Intelligent detection and protection method and device for communication security threats of vehicle-mounted terminal

Abstract

This application provides a method and apparatus for intelligent detection and protection against communication security threats to vehicle-mounted terminals. It achieves accurate communication analysis through protocol parsing and feature extraction. A detection mechanism is constructed, combining feature encoding and anomaly scoring to establish a reliable threat identification strategy. Protection optimization is introduced, ensuring continuous security through graded classification and tiered response. This method effectively addresses the shortcomings of traditional technologies in feature extraction, threat identification, and protection response, providing technical assurance for vehicle-mounted communication security.

Description

Technical Field

[0001] This application relates to the field of data processing, specifically to a method and device for intelligent detection and protection against communication security threats for vehicle-mounted terminals. Background Technology

[0002] Existing methods for vehicle-mounted communication security detection have significant shortcomings. Traditional systems perform poorly in data capture and protocol parsing, failing to effectively extract communication features and thus affecting detection results.

[0003] Furthermore, existing technologies face bottlenecks in anomaly detection and threat classification. Most systems lack robust feature encoding mechanisms and scoring strategies, resulting in suboptimal threat identification accuracy.

[0004] Existing systems have technical shortcomings in terms of protection and response. The lack of in-depth analysis of threat levels makes it difficult to achieve efficient security protection through tiered responses, thus affecting the effectiveness of protection. Solving these problems is of great significance for improving the security capabilities of in-vehicle communications. Summary of the Invention

[0005] To address the problems in existing technologies, this application provides a method and apparatus for intelligent detection and protection against communication security threats in vehicle-mounted terminals. This method and apparatus can effectively solve the shortcomings of traditional technologies in feature extraction, threat identification, and protection response, and provide technical protection for vehicle-mounted communication security.

[0006] To solve at least one of the above problems, this application provides the following technical solution: Firstly, this application provides a method for intelligent detection and protection against communication security threats to vehicle-mounted terminals, including: Data frame capture hook functions are registered for the various communication interfaces of the vehicle terminal to obtain the original data frame stream of the multiple interfaces. The protocol parser is called according to the interface type of the original data frame stream of the multiple interfaces to obtain the structured communication event sequence. Protocol field features, timing features and statistical features are extracted from the structured communication event sequence and normalization is performed to obtain the communication event feature vector sequence. The communication event feature vector sequence is input into a dilated causal convolutional encoder to obtain an encoded feature sequence. The encoded feature sequence is input into a bidirectional gated recurrent unit layer to obtain a fused hidden state sequence. The fused hidden state sequence is input into an anomaly scoring head to obtain an anomaly deviation score sequence. An out-of-limit comparison is performed between the anomaly deviation score sequence and an adaptive anomaly judgment threshold to obtain an anomaly event location index. The feature vector corresponding to the abnormal event location index is concatenated with the corresponding vector in the fused hidden state sequence to obtain the classification input feature. The classification input feature is input into a hierarchical classification head network to obtain a threat category label and a confidence score. The threat category label is assigned a value according to the mapping rule to obtain a threat level identifier. The threat level identifier and the confidence score are queried from the response strategy decision table to obtain the protection measure code. The protection measure code is used to perform protection actions on the corresponding communication interface of the vehicle terminal according to the hierarchical response rule.

[0007] Furthermore, it also includes: registering data frame callback functions in the corresponding protocol stack layers for the vehicle diagnostic interface, vehicle-to-vehicle communication interface, and cellular network interface of the vehicle terminal, and adding timestamps and interface type identifiers to the original data frames captured by each interface and writing them into an unlocked circular buffer to obtain a multi-interface original data frame stream; The original data frame streams from the multiple interfaces are distributed to the corresponding protocol parsers according to the interface type identifier. The message identifier and service identifier are parsed for the vehicle diagnostic interface data frames, the certificate status check and message payload are parsed for the vehicle-to-vehicle communication interface data frames, and the application protocol identification and port mapping are performed for the cellular network interface data frames. The parsing results are encapsulated according to a unified event structure to obtain a structured communication event sequence.

[0008] Furthermore, it also includes: extracting message identifier encoding and service identifier encoding and data field length as protocol field features for each communication event in the structured communication event sequence; extracting the time interval between adjacent similar messages as time sequence features; extracting the frequency of similar messages and the rate of change of data field within the sliding window as statistical features; and concatenating the protocol field features and the time sequence features with the statistical features to obtain the original feature vector. The original feature vector is zero-padded dimension alignment is performed according to the interface type, and the interface type encoding is added to the header to obtain the aligned feature vector. The numerical features in the aligned feature vector are normalized according to the mean and standard deviation of offline statistics to obtain the communication event feature vector sequence.

[0009] Furthermore, it also includes: inputting the communication event feature vector sequence into a multi-layer dilated causal convolutional block, with the dilation factor of each layer increasing exponentially, and performing depthwise separable convolution and batch normalization and activation function calculation sequentially within each convolutional block, and outputting the encoded feature sequence through residual connection; The encoded feature sequence is input into a bidirectional gated recurrent unit layer. The gated recurrent unit adopts a low-rank decomposition of the parameter matrix and performs recurrent processing along the forward and backward directions to obtain a forward hidden state sequence and a backward hidden state sequence, respectively. The forward hidden state sequence and the backward hidden state sequence are spliced ​​and fused to obtain a fused hidden state sequence.

[0010] Furthermore, it also includes: inputting the fused hidden state sequence into a two-layer fully connected network and normalizing the values ​​to the zero-to-one interval through the output activation layer to obtain an abnormal deviation score sequence; calculating the moving mean and moving variance of the abnormal deviation score sequence for windows that are judged to be normal to obtain the normal behavior baseline statistics. An adaptive anomaly determination threshold is obtained by adaptively updating the normal behavior baseline statistics according to a preset adjustment step size. An over-limit comparison is performed between each score in the anomaly deviation score sequence and the adaptive anomaly determination threshold. The time sequence position corresponding to the score exceeding the adaptive anomaly determination threshold is recorded to obtain the anomaly event location index.

[0011] Furthermore, it also includes: extracting the corresponding position feature vector and its neighboring feature vectors from the communication event feature vector sequence to obtain the abnormal event context feature for the abnormal event location index; and concatenating the abnormal event context feature with the corresponding position vector in the fused hidden state sequence to obtain the classification input feature. The first-level classification head is used to perform threat category classification to obtain the threat category probability distribution. Based on the threat category probability distribution, the corresponding second-level fine-grained classification sub-network is selected to perform fine-grained category classification to obtain the fine-grained category probability distribution. The category combination corresponding to the highest probability in the threat category probability distribution and the fine-grained category probability distribution is determined as the threat category label. The confidence score is obtained by weighting the highest probability values ​​of the threat category probability distribution and the fine-grained category probability distribution.

[0012] Furthermore, it also includes: assigning a degree of harm to the threat category label according to a preset threat level mapping rule to obtain a threat level identifier, and querying the response strategy decision table with the threat level identifier as the row index and the confidence score range as the column index to obtain the protection measure code; The protection measures are parsed according to the hierarchical response rules. The alarm-level code is used to report the threat detection results. The rate-limiting code is used to limit the traffic rate of the communication interface that is abnormal. The blocking code is used to disconnect the specific communication connection that is abnormal. The isolation code is used to disable the communication interface that is abnormal and restore the interface function after a configurable isolation period.

[0013] Secondly, this application provides an intelligent detection and protection device for communication security threats to vehicle-mounted terminals, comprising: The data acquisition module is used to register data frame capture hook functions for various communication interfaces of the vehicle terminal to obtain raw data frame streams of multiple interfaces, call the protocol parser according to the interface type to obtain a structured communication event sequence, extract protocol field features, timing features and statistical features from the structured communication event sequence and perform normalization processing to obtain a communication event feature vector sequence. An anomaly localization module is used to input the communication event feature vector sequence into a dilated causal convolutional encoder to obtain an encoded feature sequence, input the encoded feature sequence into a bidirectional gated recurrent unit layer to obtain a fused hidden state sequence, input the fused hidden state sequence into an anomaly scoring head to obtain an anomaly deviation score sequence, and perform an over-limit comparison between the anomaly deviation score sequence and an adaptive anomaly judgment threshold to obtain an anomaly event localization index. The risk warning module is used to concatenate the feature vector corresponding to the abnormal event location index with the corresponding vector in the fused hidden state sequence to obtain classification input features. The classification input features are then input into a hierarchical classification head network to obtain threat category labels and confidence scores. The threat category labels are assigned values ​​according to mapping rules to obtain threat level identifiers. The threat level identifiers and confidence scores are queried from a response strategy decision table to obtain protection measure codes. The protection measure codes are then used to perform protection actions on the corresponding communication interface of the vehicle terminal according to hierarchical response rules.

[0014] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals.

[0015] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals.

[0016] Fifthly, this application provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals.

[0017] As described above, this application provides a method and apparatus for intelligent detection and protection against communication security threats to vehicle-mounted terminals. Through protocol parsing and feature extraction, it achieves accurate communication analysis. A detection mechanism is constructed, combining feature coding and anomaly scoring to establish a reliable threat identification strategy. Protection optimization is introduced, ensuring continuous security through graded classification and hierarchical response. This method effectively addresses the shortcomings of traditional technologies in feature extraction, threat identification, and protection response, providing technical assurance for vehicle-mounted communication security. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the intelligent detection and protection method for communication security threats to vehicle-mounted terminals in the embodiments of this application. Figure 2 This is a structural diagram of the intelligent detection and protection device for communication security threats to vehicle-mounted terminals in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] The acquisition, storage, use, and processing of data in this application comply with relevant laws and regulations.

[0022] In view of the problems existing in the prior art, this application provides a method and device for intelligent detection and protection of communication security threats for vehicle terminals. It achieves accurate analysis of communication through protocol parsing and feature extraction. A detection mechanism is constructed, combining feature encoding and anomaly scoring to establish a reliable threat identification strategy. Protection optimization is introduced, ensuring continuous security through graded classification and hierarchical response. This method effectively solves the shortcomings of traditional technologies in feature extraction, threat identification, and protection response, providing technical protection for vehicle communication security.

[0023] To effectively address the shortcomings of traditional technologies in feature extraction, threat identification, and protection response, and to provide technical safeguards for vehicle-mounted communication security, this application provides an embodiment of an intelligent detection and protection method for communication security threats to vehicle-mounted terminals. See [link to embodiment]. Figure 1 The intelligent detection and protection method for communication security threats to vehicle-mounted terminals specifically includes the following: Step S101: Register data frame capture hook functions for the various communication interfaces of the vehicle terminal to obtain the original data frame stream of the multiple interfaces. Call the protocol parser according to the interface type to obtain the structured communication event sequence. Extract protocol field features, timing features and statistical features from the structured communication event sequence and perform normalization processing to obtain the communication event feature vector sequence. In this embodiment, the vehicle diagnostic interface of the vehicle terminal registers a receive frame callback function at the Controller Area Network (CAN) bus driver layer, the vehicle-to-vehicle communication interface registers a message receive callback function at the dedicated short-range communication protocol stack layer, and the cellular network interface registers a data packet filtering function at the network protocol stack layer. Each callback function intercepts a copy of the data frame before it passes through the protocol stack for processing. The intercepted original data frame is appended with a capture timestamp and an interface type identifier and then written into a lock-free circular buffer. This lock-free circular buffer uses atomic operations to enable multi-threaded concurrent access to reduce synchronization overhead. The buffer capacity is dynamically configured based on the available memory of the vehicle terminal, thereby forming a multi-interface raw data frame stream.

[0024] After the multi-interface raw data frame stream is continuously written to the lock-free circular buffer, the protocol parsing module reads the raw data frames from the buffer in a first-in-first-out order and distributes them to the corresponding protocol parsers according to the interface type identifier carried by each data frame. The vehicle diagnostic interface protocol parser extracts the message identifier field from the Controller Area Network (CAN) message frames and performs numerical parsing. For diagnostic messages, it further parses the service identifier and sub-function fields to mark the message's functional category. The vehicle-to-vehicle communication interface protocol parser performs a sender certificate chain verification status check on security messages and records the verification result marker. Simultaneously, it parses the basic security message content in the message payload to extract geographical location and motion status information. The cellular network interface protocol parser identifies the application layer protocol type of transport layer data packets by mapping the destination port number and matching the payload features, and appends the identification result as a protocol type marker to the parsing record. Each protocol parser encapsulates the parsing results according to a unified event structure to generate a structured communication event sequence.

[0025] Accordingly, the feature extraction module reads communication event records one by one from the structured communication event sequence, extracts three types of features for each communication event, and assembles them into an original feature vector. The extraction of protocol field features includes the numerical encoding of the message identifier, the one-hot encoding of the service identifier, and the data field length value. The extraction of temporal features is obtained by calculating the time interval between the current communication event and the previous message of the same type; this time interval reflects the arrival rhythm of similar messages. The extraction of statistical features is based on a sliding window mechanism, calculating the frequency of occurrence of similar messages within the window and the rate of change of the data field content; the length of the sliding window is a configurable parameter.

[0026] After the original feature vectors are generated, this embodiment performs dimension alignment processing on the feature vectors from different interface sources. Since the number of protocol fields in the communication events of each interface differs, the feature extraction module uses a zero-padding method to extend the original feature vectors of each interface to a unified dimension, and appends a one-hot encoding of the interface type to the header of the feature vector to retain the interface source information, thereby obtaining aligned feature vectors.

[0027] Based on the aligned feature vector, this embodiment performs normalization processing on the numerical features therein. The normalization parameters include the mean and standard deviation of each feature dimension, which are pre-calculated based on normal communication data collected offline. The feature extraction module subtracts the mean of the corresponding dimension from each numerical component in the aligned feature vector and divides it by the standard deviation of the corresponding dimension, then writes the processed feature vector into a feature sequence buffer to form a communication event feature vector sequence. The communication event feature vector sequence will be read in subsequent step S102 and input into a dilated causal convolutional encoder for temporal pattern encoding processing.

[0028] Step S102: Input the communication event feature vector sequence into the dilated causal convolutional encoder to obtain the encoded feature sequence, input the encoded feature sequence into the bidirectional gated recurrent unit layer to obtain the fused hidden state sequence, input the fused hidden state sequence into the anomaly scoring head to obtain the anomaly deviation score sequence, and perform an out-of-limit comparison between the anomaly deviation score sequence and the adaptive anomaly judgment threshold to obtain the anomaly event location index. In this embodiment, a sequence of communication event feature vectors is read from the feature sequence buffer generated in step S101. Subsequent calculations are triggered when the number of feature vectors in the buffer reaches a preset sliding window length. The communication event feature vector sequence is input to a dilated causal convolutional encoder, which contains multiple layers of dilated causal convolutional blocks. The dilation factor of each layer increases exponentially to expand the receptive field coverage. Within each dilated causal convolutional block, depthwise separable convolution, batch normalization, and activation function calculation are performed sequentially. Depthwise separable convolution reduces the number of parameters and computational cost by separating spatial convolution and channel convolution. The output of the convolutional block is added to the input via residual concatenation and then passed to the next layer. The dilated causal convolutional encoder performs local temporal pattern extraction on the input sequence and outputs a encoded feature sequence of the same length as the input sequence.

[0029] After the encoded feature sequence is generated, this embodiment inputs it into a bidirectional gated recurrent unit layer to perform sequence-level temporal dependency modeling. The bidirectional gated recurrent unit layer employs a low-rank parameter matrix decomposition, decomposing the parameter matrices of the update and reset gates into the product of two low-rank matrices to reduce the parameter size. During bidirectional processing, the forward gated recurrent unit traverses the encoded feature sequence in the forward temporal direction and outputs the forward hidden state position by position, while the backward gated recurrent unit traverses the encoded feature sequence in the reverse temporal direction and outputs the backward hidden state position by position. This embodiment performs a concatenation operation on the forward and backward hidden states at the same temporal position to form a fused hidden state sequence.

[0030] Accordingly, the fused hidden state sequence is input into an anomaly scoring head to calculate the degree of anomaly deviation at each temporal position. The anomaly scoring head consists of two fully connected layers and an output activation layer. The first fully connected layer performs a dimensionality transformation on the fused hidden state vector, the second fully connected layer maps the transformation result to a scalar output, and the output activation layer normalizes the output value to the zero-to-one interval using a range constraint function. In this embodiment, the fused hidden state vectors at each position in the fused hidden state sequence are sequentially input into the anomaly scoring head to obtain an anomaly deviation score sequence of equal length to the sequence. Each score in the anomaly deviation score sequence represents the degree of deviation of the corresponding temporal position communication event from the normal behavior pattern.

[0031] After the abnormal deviation score sequence is output, this embodiment maintains normal behavior baseline statistics for historical windows that are determined to be normal. The normal behavior baseline statistics include the moving mean and moving variance of the abnormal deviation distribution of normal windows. Whenever a window is determined to be normal, this embodiment incorporates the abnormal deviation score of that window into the moving statistics calculation to update the moving mean and moving variance.

[0032] Based on the baseline statistics of normal behavior, this embodiment performs adaptive updates to the anomaly detection threshold. Specifically, the adaptive anomaly detection threshold is calculated according to the following rules: the weighted combination of the moving mean and the moving variance is used as the threshold benchmark, and the weighting coefficient is preset according to the vehicle terminal safety configuration file. When the moving mean or the moving variance changes, the adaptive anomaly detection threshold is adjusted proportionally to maintain a stable false alarm rate level.

[0033] In this embodiment, each score in the anomaly deviation score sequence is compared with the adaptive anomaly determination threshold one by one. The temporal positions corresponding to the scores exceeding the adaptive anomaly determination threshold are recorded to form an anomaly event location index. The anomaly event location index will be read in the subsequent step S103 and used to extract the feature vectors of the corresponding positions from the communication event feature vector sequence and the fused hidden state sequence to construct the classification input.

[0034] Step S103: Concatenate the feature vector corresponding to the abnormal event location index with the corresponding vector in the fused hidden state sequence to obtain the classification input feature. Input the classification input feature into the hierarchical classification head network to obtain the threat category label and confidence score. Assign the threat category label according to the mapping rule to obtain the threat level identifier. Query the response strategy decision table with the threat level identifier and the confidence score to obtain the protection measure code. Perform protection actions on the corresponding communication interface of the vehicle terminal according to the hierarchical response rule.

[0035] In this embodiment, based on the abnormal event location index generated in step S102, feature vectors corresponding to the time sequence positions are extracted from the communication event feature vector sequence. To obtain the context information of the abnormal event, the feature extraction process simultaneously reads the feature vectors of the neighborhood before and after the abnormal position. The neighborhood range is a configurable parameter, thereby forming the abnormal event context features.

[0036] After the abnormal event context features are extracted, this embodiment reads the fusion hidden state vector corresponding to the abnormal event location index from the fusion hidden state sequence generated in step S102. The fusion hidden state vector contains the sequence-level semantic information of that temporal position after being encoded by a bidirectional gated cyclic unit layer.

[0037] Accordingly, this embodiment performs a concatenation operation on the abnormal event context features and the fused hidden state vector. The concatenation process places the abnormal event context features first and the fused hidden state vector last in a fixed order to form classification input features. These classification input features simultaneously carry the protocol field information of the original communication event and the temporal pattern information encoded by the neural network.

[0038] Based on the aforementioned classification input features, this embodiment inputs them into a hierarchical classification head network to perform threat type identification. The hierarchical classification head network adopts a two-level classification architecture. The first-level classification head consists of a fully connected layer and a normalized exponential output layer, classifying threat categories. Threat categories include protocol anomalies, identity forgery, denial-of-service attacks, data tampering, and unknown anomalies. The first-level classification head outputs the probability distribution of each threat category.

[0039] After the probability distribution of the major threat categories is generated, this embodiment selects the corresponding second-level fine-grained classification sub-network based on the threat category with the highest probability. The fine-grained categories corresponding to the protocol anomaly category include diagnostic command anomalies and message format anomalies; the fine-grained categories corresponding to the identity forgery category include certificate forgery and identifier spoofing; the fine-grained categories corresponding to the denial-of-service category include message flooding and channel interference; and the fine-grained categories corresponding to the data tampering category include payload tampering and replay attacks. Each fine-grained classification sub-network consists of an independent fully connected layer and a normalized exponential output layer, outputting the fine-grained category probability distribution.

[0040] Accordingly, this embodiment comprehensively processes the probability distribution of the major threat categories and the probability distribution of the fine-grained categories to determine the final classification result. The threat category label is determined by the combination of the threat category with the highest probability and the corresponding fine-grained category. The confidence score is calculated based on the highest probability value of the threat category probability distribution and the highest probability value of the fine-grained category probability distribution, which are then weighted and summed according to a preset weighting coefficient.

[0041] After the threat category label and the confidence score are generated, this embodiment assigns a hazard level value to the threat category label according to a preset threat level mapping rule. The mapping rule is pre-configured based on the potential hazard level of each threat category, mapping the threat category to four levels: severe, high-risk, medium-risk, and low-risk, thereby obtaining the threat level identifier.

[0042] Based on the threat level identifier and the confidence score, this embodiment queries the response strategy decision table to determine protective measures. The row index of the response strategy decision table is the threat level, the column index is the confidence score interval, and the table entries contain the protective measure codes to be executed under the corresponding conditions. The query process locates the decision table rows using the threat level identifier and the decision table columns using the confidence score interval, reading the protective measure codes at the intersection.

[0043] After the protection measure codes are determined, this embodiment performs protection actions on the corresponding communication interfaces of the vehicle terminal according to the graded response rules. For alarm-level codes, the protection response module reports the threat detection results to the remote security monitoring platform through the cellular network interface. For speed-limiting codes, the protection response module implements traffic rate limiting on the communication interfaces that generate abnormal events; the speed-limiting parameters and duration are read from the configuration file according to the threat level.

[0044] For blocking-level coding, the protection response module disconnects the specific communication connection that caused the abnormal event, blocks the reception of specific identifier messages on the vehicle diagnostic interface, and blocks the transmission of data packets to specific destination addresses on the cellular network interface. For isolation-level coding, the protection response module disables the entire communication interface that caused the abnormal event for a configurable isolation window period. After the isolation period expires, the interface function is automatically restored and the system enters enhanced monitoring mode. After executing each level of protection action, the protection response module records a response action log, which includes a response timestamp, trigger detection result identifier, response measure type, and response execution status.

[0045] As described above, the intelligent detection and protection method for communication security threats to vehicle-mounted terminals provided in this application can achieve accurate analysis of communications through protocol parsing and feature extraction. A detection mechanism is constructed, combining feature encoding and anomaly scoring to establish a reliable threat identification strategy. Protection optimization is introduced, ensuring continuous security through graded classification and hierarchical response. This method effectively addresses the shortcomings of traditional technologies in feature extraction, threat identification, and protection response, providing technical assurance for vehicle-mounted communication security.

[0046] In one embodiment of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals in this application, the method may further include the following: Step S201: Register data frame callback functions for the vehicle diagnostic interface, vehicle-to-vehicle communication interface, and cellular network interface of the vehicle terminal in the corresponding protocol stack layer, and write the original data frames captured by each interface with timestamps and interface type identifiers into the lockless circular buffer to obtain the original data frame stream of multiple interfaces. Step S202: Distribute the original data frame stream of the multi-interface to the corresponding protocol parser according to the interface type identifier, perform message identifier and service identifier parsing on the vehicle diagnostic interface data frame, perform certificate status check and message payload parsing on the vehicle-to-vehicle communication interface data frame, perform application protocol identification and port mapping on the cellular network interface data frame, and encapsulate the parsing results according to a unified event structure to obtain a structured communication event sequence.

[0047] In this embodiment, a data frame callback function is registered for the vehicle diagnostic interface at the kernel layer of the vehicle terminal operating system. The callback function sets a capture point on the receiving path of the controller local area network (Controller Area Network) bus driver layer. When a Controller Area Network (Controller Area Network) message frame is processed by the driver layer, the callback function intercepts a copy of the message frame and reads the message identifier, data length code, and data field content.

[0048] After the on-board diagnostic interface callback function is registered, this embodiment registers a message receiving callback function for the vehicle-to-vehicle communication interface at the dedicated short-range communication protocol stack layer. The callback function sets a capture point in the message receiving processing flow of the protocol stack. When a vehicle-to-vehicle communication security message or service announcement message arrives, the callback function intercepts a copy of the message and reads the message type, sender certificate digest, geographical location information, and message payload content.

[0049] Accordingly, this embodiment registers a data packet filtering function at the network protocol stack layer for the cellular network interface. The filtering function sets capture points on the transmission and reception path of the transport layer data packets. When a data packet passes through the network protocol stack, the filtering function intercepts a copy of the data packet and reads the source address, destination address, source port, destination port, protocol type, and payload length information.

[0050] After each interface callback function completes the data frame capture, this embodiment appends metadata information to the captured raw data frames. The data acquisition module generates a high-precision timestamp for each captured data frame, the timestamp using the microsecond-level timing value of the vehicle terminal system clock. The data acquisition module also appends an interface type identifier to the data frame, the interface type identifier using a predefined enumeration encoding to distinguish the source of the data frame.

[0051] Based on the data frames with the added metadata, this embodiment writes them into a lock-free circular buffer. The lock-free circular buffer uses atomic compare-and-swap operations to synchronize concurrent access between producers and consumers, avoiding the thread blocking overhead caused by mutex locks. The buffer capacity is dynamically configured according to the available memory of the vehicle terminal; when the buffer is full, new data frames overwrite the oldest data frames. Each interface callback function continuously writes data frames to the lock-free circular buffer, forming a multi-interface raw data frame stream.

[0052] After the multi-interface raw data frame stream is continuously written, the protocol parsing module reads the raw data frames from the lock-free circular buffer in a first-in-first-out order. The protocol parsing module checks the interface type identifier carried in each data frame and distributes the data frame to the corresponding protocol parser according to the interface type identifier.

[0053] For data frames whose interface type identifier indicates an on-board diagnostic interface, this embodiment calls the on-board diagnostic interface protocol parser to perform parsing processing. The protocol parser performs numerical parsing and classification on the message identifier field of the Controller Area Network (CAN) message frame, distinguishing between diagnostic request messages and diagnostic response messages. For diagnostic messages, the protocol parser further parses the service identifier and sub-function fields, marking the message's functional category based on the parsing results.

[0054] For data frames whose interface type identifier indicates a vehicle-to-vehicle communication interface, this embodiment calls the vehicle-to-vehicle communication interface protocol parser to perform parsing processing. The protocol parser performs a verification status check on the sender's certificate chain for the security message, recording verification success, verification failure, or certificate missing status as certificate status markers. Simultaneously, the protocol parser parses the basic security message content in the message payload, extracting the vehicle's geographical location coordinates, speed, and heading angle information.

[0055] For data frames whose interface type identifier indicates a cellular network interface, this embodiment invokes a cellular network interface protocol parser to perform parsing processing. The protocol parser identifies application layer protocol types such as Telematics Service (TMS), Message Queuing (MQL), and Hypertext Transfer Protocol (HTTP) by matching the destination port number with a predefined port mapping table. For data packets that cannot be directly identified by the port number, the protocol parser infers the protocol type through payload feature matching.

[0056] After each protocol parser completes its parsing process, this embodiment encapsulates the parsing results according to a unified event structure. This unified event structure includes a timestamp field, an interface type field, a protocol parsing result field, and a raw payload digest field. Each protocol parser fills the corresponding substructure in the protocol parsing result field with the parsing result specific to the interface type. The encapsulated records are arranged in chronological order to form a structured communication event sequence. This structured communication event sequence will be read in subsequent step S301 to extract protocol field features, temporal features, and statistical features.

[0057] In one embodiment of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals in this application, the method may further include the following: Step S301: Extract message identifier code and service identifier code and data field length as protocol field features for each communication event in the structured communication event sequence; extract the time interval between adjacent messages of the same type as time sequence features; extract the frequency of messages of the same type and the rate of change of data field within the sliding window as statistical features; and concatenate the protocol field features, the time sequence features and the statistical features to obtain the original feature vector. Step S302: Perform zero-padding dimension alignment on the original feature vector according to the interface type and add interface type encoding to the header to obtain an aligned feature vector. Perform normalization processing on the numerical features in the aligned feature vector according to the mean and standard deviation of offline statistics to obtain a communication event feature vector sequence.

[0058] In this embodiment, communication event records are read one by one from the structured communication event sequence generated in step S202, and protocol field features are extracted for each communication event. For vehicle diagnostic interface communication events, the feature extraction module reads the message identifier field and converts it into a numerical code, reads the service identifier field and converts it into a one-hot encoded form, and reads the data field length value as a feature component.

[0059] For vehicle-to-vehicle communication interface events, this embodiment extracts the message type field and converts it into one-hot encoding, extracts the certificate status flag and encodes it as a status indication value, and extracts the message payload length as a feature component. For cellular network interface communication events, this embodiment extracts the application protocol type field and converts it into one-hot encoding, extracts the destination port number and performs bucket encoding according to predefined bucketing rules, and extracts the payload length as a feature component. The message identifier encoding, service identifier encoding, and data field length together constitute the protocol field features.

[0060] After the protocol field features are extracted, this embodiment extracts time-series features for each communication event. The feature extraction module maintains the most recent arrival timestamp record for each message category under each interface type. For the current communication event, the feature extraction module retrieves the corresponding most recent arrival timestamp based on its interface type and message category, calculates the difference between the current event timestamp and the most recent arrival timestamp, and the difference is the time interval between adjacent messages of the same type. After the calculation is completed, the feature extraction module updates the current event timestamp to the corresponding most recent arrival timestamp record.

[0061] Accordingly, this embodiment extracts statistical features for each communication event. The feature extraction module maintains a sliding window data structure, the length of which is a configurable parameter, and stores records of the most recent communication events within the window. For the current communication event, the feature extraction module counts the number of events within the sliding window that belong to the same interface type and message category as the current event, and divides this number by the window time span to obtain the frequency of messages of the same type.

[0062] After calculating the frequency of similar messages, this embodiment further calculates the data field change rate. The feature extraction module extracts historical events belonging to the same message category as the current event from the sliding window and compares the differences between the data field content of the current event and the data field content of the historical events. The degree of difference is obtained by statistically analyzing the proportion of the number of changed bytes to the total number of bytes; this proportion is the data field change rate. The frequency of similar messages and the data field change rate together constitute statistical features.

[0063] Based on the protocol field features, the timing features, and the statistical features, this embodiment performs a concatenation operation on the three types of features in a fixed order. The concatenation process sequentially arranges the components of the protocol field features, the timing features, and the statistical features to form an original feature vector. The dimension of the original feature vector varies depending on the interface type of the communication event.

[0064] After the original feature vectors are generated, this embodiment performs dimension alignment processing on the original feature vectors of different interface types. The feature extraction module determines the maximum dimension value in the original feature vectors of each interface type as the unified target dimension. For original feature vectors with dimensions lower than the unified target dimension, the feature extraction module pads the end of the vector with zero values ​​to expand it to the unified target dimension.

[0065] Accordingly, this embodiment adds interface type encoding to the feature vector after zero-padding. The feature extraction module generates an interface type one-hot encoded vector based on the interface type of the communication event, and places the interface type one-hot encoded vector at the beginning of the zero-padding feature vector to form an aligned feature vector. The interface type encoding enables subsequent processing modules to distinguish the source interface of the feature vector.

[0066] After the aligned feature vector is generated, this embodiment performs normalization processing on the numerical features. The normalization parameters include the mean and standard deviation of each feature dimension. The mean and standard deviation are pre-calculated based on normal communication data collected offline and stored in the vehicle terminal configuration file. The feature extraction module reads the mean and standard deviation parameters, performs a standardization transformation on each numerical component in the aligned feature vector, and writes the transformed feature vector into the feature sequence buffer.

[0067] The feature sequence buffer stores the processed feature vectors in chronological order, forming a communication event feature vector sequence. This communication event feature vector sequence will be read in subsequent step S401 and input into the dilated causal convolutional encoder for temporal pattern encoding processing.

[0068] In one embodiment of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals in this application, the method may further include the following: Step S401: Input the communication event feature vector sequence into a multi-layer dilated causal convolution block. The dilation factor of each layer increases exponentially. In each convolution block, depthwise separable convolution and batch normalization and activation function calculation are performed in sequence, and the encoded feature sequence is output through residual connection. Step S402: Input the encoded feature sequence into a bidirectional gated recurrent unit layer. The gated recurrent unit adopts the low-rank decomposition of the parameter matrix and performs recurrent processing along the forward and backward directions to obtain the forward hidden state sequence and the backward hidden state sequence, respectively. Then, the forward hidden state sequence and the backward hidden state sequence are spliced ​​and fused to obtain the fused hidden state sequence.

[0069] In this embodiment, the feature vector sequence of communication events is read from the feature sequence buffer generated in step S302. Encoding calculation is triggered when the number of feature vectors in the buffer reaches the preset sliding window length. The communication event feature vector sequence is input into the first layer of the dilated causal convolutional block of the dilated causal convolutional encoder.

[0070] In the first layer of dilated causal convolutional block, this embodiment first performs depthwise separable convolution calculation. Depthwise separable convolution decomposes standard convolution into two stages: depthwise convolution and pointwise convolution. Depthwise convolution performs spatial convolution operations independently on each channel of the input features, while pointwise convolution linearly combines the outputs of each channel using a one-to-one convolution kernel. This decomposition method reduces the number of parameters and computational cost compared to standard convolution.

[0071] After the depthwise separable convolution calculation is completed, this embodiment performs batch normalization on the convolution output. The batch normalization layer calculates the mean and variance of the feature values ​​of each sample in the current batch, standardizes the feature values, and then performs an affine transformation using learnable scaling and offset parameters. This batch normalization process stabilizes the distribution range of the intermediate layer features.

[0072] Accordingly, this embodiment performs activation function calculation on the batch-normalized output. The activation function applies a nonlinear transformation to the input values, enabling the network to fit complex patterns. The activation function output is added to the original input of the convolutional block through a residual connection, which allows the gradient to be directly propagated back to shallow layers to alleviate the gradient vanishing problem in deep networks. The result of the residual addition is used as the output of the first dilated causal convolutional block.

[0073] After the output of the first convolutional block is generated, this embodiment sequentially inputs it into subsequent dilated causal convolutional blocks. The structure of each dilated causal convolutional block is the same as that of the first layer, including depthwise separable convolution, batch normalization, activation function, and residual connection. The difference between each layer lies in the configuration of the dilation factor. The dilation factor of the first layer is set as the baseline value, and the dilation factor of each subsequent layer increases exponentially.

[0074] The dilation factor controls the spacing between sampling points of the convolutional kernel; a larger dilation factor results in a wider receptive field coverage for the kernel. By configuring an exponentially increasing dilation factor, shallow convolutional blocks capture local short-range temporal patterns, while deep convolutional blocks capture global long-range temporal dependencies. The constraint of causal convolution ensures that the output at each temporal position depends only on the input at the current and previous positions, meeting the causality requirements of real-time processing scenarios.

[0075] After the multi-layer dilated causal convolutional blocks are processed sequentially, this embodiment obtains an encoded feature sequence. The encoded feature sequence has the same temporal length as the input communication event feature vector sequence, and the encoded feature vector at each temporal position fuses the local temporal pattern information within the corresponding position and its receptive field.

[0076] Based on the encoded feature sequence, this embodiment inputs it into a bidirectional gated recurrent unit layer to perform sequence-level temporal dependency modeling. The bidirectional gated recurrent unit layer includes two sub-units: a forward gated recurrent unit and a backward gated recurrent unit. The forward gated recurrent unit traverses the sequence in the forward temporal direction starting from the first position of the encoded feature sequence.

[0077] During the loop processing of the forward-gated loop unit, this embodiment performs gated state update calculations at each time position. The gated loop unit includes two gating mechanisms: an update gate and a reset gate. The update gate controls the retention ratio of the hidden state at the previous time step, and the reset gate controls the influence of the hidden state at the previous time step on the calculation of candidate hidden states. The gated loop unit adopts a low-rank decomposition of the parameter matrix, decomposing the parameter matrices of the update gate and the reset gate into the product of two low-rank matrices to reduce the parameter size.

[0078] Accordingly, this embodiment performs reverse loop processing on the backward-gated loop unit. The backward-gated loop unit traverses backward along the temporal sequence starting from the end of the encoded feature sequence, and its gating mechanism and parameter structure are the same as those of the forward-gated loop unit. The forward-gated loop unit outputs a forward hidden state sequence, and the backward-gated loop unit outputs a backward hidden state sequence. The temporal length of both hidden state sequences is the same as that of the encoded feature sequence.

[0079] After the forward hidden state sequence and the backward hidden state sequence are generated, this embodiment performs a concatenation operation on the forward hidden state vector and the backward hidden state vector at the same temporal position. The concatenation process places the forward hidden state vector at the beginning and the backward hidden state vector at the end, forming a fused hidden state vector for that temporal position. After performing the above concatenation operation on all temporal positions of the encoded feature sequence, a fused hidden state sequence is generated. This fused hidden state sequence will be input into the anomaly scoring head in subsequent step S501 to calculate the anomaly deviation score.

[0080] In one embodiment of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals in this application, the method may further include the following: Step S501: Input the fused hidden state sequence into a two-layer fully connected network and normalize the values ​​to the range of zero to one through the output activation layer to obtain the abnormal deviation score sequence. Calculate the moving mean and moving variance of the abnormal deviation score sequence for the windows that are judged to be normal to obtain the normal behavior baseline statistics. Step S502: Adaptively update the anomaly determination threshold by performing an adaptive update on the normal behavior baseline statistics according to a preset adjustment step size to obtain an adaptive anomaly determination threshold. Perform an over-limit comparison between each score value in the anomaly deviation score sequence and the adaptive anomaly determination threshold. Record the time sequence position corresponding to the score value that exceeds the adaptive anomaly determination threshold to obtain the anomaly event location index.

[0081] In this embodiment, the fusion hidden state vector at each time position is read sequentially from the fusion hidden state sequence generated in step S402, and then input into the anomaly scoring head to calculate the anomaly deviation. The first layer of the fully connected network of the anomaly scoring head performs a linear transformation on the fusion hidden state vector, mapping the input vector to an intermediate dimension space.

[0082] After the output of the first fully connected network is generated, this embodiment inputs it into the second fully connected network. The second fully connected network performs a further linear transformation on the intermediate dimension vector, mapping it to a scalar output. A non-linear activation function is set between the two fully connected networks to enhance the network's expressive power.

[0083] Accordingly, this embodiment performs output activation layer processing on the scalar output of the second-layer fully connected network. The output activation layer uses a range constraint function to compress input values ​​from any real number range into a closed interval between zero and one. The scalar value after processing by the output activation layer is the anomaly deviation score for that time sequence position. The closer the score is to one, the greater the deviation of the communication event at that position from the normal behavior pattern.

[0084] After all temporal positions of the fused hidden state sequence have been processed by the anomaly scoring head, this embodiment obtains an anomaly deviation score sequence. The anomaly deviation score sequence has the same temporal length as the fused hidden state sequence, and the score value at each position quantifies the degree of anomaly of the corresponding communication event.

[0085] Based on the aforementioned abnormal deviation score sequence, this embodiment performs a normality determination on the current window. The determination process checks whether the maximum score in the abnormal deviation score sequence exceeds the currently effective abnormal determination threshold. If the maximum score does not exceed the threshold, the current window is determined to be a normal window.

[0086] After the current window is determined to be a normal window, this embodiment incorporates the abnormal deviation score sequence into the update calculation of the normal behavior baseline statistics. The moving mean is updated using an exponential moving average method, which weights and merges the mean of the abnormal deviation score of the current window with the historical moving mean according to a preset smoothing coefficient. The moving variance is also updated using an exponential moving average method, which weights and merges the variance of the abnormal deviation score of the current window with the historical moving variance according to a preset smoothing coefficient.

[0087] Accordingly, this embodiment obtains a baseline statistic for normal behavior. This baseline statistic includes two components: a moving mean and a moving variance, reflecting the distribution characteristics of abnormal deviation scores of the vehicle-mounted terminal under normal communication conditions. The moving mean represents the central position of the abnormal deviation scores under normal conditions, and the moving variance represents the degree of dispersion of the abnormal deviation scores under normal conditions.

[0088] After the baseline statistics for normal behavior are updated, this embodiment performs an adaptive update of the anomaly detection threshold. The threshold update module reads the current values ​​of the moving mean and the moving variance, and calculates a new threshold benchmark based on a preset adjustment step size. The preset adjustment step size controls the magnitude of the threshold update; a smaller adjustment step size makes the threshold change smoother.

[0089] Specifically, the adaptive anomaly detection threshold is calculated based on a linear combination of the moving average and the moving variance. In this embodiment, the moving average is used as the base component of the threshold, and the square root of the moving variance multiplied by a configurable sensitivity coefficient is used as the floating component of the threshold. The two components are added together to obtain the adaptive anomaly detection threshold. The sensitivity coefficient is preset according to the vehicle terminal security configuration file.

[0090] Based on the adaptive anomaly determination threshold, this embodiment performs an out-of-limit comparison on the anomaly deviation score sequence. The anomaly detection module traverses the score values ​​at each time position in the anomaly deviation score sequence and compares each score value with the adaptive anomaly determination threshold.

[0091] During the out-of-limit comparison process, this embodiment marks the temporal positions where the scores exceed the adaptive anomaly determination threshold as anomaly positions. The anomaly detection module records the index number of each anomaly position in the sequence and aggregates the index numbers of all anomaly positions to form an anomaly event location index. The anomaly event location index will be read in the subsequent step S601 and used to extract the feature vectors of the corresponding positions from the communication event feature vector sequence and the fused hidden state sequence to construct the classification input.

[0092] In one embodiment of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals in this application, the method may further include the following: Step S601: Extract the corresponding position feature vector and its neighboring feature vectors from the communication event feature vector sequence to obtain the abnormal event context feature for the abnormal event location index; concatenate the abnormal event context feature with the corresponding position vector in the fused hidden state sequence to obtain the classification input feature. Step S602: Perform threat category classification on the first-level classification head based on the classification input features to obtain the threat category probability distribution. Select the corresponding second-level fine-grained classification sub-network based on the threat category probability distribution to perform fine-grained category classification to obtain the fine-grained category probability distribution. Determine the category combination corresponding to the highest probability in the threat category probability distribution and the fine-grained category probability distribution as the threat category label. Calculate the confidence score by weighting the highest probability values ​​in the threat category probability distribution and the fine-grained category probability distribution.

[0093] In this embodiment, based on the abnormal event location index generated in step S502, feature vectors corresponding to the time sequence positions are extracted from the communication event feature vector sequence generated in step S302. The feature extraction module reads the index numbers of each abnormal position recorded in the abnormal event location index and performs feature vector retrieval with each index number as the center position.

[0094] After the feature vector at the center position is retrieved, this embodiment further extracts the feature vectors of the neighborhood before and after the abnormal position. The neighborhood range is a configurable parameter, and the feature extraction module determines the start position of the forward neighborhood and the end position of the backward neighborhood based on the neighborhood range. For cases where the neighborhood range exceeds the sequence boundary, the feature extraction module uses a boundary truncation method.

[0095] Accordingly, this embodiment arranges the center position feature vector and the feature vectors of the preceding and following neighbors in chronological order. The arrangement process sequentially places the feature vectors of each position in the preceding neighborhood, the center position feature vector, and the feature vectors of each position in the following neighborhood, forming the abnormal event context feature. The abnormal event context feature retains the original feature information of the time of the abnormal event and the communication environment before and after it.

[0096] After the abnormal event context features are generated, this embodiment extracts the fusion hidden state vector at the corresponding position from the fusion hidden state sequence generated in step S402. The feature extraction module retrieves the fusion hidden state sequence according to the index number in the abnormal event location index and reads the fusion hidden state vector at the abnormal position. The fusion hidden state vector contains the sequence-level semantic information of that temporal position after being encoded by a bidirectional gated cyclic unit layer.

[0097] Based on the abnormal event context features and the fused latent state vector, this embodiment performs a concatenation operation to construct a classification input. The concatenation process flattens the abnormal event context features into a one-dimensional vector and places it at the beginning, then places the fused latent state vector at the end, forming the classification input features. These classification input features simultaneously carry multi-temporal location feature information of the original communication event and temporal pattern information encoded by a neural network.

[0098] After the classification input features are generated, this embodiment inputs them into the first-level classification head of the hierarchical classification head network to perform threat category classification. The first-level classification head consists of a fully connected layer and a normalized exponential output layer. The fully connected layer performs a linear transformation on the classification input features, and the normalized exponential output layer converts the transformation result into a probability distribution form.

[0099] The first-level classification header outputs five major threat categories: protocol anomaly, identity forgery, denial of service, data tampering, and unknown anomaly. The normalization index output layer performs exponential normalization calculations on the original scores of each category, ensuring that the sum of the probability values ​​for each category is one, thus forming a probability distribution for each threat category.

[0100] Accordingly, this embodiment selects the corresponding second-level fine-grained classification sub-network based on the probability distribution of the major threat categories. The selection process reads the category with the highest probability value in the probability distribution of the major threat categories as the activation category, and retrieves the corresponding fine-grained classification sub-network based on the category identifier of the activation category.

[0101] The fine-grained classification subnetwork for the protocol exception class outputs two categories: diagnostic command exception and message format exception. The fine-grained classification subnetwork for the identity forgery class outputs two categories: certificate forgery and identifier spoofing. The fine-grained classification subnetwork for the denial-of-service class outputs two categories: message flooding and channel interference. The fine-grained classification subnetwork for the data tampering class outputs two categories: payload tampering and replay attack.

[0102] After the fine-grained classification sub-network is selected, this embodiment inputs the classification input features into the sub-network to perform fine-grained category classification. Each fine-grained classification sub-network consists of an independent fully connected layer and a normalized exponential output layer, outputting the probability distribution of each fine-grained category under the threat category, thus forming a fine-grained category probability distribution.

[0103] Based on the probability distribution of the major threat categories and the probability distribution of the fine-grained categories, this embodiment determines the final threat category label. The threat category label is composed of the category identifier with the highest probability in the probability distribution of the major threat categories and the fine-grained category identifier with the highest probability in the probability distribution of the fine-grained categories.

[0104] After the threat category label is determined, this embodiment calculates a confidence score to quantify the reliability of the classification result. The confidence score is calculated based on the highest probability value of the probability distribution of the major threat category and the highest probability value of the probability distribution of the fine-grained category. In this embodiment, the two highest probability values ​​are weighted and summed according to a preset weighting coefficient, which is preset according to the vehicle terminal security configuration file. The weighted sum is the confidence score. The threat category label and the confidence score will be read in the subsequent step S701 to query the response strategy decision table to determine the protection measure code.

[0105] In one embodiment of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals in this application, the method may further include the following: Step S701: Assign a hazard level value to the threat category label according to the preset threat level mapping rule to obtain a threat level identifier. Use the threat level identifier as the row index and the confidence score range as the column index to query the response strategy decision table to obtain the protection measure code. Step S702: The protection measure code is parsed according to the hierarchical response rules. The alarm level code is reported as a threat detection result. The rate limiting level code is used to limit the traffic rate of the communication interface that is abnormal. The blocking level code is used to disconnect the specific communication connection that is abnormal. The isolation level code is used to disable the communication interface that is abnormal and restore the interface function after a configurable isolation period.

[0106] In this embodiment, the threat category tags generated in step S602 are used to assign hazard levels according to preset threat level mapping rules. The mapping rules use threat category tags as input keys and threat level identifiers as output values, and are pre-configured in the vehicle terminal security configuration file according to the potential hazard levels of each threat category.

[0107] In the specific configuration of the mapping rules, threats such as certificate forgery and identifier spoofing are mapped to a severe level due to the risk of identity impersonation. Threats such as payload tampering and replay attacks are mapped to a high-risk level due to the risk of data integrity corruption. Threats such as message flooding and channel interference are mapped to a medium-risk level due to the impact on communication availability. Threats such as diagnostic command anomalies and message format anomalies are mapped to a low-risk level due to their relatively limited scope of impact.

[0108] Accordingly, this embodiment converts the threat category label into a threat level identifier through a table lookup operation. The protection response module reads the combination of the major category identifier and the fine-grained category identifier of the threat category label, uses this combination as the key to retrieve the mapping rule, and obtains the corresponding threat level identifier. The threat level identifier is represented by a four-level code: severe, high-risk, medium-risk, and low-risk.

[0109] After the threat level identifier is generated, this embodiment performs an interval assignment determination on the confidence score generated in step S602. The confidence score range is divided into three non-overlapping continuous intervals: a high confidence interval, a medium confidence interval, and a low confidence interval. The boundary values ​​of each interval are preset according to the vehicle terminal security configuration file. The protection response module compares the confidence score with the boundary values ​​of each interval to determine the confidence interval to which it belongs.

[0110] Based on the threat level identifier and the confidence score range, this embodiment queries the response strategy decision table to determine the protective measure code. The response strategy decision table is a two-dimensional table structure, with row indexes corresponding to four threat levels and column indexes corresponding to three confidence score ranges. The table entries contain the protective measure codes to be executed under the corresponding combination of conditions.

[0111] The protection response module locates the target row of the decision table using the threat level identifier and the target column of the decision table using the confidence score interval. It then reads the table entry content at the intersection of the row and column as the protection measure code. The protection measure code uses a predefined coding system, distinguishing between four response intensities: alarm level code, rate-limiting level code, blocking level code, and isolation level code.

[0112] After the protective measure code is determined, this embodiment performs parsing and response action distribution on the protective measure code according to the hierarchical response rules. The protection response module first determines the response strength level of the protective measure code, and calls the corresponding response execution submodule according to the level type.

[0113] For alarm-level coding, this embodiment performs a threat detection result reporting operation. The protection response module encapsulates the threat category label, the threat level identifier, the confidence score, and the timestamp information of the abnormal event into an alarm message, and reports the alarm message to the remote security monitoring platform through the cellular network interface. Alarm-level response does not interfere with the local communication behavior of the vehicle terminal.

[0114] For rate-limited coding, this embodiment performs traffic rate limiting on the communication interface that generates the abnormal event. The protection response module determines the target communication interface based on the interface source identifier of the abnormal event and reads the rate-limiting parameters and rate-limiting duration corresponding to the current threat level from the security configuration file. The protection response module calls the traffic control interface of the target interface and limits the data transmission and reception rate of the interface to below the upper limit value specified by the rate-limiting parameters. The rate-limiting state continues until the rate-limiting duration expires and is automatically lifted.

[0115] For blocking-level coding, this embodiment performs a disconnection operation on the specific communication connection that generated the abnormal event. The protection response module determines the connection identifier to be blocked based on the detailed characteristics of the abnormal event. For the on-board diagnostic interface, it blocks message reception with a specific message identifier; for the cellular network interface, it blocks data packet transmission to a specific destination address; and for the near-field communication interface, it disconnects the connection with a specific peer device identifier. The blocking operation only affects the specific connection and does not affect other normal communications on the same interface.

[0116] For isolation-level coding, this embodiment disables the entire communication interface that generated the abnormal event. The protection response module calls the disable control interface of the target interface to suspend all transmit and receive functions of that interface. The disable duration is a configurable isolation window period, which is read from the security configuration file according to the threat level. After the isolation window period expires, the protection response module automatically restores the interface function and marks the interface in enhanced monitoring status. In enhanced monitoring status, the anomaly detection threshold of the interface is temporarily lowered to improve detection sensitivity.

[0117] After each level of protective response action is executed, this embodiment records a response action log. The response action log includes a response timestamp, trigger detection result identifier, response measure type, response parameters, and response execution status fields. The response action log is written to the local storage of the vehicle terminal and synchronously uploaded to the remote security monitoring platform when the vehicle terminal is connected to a trusted network for subsequent security posture analysis.

[0118] To effectively address the shortcomings of traditional technologies in feature extraction, threat identification, and protection response, and to provide technical safeguards for vehicle-mounted communication security, this application provides an embodiment of an intelligent detection and protection device for communication security threats to vehicle-mounted terminals, which implements all or part of the aforementioned intelligent detection and protection method for communication security threats to vehicle-mounted terminals. See [link to embodiment]. Figure 2 The intelligent detection and protection device for communication security threats to vehicle-mounted terminals specifically includes the following components: The data acquisition module 10 is used to register data frame capture hook functions for the various communication interfaces of the vehicle terminal to obtain the original data frame stream of the multiple interfaces, call the protocol parser according to the interface type to obtain the structured communication event sequence, extract protocol field features, timing features and statistical features from the structured communication event sequence and perform normalization processing to obtain the communication event feature vector sequence. The anomaly localization module 20 is used to input the communication event feature vector sequence into a dilated causal convolutional encoder to obtain an encoded feature sequence, input the encoded feature sequence into a bidirectional gated recurrent unit layer to obtain a fused hidden state sequence, input the fused hidden state sequence into an anomaly scoring head to obtain an anomaly deviation score sequence, and perform an over-limit comparison between the anomaly deviation score sequence and an adaptive anomaly judgment threshold to obtain an anomaly event localization index. The risk warning module 30 is used to concatenate the feature vector corresponding to the abnormal event location index with the corresponding vector in the fused hidden state sequence to obtain classification input features, input the classification input features into a hierarchical classification head network to obtain threat category labels and confidence scores, assign values ​​to the threat category labels according to mapping rules to obtain threat level identifiers, query the response strategy decision table with the threat level identifiers and the confidence scores to obtain protection measure codes, and execute protection actions on the corresponding communication interface of the vehicle terminal according to the hierarchical response rules.

[0119] As described above, the intelligent detection and protection device for communication security threats to vehicle-mounted terminals provided in this application can achieve accurate analysis of communications through protocol parsing and feature extraction. A detection mechanism is constructed, combining feature encoding and anomaly scoring to establish a reliable threat identification strategy. Protection optimization is introduced, ensuring continuous security through graded classification and hierarchical response. This method effectively addresses the shortcomings of traditional technologies in feature extraction, threat identification, and protection response, providing technical assurance for vehicle-mounted communication security.

[0120] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the intelligent detection and protection method for communication security threats to vehicle-mounted terminals.

[0121] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described intelligent detection and protection method for communication security threats to vehicle-mounted terminals.

[0122] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described intelligent detection and protection method for communication security threats to vehicle-mounted terminals.

[0123] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0124] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0125] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0126] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0127] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for intelligent detection and protection against communication security threats to vehicle-mounted terminals, characterized in that, The method includes: Data frame capture hook functions are registered for the various communication interfaces of the vehicle terminal to obtain the original data frame stream of the multiple interfaces. The protocol parser is called according to the interface type of the original data frame stream of the multiple interfaces to obtain the structured communication event sequence. Protocol field features, timing features and statistical features are extracted from the structured communication event sequence and normalization is performed to obtain the communication event feature vector sequence. The communication event feature vector sequence is input into a dilated causal convolutional encoder to obtain an encoded feature sequence. The encoded feature sequence is input into a bidirectional gated recurrent unit layer to obtain a fused hidden state sequence. The fused hidden state sequence is input into an anomaly scoring head to obtain an anomaly deviation score sequence. An out-of-limit comparison is performed between the anomaly deviation score sequence and an adaptive anomaly judgment threshold to obtain an anomaly event location index. The process involves concatenating the feature vector corresponding to the abnormal event location index with the corresponding vector in the fused hidden state sequence to obtain classification input features. These classification input features are then input into a hierarchical classification head network to obtain threat category labels and confidence scores. This includes: extracting the corresponding position feature vector and its neighboring feature vectors from the communication event feature vector sequence to obtain abnormal event context features; concatenating the abnormal event context features with the corresponding position vector in the fused hidden state sequence to obtain classification input features; inputting the classification input features into a first-level classification head to perform threat category classification to obtain a threat category probability distribution; selecting a corresponding second-level fine-grained classification sub-network based on the threat category probability distribution to perform fine-grained category classification to obtain a fine-grained category probability distribution; determining the category combination with the highest probability in the threat category probability distribution and the fine-grained category probability distribution as the threat category label; and weighting the highest probability values ​​in the threat category probability distribution and the fine-grained category probability distribution to calculate the confidence score. The threat category label is assigned a value according to the mapping rule to obtain a threat level identifier. The threat level identifier and the confidence score are used to query the response strategy decision table to obtain the protection measure code. The protection measure code is then used to perform protection actions on the corresponding communication interface of the vehicle terminal according to the graded response rule.

2. The intelligent detection and protection method for communication security threats to vehicle-mounted terminals according to claim 1, characterized in that, The process involves registering data frame capture hook functions for each of the various communication interfaces of the vehicle terminal to obtain a multi-interface raw data frame stream. Then, the process calls a protocol parser on the multi-interface raw data frame stream according to the interface type to obtain a structured communication event sequence, including: Register data frame callback functions in the corresponding protocol stack layers for the vehicle diagnostic interface, vehicle-to-vehicle communication interface, and cellular network interface of the vehicle terminal. Add timestamps and interface type identifiers to the original data frames captured by each interface and write them into an unlocked circular buffer to obtain a multi-interface original data frame stream. The original data frame streams from the multiple interfaces are distributed to the corresponding protocol parsers according to the interface type identifier. The message identifier and service identifier are parsed for the vehicle diagnostic interface data frames, the certificate status check and message payload are parsed for the vehicle-to-vehicle communication interface data frames, and the application protocol identification and port mapping are performed for the cellular network interface data frames. The parsing results are encapsulated according to a unified event structure to obtain a structured communication event sequence.

3. The intelligent detection and protection method for communication security threats to vehicle-mounted terminals according to claim 1, characterized in that, The step of extracting protocol field features, temporal features, and statistical features from the structured communication event sequence and performing normalization processing to obtain a communication event feature vector sequence includes: For each communication event in the structured communication event sequence, extract the message identifier code, service identifier code, and data field length as protocol field features, extract the time interval between adjacent messages of the same type as time sequence features, and extract the frequency of messages of the same type and the rate of change of data field within the sliding window as statistical features. Concatenate the protocol field features, the time sequence features, and the statistical features to obtain the original feature vector. The original feature vector is zero-padded dimension alignment is performed according to the interface type, and the interface type encoding is added to the header to obtain the aligned feature vector. The numerical features in the aligned feature vector are normalized according to the mean and standard deviation of offline statistics to obtain the communication event feature vector sequence.

4. The intelligent detection and protection method for communication security threats to vehicle-mounted terminals according to claim 1, characterized in that, The process of inputting the communication event feature vector sequence into a dilated causal convolutional encoder to obtain an encoded feature sequence, and then inputting the encoded feature sequence into a bidirectional gated recurrent unit layer to obtain a fused hidden state sequence includes: The feature vector sequence of the communication event is input into a multi-layer dilated causal convolutional block. The dilation factor of each layer increases exponentially. Within each convolutional block, depthwise separable convolution and batch normalization and activation function calculation are performed sequentially, and the encoded feature sequence is output through residual connection. The encoded feature sequence is input into a bidirectional gated recurrent unit layer. The gated recurrent unit adopts a low-rank decomposition of the parameter matrix and performs recurrent processing along the forward and backward directions to obtain a forward hidden state sequence and a backward hidden state sequence, respectively. The forward hidden state sequence and the backward hidden state sequence are spliced ​​and fused to obtain a fused hidden state sequence.

5. The intelligent detection and protection method for communication security threats to vehicle-mounted terminals according to claim 1, characterized in that, The process of inputting an anomaly scoring head into the fused hidden state sequence to obtain an anomaly deviation score sequence, and performing an out-of-limit comparison between the anomaly deviation score sequence and the adaptive anomaly determination threshold to obtain an anomaly event localization index includes: The fused hidden state sequence is input into a two-layer fully connected network and the output activation layer normalizes the values ​​to the interval between zero and one to obtain an abnormal deviation score sequence. The moving mean and moving variance of the abnormal deviation score sequence are calculated for the windows that are judged to be normal to obtain the normal behavior baseline statistics. An adaptive anomaly determination threshold is obtained by adaptively updating the normal behavior baseline statistics according to a preset adjustment step size. An over-limit comparison is performed between each score in the anomaly deviation score sequence and the adaptive anomaly determination threshold. The time sequence position corresponding to the score exceeding the adaptive anomaly determination threshold is recorded to obtain the anomaly event location index.

6. The intelligent detection and protection method for communication security threats to vehicle-mounted terminals according to claim 1, characterized in that, The process involves assigning values ​​to the threat category labels according to mapping rules to obtain a threat level identifier, querying the response strategy decision table using the threat level identifier and the confidence score to obtain a protection measure code, and performing protection actions on the corresponding communication interface of the vehicle terminal according to the protection measure code and hierarchical response rules, including: The threat category label is assigned a degree of harm according to a preset threat level mapping rule to obtain a threat level identifier. The response strategy decision table is then queried using the threat level identifier as a row index and the confidence score interval as a column index to obtain the protection measure code. The protection measures are parsed according to the hierarchical response rules. The alarm-level code is used to report the threat detection results. The rate-limiting code is used to limit the traffic rate of the communication interface that is abnormal. The blocking code is used to disconnect the specific communication connection that is abnormal. The isolation code is used to disable the communication interface that is abnormal and restore the interface function after a configurable isolation period.

7. A smart detection and protection device for communication security threats to vehicle-mounted terminals, characterized in that, The device includes: The data acquisition module is used to register data frame capture hook functions for various communication interfaces of the vehicle terminal to obtain raw data frame streams of multiple interfaces, call the protocol parser according to the interface type to obtain a structured communication event sequence, extract protocol field features, timing features and statistical features from the structured communication event sequence and perform normalization processing to obtain a communication event feature vector sequence. An anomaly localization module is used to input the communication event feature vector sequence into a dilated causal convolutional encoder to obtain an encoded feature sequence, input the encoded feature sequence into a bidirectional gated recurrent unit layer to obtain a fused hidden state sequence, input the fused hidden state sequence into an anomaly scoring head to obtain an anomaly deviation score sequence, and perform an over-limit comparison between the anomaly deviation score sequence and an adaptive anomaly judgment threshold to obtain an anomaly event localization index. The risk warning module is used to concatenate the feature vector corresponding to the abnormal event location index with the corresponding vector in the fused hidden state sequence to obtain classification input features. The classification input features are then input into a hierarchical classification head network to obtain threat category labels and confidence scores. This includes: extracting the corresponding position feature vector and its preceding and following neighbor feature vectors from the communication event feature vector sequence to obtain abnormal event context features for the abnormal event location index; concatenating the abnormal event context features with the corresponding position vector in the fused hidden state sequence to obtain classification input features; and inputting the classification input features into a first-level classification head to perform threat category classification to obtain a threat category probability distribution. The probability distribution of the major threat categories is used to select the corresponding second-level fine-grained classification subnetwork to perform fine-grained category classification and obtain a fine-grained category probability distribution. The category combination corresponding to the highest probability in the probability distribution of the major threat categories and the probability distribution of the fine-grained categories is determined as the threat category label. The confidence score is obtained by weighting the highest probability values ​​of the probability distribution of the major threat categories and the probability distribution of the fine-grained categories. The threat category label is assigned a value according to the mapping rule to obtain the threat level identifier. The threat level identifier and the confidence score are used to query the response strategy decision table to obtain the protection measure code. The protection measure code is used to perform protection actions on the corresponding communication interface of the vehicle terminal according to the hierarchical response rule.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the intelligent detection and protection method for communication security threats to vehicle-mounted terminals as described in any one of claims 1 to 6.

Images