic vector corresponding to the sequence to be detected; Step S103: Based on the preset center vector of the target cluster, determine the target semantic distance between the target semantic vector and the center vector of each target cluster, wherein the preset target clusters include normal behavior clusters and known attack behavior clusters; Step S104: Based on a preset sliding time window, obtain the first historical semantic vectors corresponding to the N first historical detection sequences closest to the current time, and determine the target threshold based on each first historical semantic vector and the center vector of each target cluster, where N is a positive integer; Step S105: Compare the target threshold with the semantic distance of each target, and determine the intrusion behavior type corresponding to the sequence to be detected based on the comparison result.

[0021] The methods described in this specification can be applied to vehicles, to cloud environments connected to vehicles, or to systems comprised of vehicles and cloud environments; no limitation is made here. In some embodiments, vehicles can upload vehicle data to the cloud, and the cloud can process the received data and send relevant data back to the vehicles based on the processing results. It should be noted that the cloud can communicate with multiple vehicles, receiving and storing data uploaded by each vehicle.

[0022] In step S101, by running the eBPF (extended Berkeley Packet Filter) program in the vehicle operating system kernel space, without modifying the kernel code, event monitoring and data collection can be achieved simply by mounting LSM (Linux Security Module) hook points.

[0023] Specifically, users can load pre-written eBPF programs into the vehicle kernel via system calls. The kernel performs security and legitimacy checks on the eBPF programs to ensure they do not compromise kernel stability. Once verified, the kernel compiles the program into machine code in real-time and attaches it to a specified kernel hook point. When a corresponding system event is triggered, the kernel can automatically execute the eBPF program, capture data, and transmit the results to user space. Thus, the entire process requires no modification to the kernel code, and since the eBPF program runs in kernel space, it can detect vehicle intrusion attempts in real-time, effectively preventing harm to the vehicle.

[0024] The target system events monitored via eBPF can be configured according to actual needs. In some embodiments, the types of target system events monitored, the mounted LSM Hook points, and the corresponding possible behaviors are shown in Table 1: Table 1 After obtaining the log data of the target system events, the log data can be cleaned, standardized, and then structured to construct the sequence to be detected.

[0025] In some embodiments, the sequence to be detected can be constructed by the following steps: extracting triplet information corresponding to each target system event from the log data, wherein the triplet information includes fields such as user identification information, system call information, and operation behavior information; arranging the triplet information corresponding to each target system event in chronological order and dividing it according to a preset sequence length to obtain the sequence to be detected.

[0026] In the embodiments of this specification, triples can be used to represent the semantic behavior of events. A triple includes three elements: Subject, Interface, and Action, which can be represented by SIA (Subject-Interface-Action). The Subject's field can be user identification information (e.g., username root), representing the permission context of the behavior; the Interface's field can be system call information (e.g., execve), representing the operation channel of the behavior; and the Action's field can be operation behavior information (e.g., / bin / sh), representing the execution target of the behavior. Based on triples, the raw target system events collected by eBPF are structurally semantically abstracted, and each target system event is modeled as a semantic triple of "Who (Subject) - Through which Interface (Interface) - What Action (Action) was executed".

[0027] When constructing the sequence to be detected, triplet information corresponding to each target system event can be extracted from the log data and arranged in chronological order of timestamps to form a SIA structured log. Further, the SIA structured log is segmented. In some embodiments, a time-aware sliding window mechanism can be used to segment continuous SIA logs into fixed-length behavior sequences, such as segmenting every 30 events to obtain N sequences to be detected. Each sequence to be detected contains 30 events. The sequence to be detected retains the temporal correlation and contextual semantics of the behaviors. The format of the sequence to be detected can be: [{"usr":"root","api":"execve","action":" / bin / sh"}, … ].

[0028] In step S102, after obtaining the sequence to be detected, semantic vector transformation can be performed on the sequence to obtain the target semantic vector corresponding to the sequence to be detected. It should be noted that semantic vector transformation can be implemented in various ways. For example, the BGE (BAAI General Embedding) semantic embedding model can be used to output the target semantic vector corresponding to the sequence to be detected. During the training process of the semantic embedding model, the training samples can be a set of triple sequences. Of course, other vector generation models or algorithms can also be used for vector transformation, such as Word2Vec (Word to Vector), TF-IDF, etc., which are not limited here.

[0029] In the embodiments of this specification, in order to enable the semantic vector to better represent the semantics of the sequence to be detected, the semantic vector conversion can be performed in the following way: the sequence to be detected is processed by a preset semantic vector generation model to obtain a first semantic vector for each field in the sequence to be detected; attention-weighted fusion is performed on the first semantic vector of each field to obtain a second semantic vector of the sequence to be detected; for each dimension of the second semantic vector, the target value under that dimension is adjusted based on the center point value and boundary point value corresponding to that dimension to obtain the target semantic vector, wherein the center point value and boundary point value under each dimension are obtained by performing data distribution feature analysis on the M second historical semantic vectors corresponding to the M second historical detection sequences, where M is a positive integer.

[0030] It should be understood that the preset semantic vector generation model can be selected according to actual needs. For ease of explanation, the BGE semantic embedding model is used as an example here. The training process of the BGE semantic embedding model can include a pre-training phase, a training phase on general text, and a training phase on a specific task. The specific training process can be found in existing BGE model training processes, which will not be elaborated here. In some embodiments, processing the sequence to be detected using the preset semantic vector generation model can be achieved through the following steps: constructing a semantic text matrix based on the triplet information in the sequence to be detected, where each column of the semantic text matrix corresponds to a field in the triplet information; processing the semantic text matrix using the preset semantic vector generation model to obtain a vector matrix for each field; and obtaining the first semantic vector for each field by pooling the vector matrix of each field.

[0031] Specifically, a sequence to be detected contains multiple events; taking 30 events as an example, each event corresponds to its own triplet information. Each field in the triplet information is used as a column of the semantic text matrix. For example, the first column corresponds to the subject, the second column to the interface, and the third column to the action. This results in a 30×3 semantic text matrix, which contains 30 subject text fragments, 30 interface text fragments, and 30 action text fragments.

[0032] In processing the semantic text matrix using the BGE semantic embedding model, each semantic field in the triples is independently encoded, preserving the independent semantic features of each field. In some embodiments, the BGE semantic embedding model processes 30 main text fragments, 30 interface text fragments, and 30 action text fragments respectively, obtaining vector matrices corresponding to the 30 main text fragments, the 30 interface text fragments, and the 30 action text fragments. For example, these three vector matrices are all 30×384 dimensions.

[0033] After obtaining the 30×384-dimensional vector matrix corresponding to each semantic field, pooling can be performed to compress the sequence dimension into a single semantic representation. In some embodiments, average pooling can be used to process each vector matrix. In this case, each vector matrix after pooling will be converted from a 30×384-dimensional vector matrix into a 384-dimensional semantic vector, and the 384-dimensional semantic vector corresponding to each field will be used as the first semantic vector of each field.

[0034] In the embodiments of this specification, considering that the BGE semantic embedding model uses a general semantic encoder, the generated first semantic vector is not optimized for the automotive security domain. In order to perceive the differences in security distinguishability of each SIA field under different attack modes, an attention layer is added in the embodiments of this specification. Through a learnable attention mechanism, the contribution weight of each SIA field under different attack modes is automatically perceived, and adaptive weighted fusion is achieved.

[0035] Specifically, after obtaining the first semantic vector for each field, a pre-trained attention layer processes the first semantic vector for each field to determine the attention weight for each field. Based on these attention weights, the first semantic vectors for each field are then weighted and fused to obtain the second semantic vector. Continuing with the example where the first semantic vector for each field is a 384-dimensional semantic vector, the attention weights are a1, a2, and a3 for each field. A weighted fusion of a1, a2, and a3 is then performed on the first semantic vector for each field, ultimately resulting in a 1152-dimensional semantic vector as the second semantic vector.

[0036] In some embodiments, when training the attention layer, the attention layer can be trained by learning attention weights driven by a classification auxiliary task. During the training phase, an end-to-end supervised training network of the attention layer and the security classification head is constructed. The learning of attention weights is driven by a normal / attack binary classification task. After training is completed, the classification head is discarded, and only the trained attention layer is retained for the generation of the second semantic vector.

[0037] Specifically, the training data used for the attention layer training can be labeled normal behavior samples and attack behavior samples. Each sample is a 30-event SIA triplet behavior sequence, labeled as normal or attack. Each training sample is input into the BGE semantic embedding model to obtain a pooled vector of three fields, i.e., the first semantic vector of the three fields. It should be noted that the parameters of the BGE semantic embedding model remain frozen throughout the training process and do not participate in gradient updates; they are only used as a general semantic feature extractor. Further, the first semantic vectors of each of the three fields are input into the attention layer, attention weights are calculated, and weighted fusion and concatenation are performed to generate an 1152-dimensional semantic vector. The 1152-dimensional semantic vector is input into the security classification head for processing, and the binary classification probability of normal / attack is output through sofmax. The attention layer parameters are updated through loss calculation and backpropagation to achieve iterative training until training is complete. After training is completed, the security classification head is discarded, and the trained parameters of the attention layer are saved for subsequent generation of the second semantic vector.

[0038] In the embodiments of this specification, through the supervision signal of normal / attack binary classification, the attention layer can learn to automatically adjust the contribution weights of the three fields in the triplet for different behavior sequences, so that the weighted fused vector has the maximum normal / abnormal discrimination in the semantic space, enabling the attention layer to extract the behavioral semantic representation optimized for vehicle safety from the output of the preset semantic vector generation model.

[0039] After obtaining the second semantic vector of the sequence to be detected, such as the 1152-dimensional semantic vector in the weighted fusion above, its distribution characteristics in the high-dimensional space are not actually optimized for vehicle intrusion detection tasks. This may result in a relatively loose distribution of semantic vectors for normal behavior, while the deviation of semantic vectors for abnormal behavior may not be significant enough. Therefore, in the embodiments of this specification, quantile-driven vector space nonlinear discriminative enhancement is applied to the second semantic vector, significantly enhancing the spatial discriminative power of semantic vectors for normal / abnormal behavior without changing the vector dimension.

[0040] Specifically, for each dimension of the second semantic vector, the center point value and boundary point value under each dimension can be pre-calculated. In some embodiments, the center point value and boundary point value under each dimension can be implemented in the following way: for each dimension, obtain M values ​​of M second historical semantic vectors under that dimension, and perform data distribution feature analysis on the M values, taking the first quantile value as the center point value corresponding to that dimension, and taking the second quantile value as the boundary point value corresponding to that dimension, wherein the percentage corresponding to the first quantile value is less than the percentage corresponding to the second quantile value.

[0041] It should be understood that the M second historical semantic vectors can be semantic vectors corresponding to the M historical detection sequences generated from the captured vehicle history. The number of M can be selected according to actual needs. For example, all the second historical semantic vectors obtained within three months or one month of history can be used as the M second historical semantic vectors. There is no limitation here. The generation process of the second historical semantic vectors is the same as that of the target semantic vector of the sequence to be detected, so it will not be described again here.

[0042] Continuing with the example of the 1152-dimensional semantic vector, each second historical semantic vector is also a 1152-dimensional semantic vector. For each dimension, the numerical values ​​of each second historical semantic vector under that dimension are extracted, resulting in a total of M numerical values ​​under that dimension. Data distribution feature analysis is performed on these M numerical values ​​to select the first quantile and the second quantile. The first and second quantiles can be selected as needed, as long as the percentage corresponding to the first quantile is less than the percentage corresponding to the second quantile. In some embodiments, the first quantile can be the P90 quantile, and the second quantile can be the P95 quantile. The P90 quantile represents that 90% of the M numerical values ​​are less than or equal to this value, and the P95 quantile represents that 95% of the M numerical values ​​are less than or equal to this value. Therefore, the P90 quantile is used as the center point value for that dimension, and the P95 quantile is used as the boundary point value for that dimension. For each dimension of the 1152-dimensional semantic vector, the center point value and boundary point value for each dimension can be determined in the above manner.

[0043] In some embodiments, the numerical space of each dimension can be divided into three regions: a core region, a transition region, and an outlier region, using center point values ​​and boundary point values. In the core region, all values ​​are less than or equal to the center point value of that dimension, representing the typical normal value range for that dimension. In the transition region, the values ​​correspond to a range greater than the center point value and less than or equal to the boundary point value of that dimension, representing the boundary values ​​of normal behavior for that dimension. In the outlier region, all values ​​are greater than the boundary point value of that dimension.

[0044] In the embodiments of this specification, in order to make the semantic vectors of normal behavior cluster towards typical values ​​in each dimension, reducing intra-cluster dispersion, and to push the semantic vectors of abnormal behavior away from the normal distribution area in each dimension, increasing inter-cluster distance, the second semantic vector of the sequence to be detected can be processed through the following steps: For each dimension of the second semantic vector, if the target value in that dimension is less than or equal to the boundary point value corresponding to that dimension, the target value is adjusted based on the center point value, the difference between the target value and the center point value; For each dimension of the second semantic vector, if the target value in that dimension is greater than the boundary point value corresponding to that dimension, the target value is adjusted based on the difference between the boundary point value, the target value and the center point value.

[0045] Specifically, the target value is extracted sequentially for each dimension of the second semantic vector. The relationship between the target value and the boundary point value in that dimension is then determined. If the target value is less than or equal to the boundary point value, the target value in that dimension can be adjusted using the following formula: newj =mid j +(old j -mid j ) / 2 If the target value is greater than the boundary point value in this dimension, the target value in this dimension can be adjusted using the following formula: new j =edge j +(old j -mid j )×2 Among them, old j Let new be the target value of the j-th dimension in the second semantic vector. j Let mid be the adjusted target value of the j-th dimension in the second semantic vector. j Let edge be the value of the center point in the j-th dimension. j Let be the boundary point value of the j-th dimension.

[0046] By employing the above method, the distance between the values ​​in the core and transition regions and the center point value in each dimension is halved, causing the semantic vectors of normal behavior to cluster towards typical values ​​in each dimension, reducing intra-cluster dispersion. Conversely, for the values ​​in the outlier regions in each dimension, the distance between the outlier values ​​and the center point value is doubled, pushing the semantic vectors of abnormal behavior away from the normal distribution area in each dimension, increasing inter-cluster distance. By performing the above adjustments on the target values ​​in each dimension of the second semantic vector, the adjusted vector is used as the target semantic vector.

[0047] In step S103, after obtaining the target semantic vector corresponding to the sequence to be detected, the semantic distance between the target semantic vector and the center vectors of a plurality of preset target clusters can be calculated. The plurality of preset target clusters may include normal behavior clusters and known attack behavior clusters. The normal behavior clusters contain semantic vectors that are determined to be normal behavior. For each known attack behavior, there is a corresponding known attack behavior cluster, and each known attack behavior cluster contains semantic vectors that are determined to be that known attack type.

[0048] In some embodiments, the target cluster can be constructed through the following steps: obtaining a set of historical sequences of the vehicle, and performing semantic vector transformation on each historical sequence in the set to obtain a target historical semantic vector corresponding to each historical sequence, wherein the set of historical sequences includes historical sequences corresponding to normal vehicle behavior and historical data corresponding to known attack behavior; determining the range of clustering parameters of DBSCAN, sampling the range of clustering parameters to obtain multiple combinations of first clustering parameters, and clustering the target historical semantic vector of each historical sequence in the set based on each combination of first clustering parameters to obtain a first clustering result under each combination of first clustering parameters; determining the target interval of clustering parameters based on the adjusted Rand index corresponding to each first clustering result, and performing a grid search based on the target interval to determine multiple combinations of second clustering parameters, and clustering the target historical semantic vector of each historical sequence in the set based on each combination of second clustering parameters to obtain a second clustering result under each combination of second clustering parameters; and selecting the cluster contained in the second clustering result with the highest adjusted Rand index as the target cluster based on the adjusted Rand index corresponding to each second clustering result.

[0049] Specifically, the historical sequence set can be vehicle triple sequences collected within a preset historical period, such as the last three months, the last six months, or the last year, etc., without limitation. The historical sequence set includes normal historical sequences as well as historical sequences of various known attack types. Semantic vector transformation is performed on the historical sequences in the set to obtain the target historical semantic vector corresponding to each historical sequence. The specific vector transformation method is the same as the target semantic vector generation process described above, both requiring processing by a preset semantic vector generation model, attention-weighted fusion, and vector adjustment based on the center point and boundary point values ​​in each dimension. The specific process can be referred to the description above, and will not be repeated here.

[0050] Clustering is performed on the target historical semantic vectors corresponding to each historical sequence in the historical sequence set to obtain the clusters to which normal type vectors belong and the clusters to which vectors of known attack types belong. The specific clustering method can be selected according to actual needs. In some embodiments, DBSCAN is chosen for clustering. It should be noted that the clustering parameters of DBSCAN include the neighborhood radius and the minimum density threshold. Considering that the DBSCAN clustering parameters are difficult to determine manually in high-dimensional semantic vector spaces, the embodiments in this specification achieve efficient convergence to the optimal parameter combination through a gradual search space shrinkage strategy of global exploration and local refinement.

[0051] In the first stage, the global exploration stage, sampling can be performed across the range of DBSCAN's clustering parameters. For example, Monte Carlo random sampling can be used to sample across the entire parameter space, resulting in multiple first clustering parameter combinations. Each first clustering parameter combination includes a set of parameter values ​​for neighborhood radius and minimum density threshold. For instance, if there are 500 first clustering parameter combinations, then for each first clustering parameter combination, the target historical semantic vector of each historical sequence in the historical sequence set is clustered to obtain the corresponding first clustering result. For each clustering, the clustering result can include the number of vectors in each cluster, cluster centers, the number of noise points, etc.

[0052] It should be noted that the adjusted RAND index is a core indicator used to measure the clustering effect. It can assess the degree of matching between the clustering results and the real labels (normal / known attack types). The closer the adjusted RAND index is to 1, the higher the consistency between the clustering results and the real behavior type. In the embodiments of this specification, for each group of first clustering results, parameter combinations with higher adjusted RAND indices are selected. For example, the adjusted RAND indices are sorted in descending order, and the top 10% or 30% of parameter combinations are extracted. The neighborhood radius and minimum density threshold of these parameter combinations are used as the target interval for clustering parameters.

[0053] In the second stage, the local refinement stage, a grid search is performed on the target interval based on the clustering parameters determined above. The grid search can traverse the target interval with equal step sizes, generating multiple combinations of second clustering parameters. It should be noted that the step size can be selected according to actual needs and is not limited here. Grid search is more accurate than random sampling and can cover all key parameter combinations within the target interval.

[0054] Furthermore, based on each combination of second clustering parameters, DBSCAN clustering is re-executed on the target historical semantic vector to obtain the second clustering results under each combination of second clustering parameters. Similarly, for each group of second clustering results, their respective adjusted Rand index is calculated, and the second clustering result with the highest adjusted Rand index is selected as the optimal clustering result. All clusters contained in this optimal clustering result are taken as the target clusters. In this optimal clustering result, each cluster corresponds to a type of normal or known attack behavior.

[0055] The two stages described above can quickly eliminate invalid parameter regions and narrow down the parameter search range through global exploration. Then, through local refinement, they can accurately converge within the narrowed search range, which greatly reduces the computational complexity compared to traditional global grid search.

[0056] In the embodiments of this specification, in order to determine the intrusion behavior type of the sequence to be detected, the target semantic distance between the target semantic vector corresponding to the sequence to be detected and the center vector of each target cluster can be calculated respectively. By the relationship between the target semantic distance and the target threshold, it can be determined whether the target semantic vector belongs to an existing target cluster or does not belong to any existing target cluster, thereby determining the intrusion behavior type of the sequence to be detected.

[0057] It should be noted that the traditional method for comparing the target semantic distance with the target threshold is to use a fixed threshold. However, a fixed threshold cannot adapt to changes in the normal behavior patterns of a vehicle under different operating states (such as startup self-test, normal driving, OTA upgrade, charging standby, etc.). For example, during the process of switching operating states (such as switching from normal driving state to charging standby state), the semantic vector of the vehicle's normal behavior will naturally change, causing its distance from the center of the normal behavior cluster to change. If a fixed threshold is still used, the above changes may cause the detected sequence to be classified into other target clusters or not to belong to any target cluster, thus leading to misjudgment of the intrusion behavior type of the detected sequence. Based on this, the embodiments of this specification use step S104 to adaptively adjust the target threshold.

[0058] In step S104, the preset sliding time window can be set according to actual needs. In some embodiments, the preset sliding time window can obtain N first historical semantic vectors corresponding to the N most recent first historical detection sequences at the current time. The size of the preset sliding time window can be set according to actual needs. For example, the size of the preset sliding time window is 1000, 1500, etc. Taking a preset sliding time window size of 1000 as an example, the 1000 most recent first historical semantic vectors at the current time can be obtained through the preset sliding time window, that is, N is 1000. It should be noted that the generation method of the first historical semantic vector is the same as the generation method of the target semantic vector mentioned above. Both need to be processed by the preset semantic vector generation model, attention weighted fusion, and vector adjustment based on the center point value and boundary point value under each dimension. The specific process can be referred to the description above, and will not be repeated here.

[0059] In some embodiments, the target threshold can be obtained by: for each first historical semantic vector, determining the semantic distance between the first historical semantic vector and the center vector of each target cluster, and selecting the minimum semantic distance from all semantic distances; based on the minimum semantic distance corresponding to each first historical semantic vector, determining the mean distance and the standard deviation distance, and determining the target threshold based on the mean distance and the standard deviation distance.

[0060] Specifically, for each first historical semantic vector, the semantic distance between the first historical semantic vector and the center vector of each target cluster is calculated, and the minimum semantic distance is selected. Using the example of 1000 first historical semantic vectors, each first historical semantic vector corresponds to a minimum semantic distance, so 1000 first historical semantic vectors correspond to 1000 minimum semantic distances. Further, for all minimum semantic distances, the mean and standard deviation are calculated to obtain the mean distance μ and the standard deviation σ. Dynamic analysis of the distribution of the minimum semantic distances corresponding to the first historical semantic vectors within a preset sliding time window is performed to obtain the target threshold. In some embodiments, the target threshold can be determined by the following formula: θ = μ + k × σ Where θ is the target threshold and k is a configurable sensitivity coefficient that can be set according to actual needs.

[0061] As can be seen from the above, as the preset sliding time window slides, the semantic vector within the window will change, and the corresponding distance mean and distance standard deviation will also adjust naturally, and the target threshold will also adaptively follow.

[0062] In step S105, to determine the intrusion behavior type of the sequence to be detected, the target semantic distance between the target semantic vector of the sequence to be detected and the center vector of each target cluster can be compared with a target threshold, and the intrusion behavior type can be determined based on the comparison result. In the implementation of this specification, the intrusion behavior type can include normal behavior, known attack behavior, and unknown attack behavior.

[0063] In some embodiments, if the semantic distance between the target semantic vector and the normal behavior cluster is less than or equal to a target threshold, the target semantic vector is recalled to the normal behavior cluster, and the sequence to be detected is determined to be normal behavior. If the semantic distance between the target semantic vector and a known attack type cluster is less than or equal to a target threshold, the sequence to be detected is determined to be a known attack behavior of that known type. If the semantic distance between the target semantic vector and all target clusters is greater than the target threshold, the target semantic vector deviates from all known normal behaviors and known attack behaviors in the semantic space, and there is an abnormal or potential unknown attack risk. Therefore, the target semantic vector can be initially identified as an unknown attack.

[0064] In other embodiments, to conserve computational resources, the target clusters may only include normal behavior clusters, meaning the historical sequence set only contains sequences of historically collected normal behavior. Similarly, through the clustering in the two stages described above, multiple target clusters are obtained, each corresponding to a type of normal behavior. Therefore, when determining the intrusion behavior type of the sequence to be detected, the sequence can first be filtered to remove sequences corresponding to known attack behaviors, and sequences with unknown attack behaviors can be used as the sequences to be detected and their semantic vectors transformed. Further, the distance between the target semantic vector corresponding to the sequence to be detected and the center vector of each normal behavior cluster is calculated. If the semantic distance between the target semantic vector and the center vector of all normal behavior clusters is greater than a target threshold, the semantic vector can be preliminarily determined as an unknown attack.

[0065] In the embodiments of this specification, for a sequence to be detected that is initially determined to be an unknown attack, it can be sent to the target user for review. If the review result determines that it is a new type of attack, the new type of attack and the corresponding sequence can be added to the known attack type library to update the known attack type library. At the same time, the target cluster can be updated based on the new type of attack's sequence to be detected and the corresponding semantic vector.

[0066] Considering that vehicles may add new functions or users' driving habits may change, potentially altering the vehicle's behavioral sequences, it's necessary to update the target cluster to address semantic drift corresponding to user behavior. In some embodiments, the distance mean sequence corresponding to K consecutive preset sliding time windows can be continuously detected, where K can be set according to actual needs, for example, K = 4, 5, 6, etc. When the cumulative offset of the distance mean exceeds a preset drift threshold, semantic drift is determined to have occurred, triggering an update of the target cluster. The preset drift threshold can be set according to actual needs, and the update of the target cluster can involve re-clustering historical semantic vectors, including those from the most recent period, to obtain a new target cluster.

[0067] It should be noted that, under normal circumstances, during the normal switching of a vehicle's operating state, the average distance within the K sliding time windows tends to stabilize. For example, when a vehicle switches from normal driving to charging standby, the behavior within the sliding time window gradually mixes with charging-related behavior from normal driving data, eventually stabilizing within charging-related behavior data. Taking K as 5 as an example, the five average distances during the switch from normal driving to charging standby are 0.08, 0.1, 0.12, 0.12, and 0.12 respectively. It can be seen that the average distance stabilizes within the first three windows, with no new offset in subsequent windows and a low cumulative offset. If a new function is added to the vehicle, such as remote control, new behavioral sequences will be generated when the user uses this new function. These behavioral sequences differ semantically from the vehicle's original behavioral sequences. Therefore, the average distance will change significantly when using this new function, and the cumulative offset of the average distance will increase significantly, exceeding the preset drift threshold. Therefore, when the cumulative offset of the distance mean is detected to exceed the preset drift threshold, the target cluster can be updated so that the target cluster can match the current vehicle behavior, thus ensuring the accuracy of intrusion detection.

[0068] In summary, the method provided in the embodiments of this specification achieves non-intrusive data acquisition by employing eBPF. By abstracting system operation behaviors into structured semantic triples, it realizes structured modeling from system events to semantic behavior representations. Based on the preset semantic vector generation model, it outputs independent encodings of multiple fields, and through cross-field weighted fusion using an adaptive attention network, it can automatically perceive the contribution weights of each field of SIA under different behavior patterns, significantly improving the discriminativeness of the final weighted fused vector in the semantic space. Simultaneously, by performing quantile statistics on the semantic vectors dimension by dimension and adjusting the values ​​of the core and outlier regions, it can significantly enhance the normal / abnormal discriminativeness of the vector space. In the embodiments of this specification, clustering is achieved through two stages: global exploration and local refinement. This efficiently achieves automatic optimization of density clustering hyperparameters in vehicle-mounted resource-constrained scenarios. Based on the clustering results, it can effectively determine the intrusion behavior type of the sequence to be detected, comprehensively covering the detection of normal behavior, known attack behavior, and unknown attack behavior. In addition, by setting dynamic target thresholds, it is possible to adapt to the natural drift of vehicle behavior patterns under different operating conditions, and by triggering automatic updates of target clusters through semantic drift detection, it is possible to ensure continuous adaptive capability to the long-term evolution of vehicle behavior patterns.

[0069] Based on the same inventive concept, embodiments of this specification also provide a vehicle-based intrusion detection device, such as... Figure 2 As shown, the device includes: The data acquisition module 201 is used to capture log data of target system events based on the eBPF program running in the vehicle operating system kernel, and to construct a sequence to be detected based on the captured log data. The semantic vector generation module 202 is used to perform semantic vector transformation on the sequence to be detected to obtain a target semantic vector corresponding to the sequence to be detected. The first processing module 203 is used to determine the target semantic distance between the target semantic vector and the center vector of each target cluster based on the center vector of the preset target cluster, wherein the preset target clusters include normal behavior clusters and known attack behavior clusters; The second processing module 204 is used to obtain the first historical semantic vectors corresponding to the N first historical detection sequences closest to the current time based on a preset sliding time window, and to determine the target threshold based on each first historical semantic vector and the center vector of each target cluster, where N is a positive integer; The third processing module 205 is used to compare the target threshold with the semantic distance of each target, and determine the intrusion behavior type corresponding to the sequence to be detected based on the comparison result.

[0070] Regarding the above-mentioned device, the specific implementation of each step has been described in detail in the embodiments of the vehicle-based intrusion detection method provided in the specification, and will not be elaborated here.

[0071] Based on the same inventive concept, embodiments of the present invention also provide a vehicle-based intrusion detection system, such as... Figure 3 The aforementioned includes a memory 304, a processor 302, and a computer program stored in the memory 304 and executable on the processor 302. When the processor 302 executes the program, it implements any of the above-described vehicle-based intrusion detection methods.

[0072] Among them, Figure 3In this document, a bus architecture (represented by bus 300) is used. Bus 300 may include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 302 and memory represented by memory 304. Bus 300 may also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 305 provides an interface between bus 300 and receiver 301 and transmitter 303. Receiver 301 and transmitter 303 may be the same element, i.e., a transceiver, providing a unit for communicating with various other devices over a transmission medium. Processor 302 is responsible for managing bus 300 and general processing, while memory 304 can be used to store data used by processor 302 during operation.

[0073] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0074] Based on the same inventive concept, embodiments of this specification provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described vehicle-based intrusion detection method.

[0075] Based on the same inventive concept, embodiments of this specification provide a computer program product, which includes a computer program that, when executed by a processor, loads and executes the steps of the above-described vehicle-based intrusion detection method.

[0076] The functions described herein can be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions can be stored as one or more instructions or code on or transmitted via a computer-readable medium. Other examples and embodiments are within the scope of this invention and the appended claims. For example, due to the nature of software, the functions described above can be implemented using software executed by a processor, hardware, firmware, hardwired, or any combination thereof. Furthermore, the functional units can be integrated into a single processing unit, or each unit can exist physically separately, or two or more units can be integrated into a single unit.

[0077] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0078] The units described as separate components may or may not be physically separate. Similarly, the components of the control device may or may not be physical units; they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0079] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0080] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A vehicle-based intrusion detection method, characterized in that, include: The eBPF program, which runs in the vehicle operating system kernel, captures log data of events in the target system and constructs a sequence to be detected based on the captured log data. The sequence to be detected is subjected to semantic vector transformation to obtain the target semantic vector corresponding to the sequence to be detected; Based on the center vector of a preset target cluster, the target semantic distance between the target semantic vector and the center vector of each target cluster is determined, wherein the preset target clusters include normal behavior clusters and known attack behavior clusters; Based on a preset sliding time window, the first historical semantic vectors corresponding to the N first historical detection sequences closest to the current time are obtained, and the target threshold is determined based on each first historical semantic vector and the center vector of each target cluster, where N is a positive integer; The target threshold is compared with the semantic distance of each target, and the intrusion behavior type corresponding to the sequence to be detected is determined based on the comparison result.

2. The method as described in claim 1, characterized in that, The construction of the sequence to be detected based on the captured log data includes: Extract the triplet information corresponding to each target system event from the log data, wherein the triplet information includes the following fields: user identification information, system call information, and operation behavior information; The triplet information corresponding to each target system event is arranged in chronological order and then segmented according to a preset sequence length to obtain the sequence to be detected.

3. The method as described in claim 2, characterized in that, The step of performing semantic vector transformation on the sequence to be detected to obtain a target semantic vector corresponding to the sequence to be detected includes: The sequence to be detected is processed by a preset semantic vector generation model to obtain the first semantic vector of each field in the sequence to be detected. The first semantic vector of each field is fused with attention weighting to obtain the second semantic vector of the sequence to be detected. For each dimension of the second semantic vector, the target value under that dimension is adjusted based on the center point value and boundary point value corresponding to that dimension to obtain the target semantic vector. The center point value and boundary point value under each dimension are obtained by performing data distribution feature analysis on the M second historical semantic vectors corresponding to the M second historical detection sequences, where M is a positive integer.

4. The method as described in claim 3, characterized in that, The step of adjusting the target value in each dimension of the second semantic vector based on the center point value and boundary point value corresponding to that dimension includes: For each dimension of the second semantic vector, if the target value under that dimension is less than or equal to the boundary point value corresponding to that dimension, the target value is adjusted based on the center point value, the difference between the target value and the center point value; For each dimension of the second semantic vector, if the target value in that dimension is greater than the boundary point value corresponding to that dimension, the target value is adjusted based on the difference between the boundary point value, the target value, and the center point value.

5. The method as described in claim 3, characterized in that, The center point and boundary point values ​​for each dimension are determined through the following steps: For each dimension, M values ​​of the second historical semantic vectors under that dimension are obtained, and data distribution feature analysis is performed on the M values. The first quantile value is taken as the center point value corresponding to the dimension, and the second quantile value is taken as the boundary point value corresponding to the dimension. The percentage corresponding to the first quantile value is less than the percentage corresponding to the second quantile value.

6. The method as described in claim 1, characterized in that, The preset target cluster is constructed through the following steps: Obtain the historical sequence set of the vehicle, and perform semantic vector transformation on each historical sequence in the historical sequence set to obtain the target historical semantic vector corresponding to each historical sequence. The historical sequence set includes historical sequences corresponding to the normal behavior of the vehicle and historical data corresponding to known attack behaviors. The range of clustering parameters of DBSCAN is determined, the range of clustering parameters is sampled to obtain multiple combinations of first clustering parameters, and based on each combination of first clustering parameters, the target historical semantic vector of each historical sequence in the historical sequence set is clustered to obtain the first clustering result under each combination of first clustering parameters. Based on the adjusted RAND index corresponding to each first clustering result, the target interval of the clustering parameters is determined, and a grid search is performed based on the target interval to determine multiple combinations of second clustering parameters. Based on each combination of second clustering parameters, the target historical semantic vector of each historical sequence in the historical sequence set is clustered to obtain the second clustering result under each combination of second clustering parameters. Based on the adjusted Rand index corresponding to each second clustering result, the cluster contained in the second clustering result with the highest adjusted Rand index is taken as the target cluster.

7. The method as described in claim 1, characterized in that, The determination of the target threshold based on each first historical semantic vector and the center vector of each target cluster includes: For each first historical semantic vector, determine the semantic distance between the first historical semantic vector and the center vector of each target cluster, and select the minimum semantic distance from all semantic distances; Based on the minimum semantic distance corresponding to each first historical semantic vector, the mean distance and the standard deviation of the distance are determined, and the target threshold is determined based on the mean distance and the standard deviation of the distance.

8. A vehicle-based intrusion detection device, characterized in that, include: The data acquisition module is used to capture log data of target system events based on the eBPF program running in the vehicle operating system kernel, and to construct the sequence to be detected based on the captured log data. A semantic vector generation module is used to perform semantic vector transformation on the sequence to be detected to obtain a target semantic vector corresponding to the sequence to be detected. The first processing module is used to determine the target semantic distance between the target semantic vector and the center vector of each target cluster based on the center vector of the preset target clusters, wherein the preset target clusters include normal behavior clusters and known attack behavior clusters; The second processing module is used to obtain the first historical semantic vectors corresponding to the N first historical detection sequences closest to the current time based on a preset sliding time window, and to determine the target threshold based on each first historical semantic vector and the center vector of each target cluster, where N is a positive integer; The third processing module is used to compare the target threshold with the semantic distance of each target, and determine the intrusion behavior type corresponding to the sequence to be detected based on the comparison result.

9. A vehicle-based intrusion detection system, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The device contains a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-7.

Images