An intelligent networked vehicle information security evaluation method, system and device

Abstract

The present application relates to the technical field of signal transmission, and in particular to a smart connected vehicle information security evaluation method, system and device. According to the time interval between adjacent message receiving time stamps in the associated time period at the current time, the timer remaining duration of each message receiving time stamp is obtained. According to the timer remaining duration of each message receiving time stamp, the timeout approximation degree of each message receiving time stamp is obtained. The shape deviation degree of the timeout approximation degree sequence and the preset attack mode sequence is determined. According to the timeout approximation degree and the shape deviation degree, the attack determination index at the current time is obtained. From the attack determination index, the smart connected vehicle information security evaluation result is obtained. The present application can effectively distinguish natural jitter and malicious attacks in a complex mobile network environment, significantly reduce the false positive rate while maintaining a high detection rate for hidden attacks.

Description

Technical Field

[0001] This invention relates to the field of signal transmission technology, specifically to a method, system, and device for assessing information security of intelligent connected vehicles. Background Technology

[0002] When intelligent connected vehicles undergo firmware over-the-air (FOTA) updates, the data reception process of the on-board electronic control unit (ECU) is strictly constrained by the response timeout timer in the transmission protocol (such as the P2 / P2* timer in the ISO 14229 standard UDS protocol, or the N_Cr timer in the ISO 15765-2 standard). Once the message interval caused by network transmission exceeds the time limit specified in the protocol, the ECU will forcibly terminate the upgrade session.

[0003] In the actual mobile communication network environment (such as 4G / 5G) where the vehicle is located, signal fading, base station switching, or multipath effects can cause unavoidable random jitter in the arrival time of data packets. Attackers exploit this characteristic to carry out timing pressure attacks by maliciously controlling the packet sending rhythm. The aim is to keep the ECU in a critical high-load state that is about to time out but has not yet timed out for a long time, thereby exhausting system resources or inducing write failures.

[0004] Existing technologies typically use linear statistical indicators such as average transmission rate or packet loss rate to monitor transmission quality. However, in scenarios with poor network signal quality, natural network congestion can also lead to an overall increase in packet latency. Statistically, this increase in latency caused by network jitter is extremely difficult to distinguish from deliberate, oppressive latency created by attackers. Judging solely by latency duration can easily generate numerous false alarms in poor network environments; relaxing the judgment threshold makes it impossible to identify targeted attacks hidden beneath network noise. Therefore, accurately identifying oppressive attacks with specific temporal patterns and effectively distinguishing them from natural network congestion in mobile communication networks with random jitter interference is a pressing technical problem that needs to be solved. Summary of the Invention

[0005] To address the problems of existing technologies, the present invention aims to provide a method, system, and device for assessing information security of intelligent connected vehicles. The specific technical solution adopted is as follows: In a first aspect of the present invention, a method for assessing the information security of intelligent connected vehicles is provided, comprising: Based on the time interval between adjacent message reception timestamps in the message reception timestamp sequence related to the current time, the remaining timer duration for each message reception timestamp is obtained; Based on the remaining time of the timer for each message's received timestamp, the timeout approximation degree of each message's received timestamp is obtained; Determine the degree of morphological deviation between the timeout approximation sequence and the preset attack mode sequence; the timeout approximation sequence is composed of the timeout approximation of the timestamps of each received message; Based on the timeout approximation degree and the morphological deviation degree, the attack judgment index at the current moment is obtained; the attack judgment index is positively correlated with the timeout approximation degree and negatively correlated with the morphological deviation degree. The information security assessment results of intelligent connected vehicles are obtained from the attack detection indicators.

[0006] In an exemplary embodiment, the process of obtaining the remaining duration of the timer includes: Determine the time interval between each message reception timestamp in the message reception timestamp sequence and its adjacent preceding message reception timestamp; Subtract the preset message processing time from the time interval to obtain the additional time occupied by the timer due to network transmission delay corresponding to each message reception timestamp; Calculate the difference between the preset timer response time limit threshold and the additional occupied time to obtain the remaining timer duration for each message reception timestamp.

[0007] In an exemplary embodiment, the process of obtaining the preset message processing time includes: Obtain the second preset number of historical message reception timestamps before the current time, and determine the historical time interval between adjacent historical message reception timestamps; Arrange the historical time intervals in ascending order, and select the historical time interval corresponding to the lower preset percentile as the preset message processing time.

[0008] In an exemplary embodiment, the process of obtaining the timeout approximation degree includes: The remaining time of the timer is input into a preset inverse proportional function, and the timeout approximation degree is output.

[0009] In an exemplary embodiment, the process of obtaining the degree of morphological deviation includes: Construct a cumulative distance block matrix; The timeout approximation sequence and the preset attack mode sequence are input into the cumulative distance calculation process in the dynamic time warping algorithm, and the values ​​of each element in the cumulative distance block matrix are output. The degree of morphological deviation is obtained based on the matrix endpoint element value in the cumulative distance block matrix and the number of rows in the cumulative distance block matrix; the matrix endpoint element value is the element value of the last row and the last column.

[0010] In an exemplary embodiment, the process of obtaining the attack determination index includes: Calculate the average timeout approximation of each message's received timestamp to obtain the overall timeout approximation situation; The attack determination index is obtained based on the overall situation of the timeout approximation degree and the degree of morphological deviation.

[0011] In an exemplary embodiment, obtaining the information security assessment result of intelligent connected vehicles from the attack determination indicators includes: The attack determination index is compared with the magnitude of a first risk level threshold and a second risk level threshold; the first risk level threshold is less than the second risk level threshold. When the attack determination index is less than or equal to the first risk level threshold, the information security assessment result of the intelligent connected vehicle is determined to be in a normal communication state. When the attack determination index is greater than the first risk level threshold and less than or equal to the second risk level threshold, the intelligent connected vehicle information security assessment result is determined to be a network transmission congestion state. When the attack determination index is greater than the second risk level threshold, the information security assessment result of the intelligent connected vehicle is determined to be a time-compression attack state.

[0012] In an exemplary embodiment, the process of obtaining the message reception timestamp sequence related to the current time includes: Obtain the first preset number of message reception timestamps before the current time, and construct the message reception timestamp sequence in chronological order.

[0013] In a second aspect of the present invention, an intelligent connected vehicle information security assessment system is provided, comprising: a memory and a processor; the memory is connected to the processor; the memory is used to store program instructions; the processor is used to implement the above-described intelligent connected vehicle information security assessment method when the program instructions are executed.

[0014] In a third aspect of the present invention, an intelligent connected vehicle information security assessment device is provided, comprising a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the above-described intelligent connected vehicle information security assessment method.

[0015] This invention has the following beneficial effects: Since the attack aims to keep the ECU in a critical high-load state that is about to time out for a long time, by obtaining the remaining timer duration of each message reception timestamp, a safety boundary reflecting the internal health of the ECU can be obtained, which is directly related to the final consequences caused by the attack intent, providing a fundamental basis for assessing the timeout approach degree; then, the morphological deviation degree between the timeout approach degree sequence and the preset attack mode sequence is determined. The preset attack mode sequence represents the typical waveform of a known attack in the timeout approach degree dimension. Deviation analysis is performed between it and the timeout approach degree sequence to obtain the similarity between the two. Through morphological matching, the hidden attack signal can be identified. Then, the attack judgment index at the current moment is obtained by fusing the data information of the timeout approach degree and the morphological deviation degree, which represents the pressure This invention integrates two dimensions—the degree of timeout approximation of force magnitude and the degree of morphological deviation representing the suspiciousness of the pattern—into a comprehensive index, constructing an intelligent integrated decision-making mechanism. This mechanism can effectively identify targeted attacks hidden under network noise, thereby effectively distinguishing between natural jitter and malicious attacks in complex mobile network environments. It significantly reduces the false alarm rate while maintaining a high detection rate for covert attacks. Moreover, this invention is based on analysis of relative state and pattern similarity, making it insensitive to absolute changes in network latency and exhibiting stronger robustness. It can also identify the attack deployment pattern in advance before the actual timeout interruption of the ECU, gaining a time window for implementing proactive defense. Furthermore, it is not dependent on specific communication protocols or network standards, and is applicable to various vehicle communication scenarios constrained by timeout mechanisms, possessing good versatility and portability. Attached Figure Description

[0016] Figure 1 This is a flowchart of the steps of an intelligent connected vehicle information security assessment method provided in one embodiment of the present invention. Detailed Implementation

[0017] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the specific implementation methods, structures, features, and effects of the present invention are described in detail below with reference to the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. All data and information collected in this application have been obtained with full consent.

[0019] This embodiment provides a method for assessing the information security of intelligent connected vehicles, applicable to detecting the attack risk to the ECU during firmware over-the-air updates of intelligent connected vehicles, thereby achieving information security assessment of intelligent connected vehicles.

[0020] This embodiment uses a data acquisition device connected to the vehicle gateway mirror port or the on-board diagnostic interface (OBD) to monitor network traffic in real time during the firmware over-the-air download process. Transport layer packets are filtered, extracting only those containing data transmission requests (e.g., UDS service ID 0x36, i.e., TransferData).

[0021] This embodiment takes the current moment as an example, obtains the message reception timestamps of several messages before the current moment, uses them as the basis for analysis, and obtains the intelligent connected vehicle information security assessment result corresponding to the current moment.

[0022] For each captured request message, the absolute timestamp of its last bit arriving at the data acquisition device is recorded (as the message reception timestamp). Since the arrival time of a single message frame is significantly affected by network jitter and cannot independently represent the timing trend, this embodiment sets up a first-in-first-out (FIFO) buffer queue of length N as the sampling window. As an example, N is set to 50, and the value of N is chosen based on the coverage requirements of common mobile network jitter frequencies.

[0023] Determine the message reception timestamp sequence related to the current time, wherein the number of message reception timestamps in the sequence is set to a first preset number, corresponding to N in the previous section. The message reception timestamp sequence related to the current time is represented as follows: Among them, subscript ( ) is a local index within the message reception timestamp sequence (i.e., the sampling window). This represents the timestamp of the message received furthest from the current time, corresponding to the earliest message arriving at the sampling window. Indicates the message reception timestamp Adjacent to, and later than the message reception timestamp The message reception timestamp; and so on. This represents the timestamp of the message received most recently, corresponding to the message that arrived latest within the sampling window. Therefore, It is arranged chronologically. Each message's received timestamp in the message reception timestamp sequence is earlier than the current time. Additionally, this embodiment can also read the block sequence number (BlockSequenceCounter) in the application layer header of each message. If the block sequence numbers of adjacent messages within the sampling window are not consecutive, it indicates packet loss or out-of-order delivery. In this case, the current sampling window buffer is cleared, and the accumulation of messages within the sampling window begins again, ensuring that the generated message reception timestamp sequence is logically continuous.

[0024] like Figure 1 As shown, the intelligent connected vehicle information security assessment method provided in this embodiment includes the following steps: Step S1: Based on the time interval between adjacent message reception timestamps in the message reception timestamp sequence related to the current time, obtain the remaining timer duration for each message reception timestamp; Step S2: Based on the remaining time of the timer for each message's received timestamp, obtain the timeout approximation degree of each message's received timestamp; Step S3: Determine the degree of morphological deviation between the timeout approximation sequence and the preset attack mode sequence; Step S4: Based on the degree of timeout approximation and the degree of morphological deviation, obtain the attack judgment index at the current moment; Step S5: Obtain the information security assessment results of intelligent connected vehicles based on the attack judgment indicators.

[0025] The following is a detailed explanation of each step.

[0026] Step S1: Based on the time interval between adjacent message reception timestamps in the message reception timestamp sequence related to the current time, obtain the remaining timer duration for each message reception timestamp.

[0027] In order to accurately obtain the remaining duration of the timer, this embodiment can subtract the inherent time required by the ECU to process data from the time interval, which is defined as the message processing time preset by the ECU, ensuring that the obtained time interval is the additional time occupied by the timer due to network transmission delay.

[0028] In an exemplary embodiment, a second preset number of historical message reception timestamps are selected before the current time. In this embodiment, the selected historical message reception timestamps can be those selected at the initial stage of the upgrade session, and all historical messages corresponding to each historical message reception timestamp are valid messages. To ensure the accuracy and reliability of the preset message processing time, the second preset number can be set relatively large, with the specific value set according to actual needs. This embodiment uses 200 timestamps as an example. Therefore, the message reception timestamps of the 200 valid messages before the current time are selected and set as 200 historical message reception timestamps. Then, the time interval between every two adjacent historical message reception timestamps in these 200 historical message reception timestamps is defined as the historical time interval. These historical time intervals are arranged in ascending order, and the historical time interval corresponding to the lower preset percentile is selected as the preset message processing time. The basis for selecting the lower percentile is that the processing speed of the ECU is usually fast and stable in an interference-free state, and the smallest historical time intervals in the ascending order can better reflect the true hardware processing capability of the ECU. The specific value of the preset percentile is set according to actual needs. In this embodiment, 5% is used as an example. Therefore, the historical time interval corresponding to the lower 5% percentile is selected as the preset message processing time. .

[0029] Furthermore, to prevent incorrect parameters from being locked during the initialization phase due to attacks or network congestion (i.e., the cold start spoofing problem), this embodiment can also introduce a physical limit verification mechanism. Specifically, a physical limit threshold is pre-stored. (For example, 10 milliseconds), this physical limit threshold, based on the ECU's computing power specifications, represents the maximum reasonable time for the ECU to process a single message under normal physical conditions. (Comparison) and The size, if ≤ ,show Within reasonable physical limits, the current environment is credible. Determined as a fixed processing time And lock it, apply it in subsequent data processing, and no longer update it; if > ,show If the issue exceeds the bounds of physics, and an anomaly is detected during the initialization phase (such as severe network congestion or attacker interference), a preset default value (e.g., 2 milliseconds) will be forcibly applied as a fixed processing time. This indicates that the environment is currently in an abnormal state. This physical limit check mechanism further ensures the accuracy of the preset message processing time used for subsequent calculations. Always within a reasonable physical range, avoiding time consumption due to preset message processing. The risk of underreporting due to malicious inflation will be addressed in the following section, which will specify the processing time. As a preset message processing time Participate in the calculation. It should be understood that, as another implementation, the above-mentioned physical limit verification mechanism may not be set, in which case the processing time will be fixed below. Replace with preset message processing time Participate in the calculation.

[0030] Based on the above-mentioned preset message processing time That is, fixed processing time The time interval between every two adjacent message reception timestamps in the message reception timestamp sequence is determined, thereby obtaining the remaining timer duration for each message reception timestamp, as detailed below: The time interval between each message reception timestamp in the message reception timestamp sequence and its adjacent preceding message reception timestamp is calculated as the time interval between each message reception timestamp and its preceding preceding message reception timestamp, and is defined as the time interval between each message reception timestamp: For each index in the message reception timestamp sequence ( Increasing from 1 to First calculate the first... The message reception timestamp is relative to the first The time interval between message reception timestamps .

[0031] when When the value equals 1, that is, for the first message reception timestamp in the message reception timestamp sequence, the time interval is... The calculation method is as follows: ; in, This indicates the timestamp of the first received message; The timestamp preceding the first received message is outside the sequence of received message timestamps. For example, if the sampling windows are continuous, the timestamp preceding the first received message can be the last received message timestamp in the previous sampling window.

[0032] when When it is greater than 1, the first The message reception timestamp is relative to the first The time interval between message reception timestamps The calculation method is as follows: ; in, Indicates the first Each message received timestamp Indicates the first Each message received timestamp.

[0033] Then subtract the fixed processing time from each time interval. This process obtains the additional time the timer is occupied due to network transmission delay for each message reception timestamp. Finally, the difference between the preset timer response timeout threshold and the additional time is calculated to obtain the remaining timer duration for each message reception timestamp. ; in, Indicates the first The remaining duration of the timer for each message reception timestamp. This indicates the preset timer response timeout threshold, and max represents the function to take the maximum value. This characterizes the additional time consumed by the timer purely due to network transmission latency, after deducting unavoidable hardware processing overhead. It should be understood that... It is a value greater than or equal to 0, in extreme cases. If it is less than 0, then it is limited to 0. This represents the remaining time elapsed before a timeout interrupt is triggered, after deducting the aforementioned additional time allocation. The `max` function ensures the result is non-negative; that is, when the actual delay exceeds the allowable range, the remaining time is set to zero, indicating that a timeout has occurred.

[0034] Preset timer response timeout threshold The maximum timeout period configured for the timer, such as the P2Server_max value parsed from the DiagnosticSessionControl response, or the standard default value of 5000 milliseconds.

[0035] Through the above process, the remaining timer duration of each message's received timestamp is obtained. These durations are then sorted sequentially to obtain a timer remaining duration sequence that is strictly aligned with the sampling window. : .in, The remaining duration of the timer representing the timestamp of the first received message. The remaining duration of the timer representing the timestamp of the second received message. This represents the remaining duration of the timer after the timestamp of the Nth (i.e., the last) message received. This is the sequence of remaining timer durations. By eliminating the impact of hardware differences, it uniformly reflects the actual pressure exerted on the protocol timer by the current network conditions and will be directly used as input data for subsequent steps.

[0036] Step S2: Based on the remaining time of the timer for each message's received timestamp, obtain the timeout approximation degree of each message's received timestamp.

[0037] Step S2 receives the timer remaining duration sequence output in step S1. Because the timer in the transmission protocol has a rigid timeout truncation characteristic, the security risks it brings do not change linearly with the remaining timer duration, but rather exhibit a non-linear, sharply increasing trend. For example, the interruption risk caused by the remaining timer duration decreasing from 100ms to 10ms is far higher than that caused by decreasing from 500ms to 410ms, even though the time intervals are the same. Therefore, this step is used to transform the linear time dimension into a risk dimension that is highly sensitive to critical states.

[0038] Based on the remaining timer duration of each message's received timestamp, the timeout proximity of each message's received timestamp is obtained. The shorter the remaining timer duration, the higher the risk of timeout, i.e., the higher the timeout proximity; the two are inversely correlated. In an exemplary embodiment, this embodiment pre-defines an inverse proportional function, inputting the remaining timer duration of each message's received timestamp into this function, and outputting the timeout proximity of each message's received timestamp. Furthermore, this inverse proportional function can also have saturation truncation logic. Based on meeting the requirements, a specific implementation of the inverse proportional function is given below: ; in, Indicates the first The timeout approximation of each message's received timestamp; min represents the minimum value function. This represents a preset order-of-magnitude adjustment constant. This represents a preset small positive number. This indicates the preset upper limit of saturation.

[0039] Order of magnitude adjustment constant The order-of-magnitude adjustment constant is used to adjust the order of magnitude of the calculation results so that they fall within a numerical range that facilitates subsequent processing. The unit of measurement is also milliseconds, and in this embodiment, it is set to . millisecond.

[0040] tiny positive numbers In this embodiment, it is set to 1 millisecond, which is used to prevent when When the denominator is zero (i.e., a timeout occurs), a calculation error occurs. Also, small positive numbers... The existence of this limit restricts the growth slope of the inverse proportional function near zero, thus playing a preliminary role in numerical stabilization.

[0041] Inverse proportional term This demonstrates the negative correlation between shorter remaining timer duration and higher risk. Through inverse proportional transformation, the original... Tiny intervals on the number line that are close to zero (i.e., the critical high-risk area) are stretched and mapped as follows: The vast range of values ​​on the number line is compressed and mapped to tiny values ​​close to zero, whereas the safe range that was originally far from zero is compressed and mapped to tiny values ​​close to zero. This transformation effectively amplifies the signal characteristics near the timeout state.

[0042] Saturation upper limit In this embodiment, it is set to (that is, when) (theoretical maximum value when =0), upper limit of saturation. Dimensionless.

[0043] The `min` function is used to perform saturation truncation logic, which is significant because it addresses situations where network interruption causes... When the risk value is consistently zero, it should not accumulate or overflow indefinitely. Once it reaches the saturation limit, it indicates that the current moment is in a state of highest risk, and the risk value will remain constant regardless of subsequent increases in delay. This ensures the stability of subsequent data processing and prevents a single outlier from causing devastating biases in the overall statistics.

[0044] Through the above data processing, the remaining timer duration sequence is obtained. Transformed into a timeout approximation sequence strictly aligned with the sampling window : .in, This indicates the timeout proximity of the first message's received timestamp. This indicates the timeout proximity of the second message's received timestamp. This represents the timeout proximity of the received timestamp of the Nth message. Timeout proximity sequence. All timeout approximation values ​​are dimensionless data.

[0045] Timeout Approximation Sequence The original chronological order of the data is preserved, but its numerical meaning has shifted from physical time to temporal risk. This applies to the timeout approximation sequence. In this model, dramatic fluctuations in values ​​no longer merely represent time jitter, but directly reflect the degree of proximity to the brink of collapse. This embodiment can also generate a timeout proximity sequence. The data is stored in a cache as input data for subsequent steps. As the sampling window slides and updates (i.e., new packets arrive and old packets are removed), the timeout approximation sequence... It also updates in real time, constantly reflecting the risk fluctuations caused by the most recent N messages. This real-time streaming processing mechanism ensures a millisecond-level response to sudden time-pressured behaviors.

[0046] Step S3: Determine the degree of morphological deviation between the timeout approximation sequence and the preset attack mode sequence.

[0047] To identify specific attack behaviors, this step first requires defining the ideal attack pattern. Attackers typically employ specific packet sending strategies to maintain pressure. Based on this, this embodiment presupposes a sequence related to the timeout approximation degree. Attack pattern sequences of the same length, i.e., attack pattern sequences of length N. Attack pattern sequence As a benchmark for shape matching, it does not change with changes in real-time data.

[0048] In this embodiment, the attack mode sequence The system supports multiple strategies to cover different attack scenarios, mainly divided into two types: constant pressure mode and fluctuating pressure mode.

[0049] The constant pressure mode simulates an attacker attempting to keep the ECU at a fixed critical point (e.g., with only 10% of the timer remaining). At this point, the attack mode sequence... Given a constant sequence, each element can be set as: ; in, Indicates attack pattern sequence The first in One element, , This indicates the set compression coefficient (e.g., 0.1).

[0050] The fluctuation pressure pattern simulates an attacker using a sawtooth rhythm of packet sending-pause-packet sending. In this case, the attack pattern sequence... This is a sequence that fluctuates according to a preset frequency (such as a sine wave or sawtooth wave). Taking a sine wave as an example, the attack pattern sequence is given below. This is one specific implementation method. It should be understood that, in addition to this, other implementation methods can be determined according to the actual situation.

[0051] Determine the attack pattern sequence The three core parameters are: the baseline pressure point, which represents the average remaining time the attacker attempts to maintain the timer, and is usually set to... A very small percentage (e.g., 5%~10%), for example =5000 milliseconds, the attacker attempts to maintain the remaining duration at around 250 milliseconds, which is within the critical danger zone. Fluctuation amplitude represents the range of jitter created by the attacker. To simulate network jitter or test system boundaries, the attacker will fluctuate around the baseline stress point, for example, ±50 milliseconds. Fluctuation period represents the frequency of the attack rhythm (which can be measured in packets), determined based on the attack script's cycle, such as completing a "high-pressure-low-pressure" cycle every 20 packets. Based on the above analysis, the attack pattern sequence is determined. Target average timer remaining time (e.g., 200 milliseconds), target fluctuation range (e.g., 50 milliseconds), attack period P (e.g., 50 packets).

[0052] Determining the attack pattern sequence Corresponding target timer remaining duration sequence : ; in, Represents the remaining duration sequence of the target timer The Middle The remaining time of each target timer Represents pi. Target timer remaining duration sequence. It can simulate a timer remaining time fluctuating sinusoidally between 150 milliseconds and 250 milliseconds.

[0053] Then, based on the target timer remaining duration sequence Using the timeout approximation formula mentioned above, the attack pattern sequence is obtained. The timeout approximation degree of each element is arranged in chronological order to obtain the attack pattern sequence. .

[0054] Determine the timeout approximation sequence With attack pattern sequence The degree of morphological deviation. (Referring to the attack pattern sequence above.) Taking a sine wave as an example, in mobile networks, random jitter in the message reception time interval can cause the attack waveform to undergo irregular stretching, compression, or local shifting on the time axis (disalignment noise). To tolerate this disalignment noise, this step applies a dynamic time warping algorithm to obtain a timeout approximation sequence. With attack pattern sequence The degree of morphological deviation between them is determined as follows: Construct the cumulative distance block matrix. It should be understood that the cumulative distance block matrix is ​​a... Distance cumulative matrix For the distance cumulative matrix any coordinate in , representing the timeout approximation sequence The first in Individual points and attack pattern sequence The first in The matching relationship between points.

[0055] Timeout Approximation Sequence With attack pattern sequence During the cumulative distance calculation process in the dynamic time warping algorithm, the output distance accumulation matrix is... Each element value in the matrix represents a distance accumulation matrix. The cumulative distance at each coordinate in the middle, specifically: ; in, Represents the distance cumulative matrix median coordinate The element value, i.e., the coordinate. The cumulative distance, express and absolute distance, Indicates attack pattern sequence The first in Data values ​​of each point, , Represents the distance cumulative matrix median coordinate The element value, i.e., the coordinate. The cumulative distance, Represents the distance cumulative matrix median coordinate The element value, i.e., the coordinate. The cumulative distance, Represents the distance cumulative matrix median coordinate The element value, i.e., the coordinate. The cumulative distance. This indicates stretching along the corresponding time axis. This indicates compression of the corresponding time axis. This indicates a direct match.

[0056] It should be understood that, in the above, and When both are equal to 1, , and All are set to 0 to obtain .

[0057] The physical meaning of this recursive formula is: in order to reach the coordinates It will automatically select the path with the lowest cost in the previous step, which is equivalent to allowing the insertion of empty spaces or the merging of coordinates on the timeline, thereby bypassing the local noise caused by network jitter.

[0058] As another implementation method, if the attack pattern sequence It is obtained from the constant oppression mode, then the attack mode sequence If all element values ​​are equal, the distance accumulation matrix is ​​obtained by following the same process described above. The values ​​of each element in the array.

[0059] Determine the distance accumulation matrix The endpoint element of the matrix in the element value is the element value of the last row and last column, i.e., the coordinates. element value .coordinate element value Represents the time-excess approximation sequence With attack pattern sequence The total distance after optimal time axis normalization. Based on coordinates. element value With distance accumulation matrix number of rows The degree of morphological deviation is obtained by utilizing the distance accumulation matrix. number of rows As the length of the matrix, relative to the coordinates The element values ​​are averaged, and the result is the degree of morphological deviation: ; in, Indicates the timeout approximation sequence With attack pattern sequence The degree of morphological deviation.

[0060] like A smaller value indicates that, after tolerating the timeline scaling caused by network jitter, the overall fluctuation pattern of the current real-time timeout approximation is highly consistent with the preset attack pattern (i.e., it possesses artificial structure), meaning the higher the probability of being attacked at the current moment, the higher the attack judgment index at the current moment; if A larger value indicates that even after normalization, the two forms are still quite different (i.e., they possess randomness and disorder), and the lower the probability of being attacked at the current moment, the lower the attack judgment index at the current moment. Therefore, the attack judgment index at the current moment is inversely correlated with the degree of form deviation.

[0061] Step S4: Based on the timeout approximation degree and the degree of morphological deviation, obtain the attack judgment index at the current moment.

[0062] Based on the timeout approximation sequence To obtain the overall timeout approximation status, in an exemplary embodiment, a timeout approximation sequence is calculated. The average timeout approximation of each message's received timestamp is used as the overall timeout approximation level. ; in, This indicates the overall timeout approximation status. This characterizes the average stress experienced by the ECU timer during the sampling window. So, what is the overall situation regarding the timeout approximation? The smaller the value, the lower the probability of being attacked at the current moment, that is, the lower the attack judgment index at the current moment; overall situation of timeout approximation. The higher the value, the higher the probability of being attacked at the current moment; that is, the higher the attack detection index at the current moment. The attack detection index is related to the overall situation of timeout proximity. Positive correlation.

[0063] This embodiment successfully decouples complex temporal risks into two independent scalar dimensions: one representing whether the attack resembles an attack. And the characterization of risk or not Then, these two scalars are used as core inputs and merged into a single quantitative indicator—the attack determination indicator at the current moment—and based on this, a refined security response strategy is executed to distinguish between malicious attacks and environmental congestion.

[0064] In one exemplary embodiment, the following is a method for calculating the attack determination index at the current moment: ; in, This indicates the attack detection index at the current moment. This represents the preset morphological tolerance factor.

[0065] molecular Demonstrates a positive correlation. The larger the numerator, the higher the attack detection index, and the more consistent with attack characteristics. (Denominator) This indicates a negative correlation and shows the degree of time-lapse approximation in the sequence. The closer to the attack pattern sequence (That is, the more stable the shape), The smaller the denominator, the higher the attack detection index, and the more consistent with attack characteristics. Morphological tolerance factor. It is a preset constant used to avoid a denominator of 0; morphological tolerance factor. It is a smooth minimum value, for example, a value of 1. When encountering targeted attacks, Approaching (Molecular size is extremely large), and Approaching 0 (denominator is extremely small, close to 0) ),lead to It has increased exponentially.

[0066] Step S5: Obtain the information security assessment results of intelligent connected vehicles based on the attack judgment indicators.

[0067] Based on the attack assessment indicators at the current moment, the information security assessment result of the intelligent connected vehicle at the current moment is obtained. To achieve accurate hierarchical assessment, this embodiment presets two risk level thresholds: a first risk level threshold and a second risk level threshold, where the first risk level threshold is lower than the second risk level threshold. The first risk level threshold can be defined as an environmental warning threshold, and the second risk level threshold can be defined as an attack assessment threshold.

[0068] The specific values ​​of the first and second risk thresholds are determined by the selection range of each constant in the calculation method of the aforementioned attack determination index, combined with the actual judgment needs. In an exemplary embodiment, the theoretical maximum and minimum values ​​of the attack determination index are determined according to the calculation method of the attack determination index. The first and second risk thresholds are determined according to a preset percentage of the maximum value. For example, the maximum value is multiplied by 30% to obtain the first risk threshold, and the maximum value is multiplied by 70% to obtain the second risk threshold. Alternatively, the first risk threshold can be set based on the average risk benchmark when the ECU is working at full load. The second risk threshold can be obtained by taking 80% of the typical value of the attack determination index obtained statistically under simulated attack scenarios. The second risk threshold ensures that only behaviors with high homogeneity will be judged as attacks.

[0069] The attack determination index at the current moment is compared with the first risk level threshold and the second risk level threshold: when the attack determination index is less than or equal to the first risk level threshold, the current intelligent connected vehicle information security assessment result is determined to be in a normal communication state, and a normal communication state signal is output; when the attack determination index is greater than the first risk level threshold and less than or equal to the second risk level threshold, the current state is determined to be in a network transmission congestion state, i.e., the intelligent connected vehicle information security assessment result is determined to be in a network transmission congestion state, and a network transmission congestion state signal is output; when the attack determination index is greater than the second risk level threshold, it indicates that the current data flow not only has extremely high pressure intensity, but also has a shape that is highly consistent with the standard attack waveform (significant human characteristics), and the current state is determined to be in a time-series pressure attack state, i.e., the intelligent connected vehicle information security assessment result is determined to be in a time-series pressure attack state, and a time-series pressure attack state signal is output.

[0070] In addition, this embodiment can also provide corresponding execution strategies for the three states obtained from the above judgment: In response to a timing-based pressure attack: Implement proactive blocking defense. Specifically: Immediately send a session control command (0x10 service) for the Unified Diagnostic Service (UDS) to the vehicle gateway, forcibly resetting the ECU to the default session mode (DefaultSession), thereby cutting off the upgrade link and preventing the ECU from crashing due to prolonged criticality. Simultaneously, record the timestamp of the attack. As evidence data.

[0071] For network congestion: Implement passive environment logging. Specifically, do not block the current upgrade connection to avoid false positives; only accumulate the duration of the weak network period in the background log. After the upgrade is complete, calculate the proportion of the weak network duration to the total duration and generate a vehicle communication robustness score report.

[0072] For normal communication status: maintain silent monitoring and do not interfere with the normal upgrade process.

[0073] Through the aforementioned hierarchical decision-making mechanism, this invention achieves a leap from a single defense function to a comprehensive security and environmental assessment function, ensuring the safety and stability of vehicles in complex network environments.

[0074] In one exemplary embodiment, this embodiment also provides an intelligent connected vehicle information security assessment system, including: a memory and a processor; the memory is connected to the processor, and the memory is used to store program instructions; the processor is used to implement the steps in the above-described intelligent connected vehicle information security assessment method embodiment when the program instructions are executed.

[0075] In one exemplary embodiment, this embodiment also provides an intelligent connected vehicle information security assessment device, comprising: a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in the above-described intelligent connected vehicle information security assessment method embodiment.

[0076] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0077] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for assessing the information security of intelligent connected vehicles, characterized in that, include: Based on the time interval between adjacent message reception timestamps in the message reception timestamp sequence related to the current time, the remaining timer duration for each message reception timestamp is obtained; The remaining duration of the timer is the remaining duration of the response timeout timer of the vehicle electronic control unit during firmware over-the-air download, which is constrained by the transmission protocol. The acquisition process includes: determining the time interval between each message reception timestamp in the message reception timestamp sequence and its adjacent preceding message reception timestamp; subtracting a preset message processing time from the time interval to obtain the additional time occupied by the timer due to network transmission delay for each message reception timestamp; calculating the difference between a preset timer response timeout threshold and the additional time occupied to obtain the remaining duration of the timer for each message reception timestamp; wherein, the preset message processing time is the inherent time required for the vehicle electronic control unit to process data; and the preset timer response timeout threshold is the maximum timeout set by the timer. Based on the remaining time of the timer for each message reception timestamp, the timeout approximation degree of each message reception timestamp is obtained, including: inputting the remaining time of the timer into a preset inverse proportional function and outputting the timeout approximation degree; The degree of morphological deviation between the timeout approximation sequence and the preset attack mode sequence is determined. The timeout approximation sequence is composed of the timeout approximation of each message reception timestamp. The process of obtaining the morphological deviation includes: constructing a cumulative distance block matrix; inputting the timeout approximation sequence and the preset attack mode sequence into the cumulative distance calculation process in the dynamic time warping algorithm, and outputting the values ​​of each element in the cumulative distance block matrix; obtaining the morphological deviation based on the matrix endpoint element value and the number of rows in the cumulative distance block matrix; the matrix endpoint element value is the element value of the last row and the last column. Based on the timeout approximation degree and the morphological deviation degree, the attack judgment index at the current moment is obtained; the attack judgment index is positively correlated with the timeout approximation degree and negatively correlated with the morphological deviation degree. The information security assessment results of intelligent connected vehicles are obtained from the attack detection indicators.

2. The intelligent connected vehicle information security assessment method as described in claim 1, characterized in that, The process of obtaining the preset message processing time includes: Obtain the second preset number of historical message reception timestamps before the current time, and determine the historical time interval between adjacent historical message reception timestamps; Arrange the historical time intervals in ascending order, and select the historical time interval corresponding to the lower preset percentile as the preset message processing time.

3. The intelligent connected vehicle information security assessment method as described in claim 1, characterized in that, The process of obtaining the attack determination indicators includes: Calculate the average timeout approximation of each message's received timestamp to obtain the overall timeout approximation situation; The attack determination index is obtained based on the overall situation of the timeout approximation degree and the degree of morphological deviation.

4. The intelligent connected vehicle information security assessment method as described in claim 1, characterized in that, The information security assessment results for intelligent connected vehicles obtained from the attack determination indicators include: The attack determination index is compared with the magnitude of a first risk level threshold and a second risk level threshold; the first risk level threshold is less than the second risk level threshold. When the attack determination index is less than or equal to the first risk level threshold, the information security assessment result of the intelligent connected vehicle is determined to be in a normal communication state. When the attack determination index is greater than the first risk level threshold and less than or equal to the second risk level threshold, the intelligent connected vehicle information security assessment result is determined to be a network transmission congestion state. When the attack determination index is greater than the second risk level threshold, the information security assessment result of the intelligent connected vehicle is determined to be a time-compression attack state.

5. The intelligent connected vehicle information security assessment method as described in claim 1, characterized in that, The process of obtaining the message reception timestamp sequence includes: Obtain the first preset number of message reception timestamps before the current time, and construct the message reception timestamp sequence in chronological order.

6. An intelligent connected vehicle information security assessment system, characterized in that it includes: Memory and processor; The memory is connected to the processor; The memory is used to store program instructions; The processor is configured to implement the intelligent connected vehicle information security assessment method according to any one of claims 1-5 when the program instructions are executed.

7. An intelligent connected vehicle information security assessment device, characterized in that, The invention includes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the intelligent connected vehicle information security assessment method according to any one of claims 1-5.

Images