A heterogeneous log and standard rule knowledge base construction method and system for vehicle networking security and a storage medium

Abstract

This invention provides a method, system, and storage medium for constructing a heterogeneous log and standard rule knowledge base for vehicle network security. The method includes: Step 1: Identifying the data source format, including semi-structured vehicle network operational data and unstructured vehicle network compliance data; Step 2: Employing a dual-channel knowledge base construction pipeline to process both semi-structured and unstructured vehicle network data, standardizing discrete log features and extracting standard graph paths in a constrained manner, and constructing a data foundation with a dual-modal separation and logical alignment between a bottom-level vector fact base and an upper-level graph rule base. The beneficial effects are: by constructing a dual-path fusion architecture of a log semantic enhancement pipeline and a standard rule knowledge base, logical alignment of heterogeneous knowledge is achieved at the retrieval level, solving the problems of log semantic sparsity and standard logical discontinuity in existing technologies, enabling security audits to more accurately compare on-site violations with static compliance standards.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, and in particular to a method, system, and storage medium for constructing a heterogeneous log and standard rule knowledge base for vehicle network security. Background Technology

[0002] With the development of intelligent connected vehicle technology, vehicles, as mobile information terminals, generate massive amounts of multi-source and highly heterogeneous operational data. In the context of connected vehicle security operation centers, building a high-quality security knowledge base is a crucial step in achieving enhanced retrieval generation based on large language models and automated threat assessment. However, data sources in the connected vehicle environment exhibit polarized heterogeneity: on the one hand, vehicles and the cloud generate semi-structured or structured log data, carrying massive amounts of dynamic facts; on the other hand, highly abstract, unstructured security standards and compliance documents carry complex static security rules. How to effectively process these two types of data and uniformly construct a high-quality data foundation is a current technical challenge.

[0003] In processing unstructured or semi-structured vehicle network logs, existing technologies typically perform key-value pair splitting on log fields and store them in a vector database using basic text encoding. However, vehicle network logs contain a large number of numerical hard features, and directly extracted log vectors generally suffer from low numerical sensitivity and sparse semantic information. For example, vector models are prone to confusing interfering logs with similar structures but different key values, resulting in the inability to effectively recall genuine clues in precise security event retrieval tasks.

[0004] Among existing vehicle network security detection technologies, patent CN121690826A proposes a deep learning-based solution. This solution acquires CAN bus data, in-vehicle entertainment system data, vehicle network data, and vehicle status data, filters and fuses these multi-source data to generate multi-dimensional feature vector data. Subsequently, a multi-source fusion dataset is generated based on the labeled warning levels, and a pre-set neural network is trained using this dataset to ultimately generate an automotive electronic intrusion detection model. This model outputs warning levels to determine whether an intrusion has occurred on the vehicle.

[0005] On the other hand, vehicle-to-everything (V2X) security standard documents have a rigorous hierarchical structure and strong logical constraints across paragraphs. Existing large-scale model retrieval enhancement systems generally employ a fixed-length mechanical block strategy when building the knowledge base. This approach may sever the contextual relationships between standard clauses, disrupting their inherent logical constraint network and making it difficult for large models to perform effective multi-hop compliance reasoning based on the clauses. In research on large-scale model retrieval enhancement in general domains, the open-source Agentic hybrid RAG framework proposed by Nagori et al. lacks a unified processing pipeline for heterogeneous industry data during the knowledge base construction phase. Its method of directly extracting graphs does not provide a specific ontology definition for the V2X domain, failing to effectively address the logical topological discontinuities and high noise issues in the graph extraction process of standard documents; furthermore, this method does not effectively isolate and align the features of "log facts" and "standard rules" at the underlying data structure level.

[0006] In summary, existing data processing and database construction technologies have limitations in addressing the complex and heterogeneous scenarios of connected vehicle security auditing. On one hand, the data processing methods described in the aforementioned patents directly extract logs into purely numerical multi-dimensional feature vectors, lacking a semantic conversion process to natural language context. This approach leads to semantic sparsity in the data base when searching large models, and the vector model is easily confused with interfering logs that have similar structures but different key discrete values. On the other hand, the general knowledge base construction frameworks described in the aforementioned literature, when processing connected vehicle security standard documents, may sever the strong logical constraint network across paragraphs between standard clauses due to their conventional mechanical text segmentation strategy. Furthermore, due to the lack of a dedicated ontology definition for the connected vehicle vertical domain, it is difficult to effectively isolate and semantically align "dynamic log facts" and "static abstract rules" at the underlying data structure level. Therefore, there is an urgent need to construct a heterogeneous log and standard rule knowledge base construction method for connected vehicle security to solve the problems of log semantic sparsity and standard logical discontinuity.

[0007] The information disclosed in this background section is intended only to enhance understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0008] To address the problems in existing technologies, this invention provides a method for constructing a heterogeneous log and standard rule knowledge base for vehicle network security, including: Step 1: Identify the data source format. The data includes semi-structured operational data of the Internet of Vehicles (IoV) and unstructured compliant data of the IoV. Step 2: A dual-channel knowledge base pipeline is constructed to process semi-structured operational data and unstructured compliant data of the Internet of Vehicles (IoV) separately. Specifically, the semi-structured operational data of the IoV is processed through a semi-structured log processing channel to build a bottom-level vector fact base, while the unstructured compliant data of the IoV is processed through an unstructured standard processing channel to build an upper-level graph rule base. Ultimately, a dual-modal, separated, and logically aligned data foundation is formed, consisting of the bottom-level vector fact base and the upper-level graph rule base.

[0009] As a further improvement of the present invention, the semi-structured operation data of the vehicle network includes vehicle network traffic logs, gateway communication logs, and CAN bus messages, and the unstructured compliance data of the vehicle network includes national security standards, Auto-ISAC threat matrix, and vulnerability intelligence reports.

[0010] As a further improvement of the present invention, in step 2, a semi-structured log processing channel is used to construct the underlying vector fact base, specifically including: Step s1: Log field parsing and key metadata filtering; Step s2: Serialize the data using a semantic serialization operator based on template mapping; Step s3: Dynamically adjust the text structure based on the original structural features of the data; Step s4: Simultaneously establish structured auxiliary filtering conditions during the text vectorization process.

[0011] As a further improvement of the present invention, step s2 specifically includes: Define the original semi-structured log of the vehicle network as a set of key-value pairs. in For feature fields, For the corresponding values, i =1… n The system calls a predefined set of semantic mapping templates. Its serialization conversion function The definition is as follows: In the formula, This represents the sequence of natural language statements output. Indicates text concatenation. For feature mapping function, This indicates the matched semantic template for a specific protocol, which will then be... Input Embedding Model Obtain high-dimensional dense vectors , This is a text embedding function.

[0012] As a further improvement of the present invention, step s3 includes: Step s30: The system first identifies the table labels or row and column structure and converts them into Markdown table format; if the table is too long and exceeds the model's processing limit, the system will split it according to the data rows; Step s31: For descriptive text, the system introduces an NLP parser to identify sentence boundaries and group and segment the text into complete semantic units.

[0013] As a further improvement of the present invention, step s4 includes: Step s40: The semantically complete text block output in step s3 is transformed into a high-dimensional dense vector through a text embedding model and stored in the underlying vector database; Step s41: While storing the vector, the key structured fields corresponding to the log are extracted and stored as scalar metadata bound to the vector; on this basis, a scalar metadata filtering index is established simultaneously.

[0014] As a further improvement of the present invention, in step 2, an upper-level graph rule base is constructed using an unstructured standard processing channel, specifically including: Step y1, define the graph based on vehicle network security: predefine the knowledge graph skeleton in the field of vehicle network security, specify the types of points and edges contained in the graph, and establish strong constraints for the extraction of large models in the future. Points are used to divide vehicle network security concepts, and edges are used to specify the logical relationships between entities. Step y2, constraint graph extraction based on the large model: using the natural language understanding capabilities of the large language model, the high-level unstructured standard text and threat matrix are transformed into structured triples, and the structural constraints defined in step y1 must be enforced during the transformation. Step y3, storage of bimodal graph: A graph network is defined as a directed graph. , where the node set Representative entities, edge sets Representational relationship; for any node Its bimodal feature representation It is a fusion of topological and semantic features: In the formula, For text embedding functions, and These are entity name and natural language description, respectively. Indicates text concatenation. This represents vector concatenation. For nodes Row vectors in the graph adjacency matrix This is the topological weight matrix.

[0015] As a further improvement of the present invention, step y2 further includes: Constraint prompt word design: The text slices of the standard document are used as input, and the entity types and relationship types predefined in step y1 are written into the prompt words of the large model as hard constraint rules; Few-shot normalized output: With the help of few-shot prompting technology, the large model is prompted to strictly output JSON arrays in the standard triple format of <head entity, relation, tail entity>, under the premise of understanding the context of vehicle network safety standards. This avoids the large model arbitrarily inventing non-compliant relation types or generating logical illusions.

[0016] The present invention also discloses a system for constructing a heterogeneous log and standard rule knowledge base for vehicle network security, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when invoked by the processor.

[0017] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0018] The beneficial effects of this invention are: 1. This invention helps to bridge the logical connection between "operational facts" and "compliance rules," improving the interpretability of audit reports. Specifically, by constructing a dual-path fusion architecture of a log semantic enhancement pipeline and a standard rule knowledge base, logical alignment of heterogeneous knowledge is achieved at the retrieval level, thereby solving the problems of log semantic sparsity and standard logical discontinuity in existing technologies, enabling security audits to more accurately compare on-site violations with static compliance standards; 2. This invention simultaneously establishes a scalar metadata filtering index, enabling better recall effects for hard features such as IP addresses during subsequent retrievals. Attached Figure Description

[0019] Figure 1 This is the overall flowchart of the method of the present invention. Detailed Implementation

[0020] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0021] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0022] This invention specifically relates to the fields of intelligent connected vehicle data processing, large language model knowledge engineering, and multimodal database construction.

[0023] To address the heterogeneity between low-level operational data (such as vehicle traffic logs and messages) and high-level regulatory data (such as security standard documents and threat intelligence) in vehicle-to-everything (V2X) auditing scenarios, existing single-database construction methods struggle to simultaneously resolve the semantic sparsity of logs and the logical discontinuity of standards. Therefore, this invention proposes a method for constructing a heterogeneous log and standard rule knowledge base for V2X security.

[0024] This invention designs a dual-channel knowledge base construction pipeline to process semi-structured and unstructured data respectively, normalizes discrete log features and constrains the extraction of standard graph paths, and finally constructs a data foundation with dual-modal separation and logical alignment between the bottom-level "vector fact base" and the upper-level "graph rule base".

[0025] This invention mainly includes: overall system architecture and data source access; semantic serialization of semi-structured logs and construction of a vector fact base; ontology constraint extraction and graph rule base construction of unstructured standard documents.

[0026] The implementation process of the heterogeneous log and standard rule knowledge base construction method and system for vehicle network security proposed in this invention is as follows: Figure 1 As shown. Next, the implementation process of the present invention will be described in detail.

[0027] Step 1: Data source access; The system first identifies the format of the accessed data source, which includes semi-structured operation data of the Internet of Vehicles and unstructured compliant data of the Internet of Vehicles. Step 2: To address the heterogeneous nature of data sources in the vehicle network auditing scenario, this invention designs a dual-channel parallel processing pipeline, including a semi-structured log processing channel and an unstructured standard processing channel. The semi-structured log processing channel processes the semi-structured operational data of the vehicle network to build a bottom-level vector fact base, while the unstructured standard processing channel processes the unstructured compliant data of the vehicle network to build an upper-level graph rule base. Ultimately, a dual-modal, separated, and logically aligned data foundation is formed, consisting of the bottom-level vector fact base and the upper-level graph rule base.

[0028] The semi-structured log processing channel (channel one) receives the underlying physical operation data of the vehicle network, i.e., the semi-structured operation data of the vehicle network, including but not limited to vehicle network traffic logs, gateway communication logs, and CAN bus messages; the unstructured standard processing channel (channel two) receives the high-level compliance rule data, i.e., the unstructured compliance data of the vehicle network, including but not limited to national security standards (such as GB / T series), Auto-ISAC threat matrix, and vulnerability intelligence reports.

[0029] Semantic serialization of semi-structured logs and construction of vector fact base To address the issues of sparse semantics in raw JSON format logs, low weighting of specific numerical features (such as IP addresses, fault codes, and CAN IDs) in traditional vector spaces, and their susceptibility to confusion, a log semantic enhancement pipeline was designed for the semi-structured log processing channel. This pipeline includes the following sub-processes: Step s1: Log field parsing and key metadata filtering; Step s2: Semantic serialization operator based on template mapping; because purely semi-structured log formats, such as JSON, contain a large number of repetitive structured syntax symbols, it is easy to lead to excessively high pseudo-similarity, resulting in inaccurate retrieval. Therefore, this invention uses the system's built-in sentence template to convert key-value pairs into natural language sentences, increasing the key-value differentiation while enhancing the semantic binding of the context.

[0030] Define the original semi-structured log of the vehicle network as a set of key-value pairs. in For feature fields, For the corresponding numerical value. The system calls a predefined semantic mapping template set. Its serialization conversion function The definition is as follows: In the formula, For text embedding functions, This represents the sequence of natural language statements output. Indicates text concatenation. For feature mapping function, This indicates the matched semantic template for a specific protocol. Subsequently, Input Embedding Model Obtain high-dimensional dense vectors .

[0031] Step s3, Structure-aware adaptive logical segmentation: Dynamically adjust the text structure based on the original structural features of the data; Step s30: The system first identifies the table labels or row and column structure and converts it into a Markdown table format. If the table is too long and exceeds the model's processing limit, the system will split it according to "data rows" to ensure that the column attributes of the data are not destroyed (for example, to prevent IP addresses or ports from being split).

[0032] Step s31: For descriptive text, the system introduces an NLP parser to identify sentence boundaries such as periods, and packages and segments the text into complete semantic units to avoid the problem of a sentence being forcibly truncated in the middle.

[0033] Step s4, Vectorization and Fact Layer Index Construction: This involves simultaneously establishing structured auxiliary filtering conditions during the text vectorization process.

[0034] Step s40: The semantically complete text block output in step s3 is transformed into a high-dimensional dense vector through a text embedding model and stored in the underlying vector database.

[0035] Step s41: While storing the vector, extract the key structured fields corresponding to the log entry and bind them to the vector as scalar metadata. Based on this, simultaneously build a scalar metadata filtering index to improve retrieval performance for hard features such as IP addresses during subsequent searches.

[0036] Ontology constraint extraction and graph rule base construction of unstructured standard documents To address the issue that complex logic and strong cross-paragraph constraints in security standard documents can lead to logical gaps in large models due to conventional block division, a graph-based standard rule extraction pipeline was designed for the unstructured standard processing channel. Step y1: Define the graph based on vehicle-to-everything (V2X) security; The core of this step is to predefine the knowledge graph skeleton in the field of vehicle network security, and specify which types of "points" and "edges" can be included in the graph, thereby establishing strong constraints for the subsequent extraction of large models.

[0037] Define entity types (points): Divide vehicle network security concepts, such as including: "compliance requirements / safety standard clauses", etc.

[0038] Define relation type (edge): specifies the logical association between entities.

[0039] Step y2: Extract constraint graphs based on the large model; The core of this step is to leverage the natural language understanding capabilities of large language models to transform high-level unstructured standard text, threat matrices, etc., into structured triples, which must be subject to the structural constraints defined in step y1: Constraint prompt word design: Take the text slices of the standard document as input, and write the entity types and relationship types predefined in step y1 as "hard constraint rules" into the prompt words of the large model.

[0040] Few-shot normalized output: Combined with few-shot hint technology (providing several standard extraction examples), it prompts large models to strictly follow the standard triple format of <head entity, relation, tail entity> to output JSON arrays, under the premise of understanding the context of vehicle network safety standards. This avoids large models arbitrarily inventing non-compliant relation types or generating logical illusions.

[0041] Step y3: Storage of bimodal graphs.

[0042] During the graph storage phase, a graph network is defined as a directed graph. , where the node set Representative entities, edge sets Representational relationship. For any node Its bimodal feature representation It is a fusion of topological and semantic features: In the formula, For text embedding functions, and These are entity name and natural language description, respectively. Indicates text concatenation. This represents vector concatenation. For nodes Row vectors in the graph adjacency matrix This is the topological weight matrix.

[0043] The present invention also discloses a system for constructing a heterogeneous log and standard rule knowledge base for vehicle network security, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when invoked by the processor.

[0044] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0045] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for constructing a heterogeneous log and standard rule knowledge base for vehicle network security, characterized in that, include: Step 1: Identify the data source format. The data includes semi-structured operational data of the Internet of Vehicles (IoV) and unstructured compliant data of the IoV. Step 2: A dual-channel knowledge base pipeline is constructed to process semi-structured operational data and unstructured compliant data of the Internet of Vehicles (IoV) separately. Specifically, the semi-structured operational data is processed through a semi-structured log processing channel to build a bottom-level vector fact base, while the unstructured compliant data is processed through an unstructured standard processing channel to build an upper-level graph rule base. Ultimately, a dual-modal, separated, and logically aligned data foundation is formed, consisting of the bottom-level vector fact base and the upper-level graph rule base. In step 2, a semi-structured log processing channel is used to construct the underlying vector fact base, specifically including: Step s1: Log field parsing and key metadata filtering; Step s2: Serialize the data using a semantic serialization operator based on template mapping; Step s3: Dynamically adjust the text structure based on the original structural features of the data; Step s4: Simultaneously establish structured auxiliary filtering conditions during the text vectorization process; In step 2, an upper-level graph rule base is constructed using unstructured standard processing channels, specifically including: Step y1, define the graph based on vehicle network security: predefine the knowledge graph skeleton in the field of vehicle network security, specify the types of points and edges contained in the graph, and establish strong constraints for the extraction of large models in the future. Points are used to divide vehicle network security concepts, and edges are used to specify the logical relationships between entities. Step y2, constraint graph extraction based on the large model: using the natural language understanding capabilities of the large language model, the high-level unstructured standard text and threat matrix are transformed into structured triples, and the structural constraints defined in step y1 must be enforced during the transformation. Step y3, storage of bimodal graph: A graph network is defined as a directed graph. , where the node set Representative entities, edge sets Representational relationship; for any node Its bimodal feature representation It is a fusion of topological and semantic features: In the formula, For text embedding functions, and These are entity name and natural language description, respectively. Indicates text concatenation. This represents vector concatenation. For nodes Row vectors in the graph adjacency matrix This is the topological weight matrix.

2. The method for constructing a heterogeneous log and standard rule knowledge base according to claim 1, characterized in that, The semi-structured operation data of the vehicle network includes vehicle network traffic logs, gateway communication logs, and CAN bus messages, while the unstructured compliance data of the vehicle network includes national security standards, the Auto-ISAC threat matrix, and vulnerability intelligence reports.

3. The method for constructing a heterogeneous log and standard rule knowledge base according to claim 1, characterized in that, Step s2 specifically involves: Define the original semi-structured log of the vehicle network as a set of key-value pairs. in For feature fields, For the corresponding values, i =1… n The system calls a predefined set of semantic mapping templates. Its serialization conversion function The definition is as follows: In the formula, This represents the sequence of natural language statements output. Indicates text concatenation. For feature mapping function, This indicates the matched semantic template for a specific protocol, which will then be... Input Embedding Model Obtain high-dimensional dense vectors , This is a text embedding function.

4. The method for constructing a heterogeneous log and standard rule knowledge base according to claim 1, characterized in that, Step s3 includes: Step s30: The system first identifies the table labels or row and column structure and converts them into Markdown table format; if the table is too long and exceeds the model's processing limit, the system will split it according to the data rows; Step s31: For descriptive text, the system introduces an NLP parser to identify sentence boundaries and group and segment the text into complete semantic units.

5. The method for constructing a heterogeneous log and standard rule knowledge base according to claim 1, characterized in that, Step s4 includes: Step s40: The semantically complete text block output in step s3 is transformed into a high-dimensional dense vector through a text embedding model and stored in the underlying vector database; Step s41: While storing the vector, extract the key structured fields corresponding to the logs and bind them to the vector as scalar metadata; on this basis, simultaneously build a scalar metadata filtering index.

6. The method for constructing a heterogeneous log and standard rule knowledge base according to claim 1, characterized in that, Step y2 further includes: Constraint prompt word design: The text slices of the standard document are used as input, and the entity types and relationship types predefined in step y1 are written into the prompt words of the large model as hard constraint rules; Few-shot normalized output: With the help of few-shot prompting technology, the large model is prompted to strictly output JSON arrays in the standard triple format of <head entity, relation, tail entity>, under the premise of understanding the context of vehicle network safety standards. This avoids the large model arbitrarily inventing non-compliant relation types or generating logical illusions.

7. A system for constructing a heterogeneous log and standard rule knowledge base for vehicle network security, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method of any one of claims 1-6 when invoked by the processor.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-6 when invoked by a processor.

Images