Vehicle network intrusion detection and prevention systems, methods, devices, equipment and media

Abstract

This invention relates to the field of vehicle technology and discloses a vehicle network intrusion detection and prevention system, method, apparatus, device, and medium. The vehicle network intrusion detection and prevention system includes at least a cloud subsystem and a vehicle subsystem; the cloud subsystem includes at least a cloud analysis platform and a cloud platform gateway; the vehicle subsystem includes at least a vehicle-side main controller, a vehicle-side CAN subnet controller, a vehicle-side operating system USB controller, a vehicle-side operating system Ethernet controller, and a vehicle-side operating system domain controller. The vehicle network intrusion detection and prevention system provided by this invention has low controller overhead and low overall development cost. Applying it to network intrusion monitoring and prevention in commercial vehicles can at least improve vehicle operation safety during the operational phase of commercial vehicles and help ensure the quality of information security development for commercial vehicles.

Description

Technical Field

[0001] This invention relates to the field of vehicle technology, and in particular to a vehicle network intrusion monitoring and defense system, method, device, equipment and medium. Background Technology

[0002] As commercial vehicles are increasingly becoming intelligent and connected, promoting network intrusion monitoring and defense has become a core necessity for ensuring industry security, social stability, and enterprise development. From the perspectives of security, compliance, economy, and industry development, it is imperative for commercial vehicles to conduct network intrusion monitoring.

[0003] From a security perspective, the unique characteristics of commercial vehicles dictate that their cybersecurity is far more critical than that of passenger vehicles. Today's intelligent commercial vehicles are equipped with systems such as vehicle networking, remote diagnostics, and OTA upgrades, and are also connected to fleet management platforms. This significantly broadens the attack surface, making everything from the in-vehicle CAN bus and OBD interface to external wireless communication links potential entry points for hackers. Once an intrusion occurs, not only will vehicle location and driving data be stolen, but extreme situations such as hijacking of vehicle control and failure of braking and steering systems may also occur, directly threatening the driver's life. Furthermore, commercial vehicles bear the heavy responsibility of logistics transportation. If cold chain or hazardous materials transport vehicles are attacked, it could lead to cargo damage, hazardous material leaks, and other public safety accidents, causing incalculable social harm.

[0004] From a compliance perspective, global cybersecurity regulations have imposed mandatory requirements on commercial vehicles, making cybersecurity defense systems a "threshold" for businesses. China has issued standards such as GB44495, explicitly stipulating that commercial vehicles must possess cybersecurity protection capabilities. The EU has also implemented R155 and R156 regulations, incorporating in-vehicle cybersecurity and data security into vehicle type certification. If companies fail to establish effective intrusion prevention systems, they will not only be unable to enter mainstream domestic and international markets but may also face hefty fines for data breaches and security vulnerabilities. Compliance pressures are forcing companies to integrate cybersecurity into their entire R&D and production processes.

[0005] From an economic perspective, cyber intrusion prevention is crucial for reducing corporate losses and ensuring supply chain stability. Commercial vehicles are the core carriers of the logistics supply chain; a large-scale cyberattack on a fleet can directly lead to transportation disruptions. For time-sensitive goods such as fresh produce and pharmaceuticals, a shutdown of just a few hours can result in the complete loss of goods. In the event of a ransomware attack, companies may have to pay exorbitant ransoms, and some small and medium-sized logistics companies may even go bankrupt. Furthermore, if a cybersecurity breach causes a security incident, automakers will face a chain reaction of losses, including a collapse in brand reputation and customer loss. A robust defense system can significantly reduce such economic risks.

[0006] From an industry development perspective, network intrusion prevention is a necessary support for the intelligent transformation of commercial vehicles. With the implementation of technologies such as autonomous driving and intelligent fleet management, commercial vehicles are increasingly reliant on networks, and network security is a prerequisite for the implementation of these technologies. Only by building a strong defense barrier can we dispel users' security concerns about intelligent commercial vehicles, promote the large-scale application of new technologies, and simultaneously foster the formation of security standards and technical systems within the industry, thereby achieving the healthy and sustainable development of the commercial vehicle industry.

[0007] In view of this, under the background of the intelligent and connected transformation of commercial vehicles, network intrusion monitoring and defense systems have become a core necessity to ensure the safety of drivers and passengers and the public, meet domestic and international compliance requirements, reduce corporate economic losses, and support the intelligent and healthy development of the industry. Their importance and necessity are self-evident. Summary of the Invention

[0008] The purpose of this invention is to provide a vehicle network intrusion monitoring and defense system, method, device, equipment and medium, which can at least be applied to the monitoring of in-vehicle network attack behavior in commercial vehicles when the computing power and space of the in-vehicle controller are insufficient, which is conducive to ensuring the quality of information security development of commercial vehicles.

[0009] To address the aforementioned technical problems, in a first aspect, the present invention provides a vehicle network intrusion detection and defense system, comprising at least a cloud subsystem and a vehicle subsystem; the cloud subsystem comprises at least a cloud analysis platform and a cloud platform gateway; the vehicle subsystem comprises at least a vehicle main controller, a vehicle CAN subnet controller, a vehicle operating system USB controller, a vehicle operating system Ethernet controller, and a vehicle operating system domain controller.

[0010] The cloud analytics platform establishes a connection with the cloud platform gateway using at least a hardware communication method; the cloud platform gateway connects to the first end of the vehicle-side main controller via at least a preset secure link; the second end of the vehicle-side main controller establishes a connection with the output end of the vehicle-side CAN subnet controller using at least a CAN communication method; the third end of the vehicle-side main controller establishes a connection with the vehicle-side operating system USB controller using at least a USB communication method; the fourth end of the vehicle-side main controller establishes a connection with the vehicle-side operating system Ethernet controller via at least an Ethernet connection; and the fifth end of the vehicle-side main controller establishes a connection with the output end of the vehicle-side operating system domain controller via at least an Ethernet connection; the input end of the vehicle-side CAN subnet controller is connected to at least one in-vehicle CAN gateway of the vehicle-side CAN subnet; and the input end of the vehicle-side operating system domain controller is connected to at least one on-board CAN gateway of the vehicle-side operating system domain control subnet.

[0011] Based on the same concept, in a second aspect, the present invention also provides a vehicle network intrusion detection and defense method, which is implemented based on the vehicle network intrusion detection and defense system described in the first aspect, and the vehicle network intrusion detection and defense method includes at least:

[0012] The vehicle-side CAN subnet controller monitors the abnormal behavior of at least one vehicle-side CAN subnet. When the abnormal behavior of any vehicle-side CAN subnet meets the preset judgment conditions, the vehicle-side CAN subnet controller generates network attack event information and reports it to the vehicle-side main controller in a first preset form.

[0013] Each subnet controller in the vehicle-side CAN subnet monitors subnet diagnostic attack behavior information, and uploads the subnet diagnostic attack behavior information and subnet controller code to the vehicle-side CAN subnet controller in the first preset form, and then the vehicle-side CAN subnet controller transmits the information to the vehicle-side main controller.

[0014] After the vehicle-side main controller converts the network attack event information, the subnet diagnostic attack behavior information, and the subnet controller code, which exist in the first preset form, into a second preset form, it adds at least the vehicle VIN information to form a first cloud upload file. Then, the first cloud upload file is uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0015] Optionally, it may also include at least:

[0016] The vehicle-side operating system USB controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format.

[0017] After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a second cloud upload file. The second cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

[0018] Optionally, it may also include at least:

[0019] The vehicle-side operating system Ethernet controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format.

[0020] After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a third cloud upload file. The third cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

[0021] Optionally, it may also include at least:

[0022] The vehicle-side operating system domain controller monitors the abnormal behavior of at least one of the vehicle-side operating system domain controller subnets. When the abnormal behavior of any of the vehicle-side operating system domain controller subnets meets the set judgment conditions, the vehicle-side operating system domain controller generates network attack event information and reports it to the vehicle-side main controller in a third preset form.

[0023] The subnet controller in each of the vehicle operating system domain control subnets monitors the subnet diagnostic attack information and uploads the subnet diagnostic attack information and the subnet controller code to the vehicle operating system domain controller in the first preset form, and then the vehicle operating system domain controller transmits it to the vehicle main controller in the third preset form.

[0024] After the vehicle-side main controller converts the network attack event information, the subnet diagnostic attack information, and the subnet controller code, which exist in the third preset form, into the second preset form, it adds at least the vehicle VIN information to form a fourth cloud upload file. Then, the fourth cloud upload file is uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0025] Based on the same concept, in a third aspect, the present invention also provides a vehicle network intrusion detection and defense device for performing the vehicle network intrusion detection and defense method described in any of the second aspects;

[0026] The vehicle network intrusion detection and defense device includes at least a vehicle-side CAN subnet monitoring module;

[0027] The vehicle-side CAN subnet monitoring module is used for at least:

[0028] The vehicle-side CAN subnet controller monitors the abnormal behavior of at least one vehicle-side CAN subnet. When the abnormal behavior of any vehicle-side CAN subnet meets the preset judgment conditions, the vehicle-side CAN subnet controller generates network attack event information and reports it to the vehicle-side main controller in a first preset form.

[0029] Each subnet controller in the vehicle-side CAN subnet monitors subnet diagnostic attack behavior information, and uploads the subnet diagnostic attack behavior information and subnet controller code to the vehicle-side CAN subnet controller in the first preset form, and then the vehicle-side CAN subnet controller transmits the information to the vehicle-side main controller.

[0030] After the vehicle-side main controller converts the network attack event information, the subnet diagnostic attack behavior information, and the subnet controller code, which exist in the first preset form, into a second preset form, it adds at least the vehicle VIN information to form a first cloud upload file. Then, the first cloud upload file is uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0031] Optionally, it may also include at least a first vehicle-side operating system monitoring module;

[0032] The first vehicle-side operating system monitoring module is used for at least:

[0033] The vehicle-side operating system USB controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format.

[0034] After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a second cloud upload file. The second cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

[0035] Optionally, it may also include at least a second vehicle-side operating system monitoring module;

[0036] The second vehicle-side operating system monitoring module is used for at least:

[0037] The vehicle-side operating system Ethernet controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format.

[0038] After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a third cloud upload file. The third cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

[0039] Based on the same concept, in a fourth aspect, the present invention also provides an electronic device including a memory and a processor, the memory storing a computer program executable on the processor, the processor executing the program to implement the steps of the vehicle network intrusion detection and defense method according to any one of the second aspects.

[0040] Based on the same concept, in a fifth aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the vehicle network intrusion detection and defense method according to any one of the second aspects.

[0041] The vehicle network intrusion detection and prevention system provided in this embodiment of the invention includes at least a cloud subsystem and a vehicle subsystem. The cloud subsystem includes at least a cloud analysis platform and a cloud platform gateway. The vehicle subsystem includes at least a vehicle main controller, a vehicle CAN subnet controller, a vehicle operating system USB controller, a vehicle operating system Ethernet controller, and a vehicle operating system domain controller. Specifically, the cloud analysis platform establishes a connection with the cloud platform gateway using at least a hardware communication method; the cloud platform gateway connects to the first end of the vehicle main controller via at least a preset security link; the second end of the vehicle main controller establishes a connection with the output end of the vehicle CAN subnet controller using at least a CAN communication method; the third end of the vehicle main controller establishes a connection with the vehicle operating system USB controller using at least a USB communication method; the fourth end of the vehicle main controller establishes a connection with the vehicle operating system Ethernet controller via at least an Ethernet connection; and the fifth end of the vehicle main controller establishes a connection with the output end of the vehicle operating system domain controller via at least an Ethernet connection. The input end of the vehicle CAN subnet controller is connected to at least one in-vehicle CAN gateway of the vehicle CAN subnet; and the input end of the vehicle operating system domain controller is connected to at least one on-board CAN gateway of the vehicle operating system domain controller subnet.

[0042] It is understandable that, due to the long lifespan of commercial vehicle controllers, many controllers cannot be configured with IDS network intrusion monitoring components due to limitations in computing power and storage space. Therefore, a low-overhead method is designed for network intrusion monitoring and defense. The vehicle network intrusion monitoring and defense system provided in this embodiment of the invention has low controller overhead and low overall development cost. Applying it to commercial vehicle network intrusion monitoring and defense can at least improve vehicle operation safety during the operation phase of commercial vehicles and help ensure the quality of commercial vehicle information security development. Attached Figure Description

[0043] Figure 1 This is a schematic diagram of the structure of a vehicle network intrusion detection and defense system provided in an embodiment of the present invention;

[0044] Figure 2 This is a detailed structural diagram of a vehicle network intrusion detection and defense system provided in an embodiment of the present invention;

[0045] Figure 3 This is a flowchart of a vehicle network intrusion detection and defense method provided in an embodiment of the present invention;

[0046] Figure 4 This is a schematic diagram of the structure of a vehicle network intrusion detection and defense device provided in an embodiment of the present invention;

[0047] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0049] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “said,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0050] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0051] It should be understood that although the terms first, second, third, etc., may be used in the embodiments of this application, these descriptions should not be limited to these terms. These terms are only used to distinguish the descriptions. For example, first may also be referred to as second without departing from the scope of the embodiments of this application, and similarly, second may also be referred to as first.

[0052] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0053] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0054] It should be noted that any symbols and / or numbers present in the specification that are not marked in the accompanying drawings are not reference numerals.

[0055] Figure 1 This is a schematic diagram of the structure of a vehicle network intrusion detection and prevention system provided in an embodiment of the present invention. Figure 2 This is a detailed structural diagram of a vehicle network intrusion detection and defense system provided in an embodiment of the present invention. This embodiment is applicable to at least any commercial vehicle network intrusion monitoring and defense design scenario. This vehicle network intrusion detection and defense system can be implemented using software and / or hardware. Figure 1 and Figure 2 As shown, the vehicle control device's vehicle network intrusion detection and defense system includes at least a cloud subsystem and a vehicle terminal subsystem.

[0056] Cloud subsystems (such as Figure 1 The "cloud" shown; Figure 2 (Not shown in the image) includes at least a cloud analytics platform (such as...) Figure 1 and Figure 2 "Platform 1" and cloud platform gateway (such as Figure 1 and Figure 2 Platform 2); the vehicle terminal system includes at least the vehicle terminal main controller (such as...). Figure 1 and Figure 2 The “ECU-A” in the text), the vehicle-side CAN subnet controller (such as Figure 1 and Figure 2 "ECU-B" in the text), vehicle-side operating system USB controller (such as Figure 1 and Figure 2 "ECU-C" in the text), vehicle-side operating system Ethernet controller (such as Figure 1 and Figure 2 "ECU-D" and vehicle-side operating system domain controller (such as Figure 1 and Figure 2 (The “ECU-E” in the text).

[0057] The cloud analytics platform establishes a connection with the cloud platform gateway using at least hardware communication; the cloud platform gateway connects to the first end of the vehicle-side main controller via at least a pre-defined secure link; the second end of the vehicle-side main controller establishes a connection with the output end of the vehicle-side CAN subnet controller using at least CAN communication; the third end of the vehicle-side main controller establishes a connection with the vehicle-side operating system USB controller using at least USB communication; the fourth end of the vehicle-side main controller establishes a connection with the vehicle-side operating system Ethernet controller via at least Ethernet; and the fifth end of the vehicle-side main controller establishes a connection with the output end of the vehicle-side operating system domain controller via at least Ethernet; the input end of the vehicle-side CAN subnet controller is connected to at least one vehicle-side CAN subnet (e.g., Figure 1 The in-vehicle CAN gateway (e.g., "subnet 1", "subnet 2", "subnet n") in the network. Figure 1 The "ECU1-1", "ECU1-n", "ECU2-1", "ECU2-n", "ECUn-1", and "ECUn-n" in the code are used; the input terminal of the vehicle operating system domain controller is connected to at least one vehicle operating system domain controller subnet (e.g., Figure 1 The vehicle-mounted CAN gateway (such as "subnet E") in the network (e.g.) Figure 1 (In "ECUE-1" and "ECUE-n").

[0058] Among them, the vehicle-side ECU-A can be a controller with cellular data communication capabilities. It is at least responsible for receiving network security attack data from other vehicle-side controllers, monitoring its own network attack behavior data, and uploading all this data to the cloud. ECU-B is connected to the in-vehicle CAN gateway of each CAN subnet in the vehicle. It is at least responsible for monitoring abnormal behavior of each subnet's load rate, key messages, signals, diagnostic information, etc. If abnormal behavior occurs, it reports the event to ECU-A in the form of a CAN message, and ECU-A adds system time information. ECU-C can be a controller connected to ECU-A via USB. It needs to monitor network security attacks on its own bus and operating system, and after an attack occurs, report the controller code where the attack occurred, the attack type, the event handling result, the time of the event, and other important descriptions. The data is reported to ECU-A in the form of a TCP data stream; ECU-D can be a controller connected to ECU-A via Ethernet. It needs to monitor network security attacks on its own bus and operating system, and after an attack occurs, report the controller code where the attack occurred, the attack type, the event handling result, the time of the event, and other important descriptions to ECU-A in the form of a TCP data stream; ECU-E can be a domain controller connected to ECU-A via Ethernet. It needs to monitor network security attacks on its own bus and operating system, as well as abnormal behaviors such as load rate of each subnet, key messages, signals, and diagnostic information, and after an attack occurs, report the controller code or subnet code where the attack occurred, the attack type, the event handling result, the time of the event, and other important descriptions to ECU-A in the form of a TCP data stream.

[0059] Furthermore, the cloud mainly consists of Platform 1 and Platform 2. Platform 1 is at least responsible for collecting and managing network security attack event data from the vehicle and providing a human-machine interface for staff to analyze. Platform 2 is the cloud platform gateway, which can communicate with ECU-A using secure links such as TLS (i.e., the aforementioned preset secure links), and after receiving network attack event data from inside the vehicle, it will pass it through to Platform 1. Platform 1 and Platform 2 are deployed in the same cloud environment and can use hardwired communication.

[0060] The vehicle network intrusion detection and prevention system provided in this embodiment includes at least a cloud subsystem and a vehicle subsystem. The cloud subsystem includes at least a cloud analysis platform and a cloud platform gateway. The vehicle subsystem includes at least a vehicle main controller, a vehicle CAN subnet controller, a vehicle operating system USB controller, a vehicle operating system Ethernet controller, and a vehicle operating system domain controller. Specifically, the cloud analysis platform establishes a connection with the cloud platform gateway using at least a hardware communication method; the cloud platform gateway connects to the first end of the vehicle main controller via at least a preset security link; the second end of the vehicle main controller establishes a connection with the output end of the vehicle CAN subnet controller using at least a CAN communication method; the third end of the vehicle main controller establishes a connection with the vehicle operating system USB controller using at least a USB communication method; the fourth end of the vehicle main controller establishes a connection with the vehicle operating system Ethernet controller via at least an Ethernet connection; and the fifth end of the vehicle main controller establishes a connection with the output end of the vehicle operating system domain controller via at least an Ethernet connection. The input end of the vehicle CAN subnet controller is connected to at least one in-vehicle CAN gateway of the vehicle CAN subnet; and the input end of the vehicle operating system domain controller is connected to at least one on-board CAN gateway of the vehicle operating system domain controller subnet.

[0061] It is understandable that, due to the long lifespan of commercial vehicle controllers, many controllers cannot be configured with IDS network intrusion monitoring components due to limitations in computing power and storage space. Therefore, a low-overhead method is designed for network intrusion monitoring and defense. The vehicle network intrusion monitoring and defense system provided in this embodiment has low controller overhead and low overall development cost. Applying it to commercial vehicle network intrusion monitoring and defense can at least improve vehicle operation safety during the operation phase of commercial vehicles and help ensure the quality of commercial vehicle information security development.

[0062] Figure 3 This is a flowchart of a vehicle network intrusion detection and defense method provided by an embodiment of the present invention. This embodiment is applicable to at least any vehicle network intrusion monitoring and defense design scenario in commercial vehicles. This vehicle network intrusion detection and defense method can be, but is not limited to, executed by the vehicle network intrusion detection and defense device in this embodiment of the present invention as the execution subject. This execution subject can be implemented in software and / or hardware. Figure 3 As shown, the vehicle network intrusion detection and defense method includes at least the following steps:

[0063] S1. Monitor the abnormal behavior of at least one vehicle-side CAN subnet through the vehicle-side CAN subnet controller. When the abnormal behavior of any vehicle-side CAN subnet meets the preset judgment conditions, generate network attack event information through the vehicle-side CAN subnet controller and report it to the vehicle-side main controller in a first preset form.

[0064] S2. Monitor subnet diagnostic attack behavior information through each subnet controller in each vehicle-side CAN subnet, and upload the subnet diagnostic attack behavior information and subnet controller code to the vehicle-side CAN subnet controller in a first preset form, and then transmit the information to the vehicle-side main controller through the vehicle-side CAN subnet controller.

[0065] S3. After converting the network attack event information, subnet diagnostic attack behavior information and subnet controller code existing in the first preset form into the second preset form through the vehicle-side main controller, at least the vehicle VIN information is added to form a first cloud upload file. Then, the first cloud upload file is uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0066] The first preset format can be a CAN message format, and the second preset format can be a file format.

[0067] See also Figure 1 and Figure 2 The implementation path for the above vehicle network intrusion detection and defense methods can be as follows:

[0068] ECU-B connects to CAN subnets 1, 2, ..., n, and can monitor their load rates, key messages, and signals for abnormal behavior in real time. If the load rate exceeds a set threshold, or if key message signals exhibit abnormalities in period, content, or length, it is considered to meet preset judgment conditions. A network attack event is immediately generated and reported to ECU-A via CAN messages. Each controller in CAN subnets 1, 2, ..., n monitors its own diagnostic information for abnormal behavior and reports diagnostic attack information and controller codes to ECU-B via CAN messages. ECU-B then transmits this information to ECU-A. Upon receiving the information, ECU-A converts the message into a file format, adds the vehicle's VIN code information, and uploads it to platform 2. Platform 2 then transmits this information to platform 1 for display, statistical analysis, and other functions via a human-machine interface.

[0069] In one specific implementation, the vehicle network intrusion detection and defense method may optionally include at least:

[0070] (1-1) The vehicle-side operating system USB controller monitors network attack events on the vehicle-side Ethernet, operating system and external interfaces at least, and uploads the controller code, attack type, event handling result and event time at the time of the attack to the vehicle-side main controller in a third preset form.

[0071] (1-2) After the controller code, attack type, event handling result and event occurrence time of the attack behavior existing in the third preset form are converted into the second preset form by the vehicle-side main controller, at least the vehicle VIN information is added to form a second cloud upload file. Then, the second cloud upload file is uploaded to the cloud platform gateway and then the second cloud upload file is transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0072] See also Figure 1 and Figure 2 The implementation path of the vehicle network intrusion detection and defense method proposed in the above embodiments can be as follows:

[0073] ECU-C can be a controller with an operating system that connects to ECU-A via USB. It monitors its own Ethernet network, operating system, external interfaces, and other important network attack events. When a network attack occurs, it reports the controller code where the attack occurred, the attack type, the event handling result, the time of the event, and other important descriptions to ECU-A in the form of a TCP data stream (i.e., the aforementioned third preset format). After receiving the corresponding information, ECU-A converts the message into a file format, adds the vehicle VIN code information, and uploads it to platform 2. Platform 2 then transmits it to platform 1, where it is displayed and statistically analyzed through a human-machine interface.

[0074] In another specific implementation, the vehicle network intrusion detection and defense method may optionally include at least:

[0075] (2-1) The vehicle-side operating system Ethernet controller monitors network attack events on the vehicle-side Ethernet, operating system and external interfaces at least, and uploads the controller code, attack type, event handling result and event time at the time of the attack to the vehicle-side main controller in a third preset form.

[0076] (2-2) After the controller code, attack type, event handling result and event occurrence time of the attack behavior existing in the third preset form are converted into the second preset form by the vehicle-side main controller, at least the vehicle VIN information is added to form a third cloud upload file. Then, the third cloud upload file is uploaded to the cloud platform gateway and then the third cloud upload file is transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0077] See also Figure 1 and Figure 2 The implementation path of the vehicle network intrusion detection and defense method proposed in the above embodiments can be as follows:

[0078] ECU-D can be a controller with an operating system and an Ethernet connection to ECU-A. It monitors its own Ethernet network, operating system, external interfaces, and other important network attack events. When a network attack occurs, it reports the controller code where the attack occurred, the attack type, the event handling result, the time of the event, and other important descriptions to ECU-A in the form of a TCP data stream. After receiving the corresponding information, ECU-A converts the message into a file format, adds the vehicle VIN code information, and uploads it to Platform 2. Platform 2 then transmits it to Platform 1, where it is displayed, statistically analyzed, and performed through a human-machine interface.

[0079] In yet another specific implementation, the vehicle network intrusion detection and defense method may optionally include at least:

[0080] (3-1) Monitor the abnormal behavior of at least one vehicle operating system domain control subnet through the vehicle operating system domain controller. When the abnormal behavior of any vehicle operating system domain control subnet meets the set judgment conditions, generate network attack event information through the vehicle operating system domain controller and report it to the vehicle main controller in a third preset form.

[0081] (3-2) The subnet diagnostic attack information is monitored by each subnet controller in each vehicle-end operating system domain control subnet, and the subnet diagnostic attack information and subnet controller code are uploaded to the vehicle-end operating system domain controller in a first preset form, and then the vehicle-end operating system domain controller transmits the information to the vehicle-end main controller in a third preset form.

[0082] (3-3) After the network attack event information, subnet diagnostic attack information and subnet controller code existing in the third preset form are converted into the second preset form by the vehicle-side main controller, at least the vehicle VIN information is added to form a fourth cloud upload file. Then, the fourth cloud upload file is uploaded to the cloud platform gateway and then the fourth cloud upload file is transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0083] See also Figure 1 and Figure 2 The implementation path of the vehicle network intrusion detection and defense method proposed in the above embodiments can be as follows:

[0084] ECU-E can be a domain controller with an operating system connected to ECU-A via Ethernet. It needs to monitor network security attacks on its own bus and operating system, as well as abnormal behavior of its subordinate subnets, including load rate, critical messages, signals, and diagnostic information. Directly connected to CAN subnet E, it can monitor load rate, critical messages, and signal anomalies in real time. If the load rate exceeds a set threshold, or if critical message signals exhibit abnormalities in period, content, or length, a network attack event will be immediately generated and reported to ECU-E via CAN messages. Each controller in CAN subnet E monitors its own diagnostic information for abnormal behavior and reports diagnostic attack information and controller codes to ECU-E via CAN messages. The ECU-E also needs to monitor important network attack events related to its own Eth network, operating system, and external interfaces. For example, if subnet E exhibits abnormal behavior in load rate, critical messages, or signals; if the self-diagnostic information monitored by each controller in subnet E shows abnormal behavior; and if the ECU-E itself exhibits important network attack anomalies related to its Eth network, operating system, and external interfaces, it will integrate this information and report it to the ECU-A in the form of a TCP data stream. This report includes the controller code that caused the attack, the attack type, the event handling result, the event occurrence, other important descriptions, and the event occurrence time. Upon receiving the information, the ECU-A converts the message into a file format, adds the vehicle's VIN code information, and uploads it to platform 2. Platform 2 then transmits this information to platform 1 for display, statistical analysis, and other tasks via a human-machine interface.

[0085] The technical solution provided in this embodiment firstly monitors the abnormal behavior of at least one vehicle-side CAN subnet through the vehicle-side CAN subnet controller. When the abnormal behavior of any vehicle-side CAN subnet meets the preset judgment conditions, the vehicle-side CAN subnet controller generates network attack event information and reports it to the vehicle-side main controller in a first preset form. Further, each subnet controller in each vehicle-side CAN subnet monitors the subnet diagnostic attack behavior information and uploads the subnet diagnostic attack behavior information and the subnet controller code to the vehicle-side CAN subnet controller in a first preset form, which is then transmitted to the vehicle-side main controller. Finally, the vehicle-side main controller converts the network attack event information, subnet diagnostic attack behavior information, and subnet controller code in the first preset form into a second preset form, adds at least the vehicle VIN information to form a first cloud upload file, uploads the first cloud upload file to the cloud platform gateway, and transmits the first cloud upload file to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0086] It is understandable that, due to the long lifespan of commercial vehicle controllers, many controllers cannot be configured with IDS network intrusion monitoring components due to limitations in computing power and storage space. Therefore, a low-overhead method for network intrusion monitoring and defense is designed. The vehicle network intrusion monitoring and defense method provided in this embodiment requires low controller overhead and has low overall development cost. Applying it to commercial vehicle network intrusion monitoring and defense can at least improve vehicle operation safety during the operation phase of commercial vehicles and help ensure the quality of commercial vehicle information security development.

[0087] Figure 4 This is a schematic diagram of a vehicle network intrusion detection and defense device provided in an embodiment of the present invention. This embodiment is applicable to at least any commercial vehicle network intrusion monitoring and defense design scenario. This vehicle network intrusion detection and defense device can be implemented using software and / or hardware. Figure 4 As shown, the vehicle network intrusion detection and defense device includes at least a vehicle-side CAN subnet monitoring module 110.

[0088] The vehicle-side CAN subnet monitoring module 110 is used for at least:

[0089] The vehicle-side CAN subnet controller monitors the abnormal behavior of at least one vehicle-side CAN subnet. When the abnormal behavior of any vehicle-side CAN subnet meets the preset judgment conditions, the vehicle-side CAN subnet controller generates network attack event information and reports it to the vehicle-side main controller in a first preset form.

[0090] Each subnet controller in the vehicle-side CAN subnet monitors subnet diagnostic attack behavior information, and uploads the subnet diagnostic attack behavior information and subnet controller code to the vehicle-side CAN subnet controller in the first preset form, and then the vehicle-side CAN subnet controller transmits the information to the vehicle-side main controller.

[0091] After the vehicle-side main controller converts the network attack event information, the subnet diagnostic attack behavior information, and the subnet controller code, which exist in the first preset form, into a second preset form, it adds at least the vehicle VIN information to form a first cloud upload file. Then, the first cloud upload file is uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0092] Optionally, it may also include at least a first vehicle-side operating system monitoring module 120;

[0093] The first vehicle-side operating system monitoring module 120 is used for at least:

[0094] The vehicle-side operating system USB controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format.

[0095] After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a second cloud upload file. The second cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

[0096] Optionally, it may also include at least a second vehicle-side operating system monitoring module 130;

[0097] The second vehicle-side operating system monitoring module 130 is used for at least:

[0098] The vehicle-side operating system Ethernet controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format.

[0099] After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a third cloud upload file. The third cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

[0100] Optionally, it may also include at least a third vehicle-side operating system monitoring module 140;

[0101] The third vehicle-side operating system monitoring module 140 is used for at least:

[0102] The vehicle-side operating system domain controller monitors the abnormal behavior of at least one of the vehicle-side operating system domain controller subnets. When the abnormal behavior of any of the vehicle-side operating system domain controller subnets meets the set judgment conditions, the vehicle-side operating system domain controller generates network attack event information and reports it to the vehicle-side main controller in a third preset form.

[0103] The subnet controller in each of the vehicle operating system domain control subnets monitors the subnet diagnostic attack information and uploads the subnet diagnostic attack information and the subnet controller code to the vehicle operating system domain controller in the first preset form, and then the vehicle operating system domain controller transmits it to the vehicle main controller in the third preset form.

[0104] After the vehicle-side main controller converts the network attack event information, the subnet diagnostic attack information, and the subnet controller code, which exist in the third preset form, into the second preset form, it adds at least the vehicle VIN information to form a fourth cloud upload file. Then, the fourth cloud upload file is uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

[0105] The technical solution provided in this embodiment firstly utilizes a vehicle-side CAN subnet monitoring module to monitor the abnormal behavior of at least one vehicle-side CAN subnet through a vehicle-side CAN subnet controller. When the abnormal behavior of any vehicle-side CAN subnet meets a preset judgment condition, the vehicle-side CAN subnet controller generates network attack event information and reports it to the vehicle-side main controller in a first preset form. Further, the vehicle-side CAN subnet monitoring module monitors subnet diagnostic attack behavior information through each subnet controller in each vehicle-side CAN subnet, and uploads the subnet diagnostic attack behavior information and subnet controller code to the vehicle-side CAN subnet controller in a first preset form, which is then transmitted to the vehicle-side main controller. Finally, the vehicle-side CAN subnet monitoring module, through the vehicle-side main controller, converts the network attack event information, subnet diagnostic attack behavior information, and subnet controller code existing in the first preset form into a second preset form, adds at least vehicle VIN information to form a first cloud upload file, uploads the first cloud upload file to the cloud platform gateway, and transmits the first cloud upload file to the cloud analysis platform through the cloud platform gateway, thereby at least achieving network intrusion monitoring display and data statistical analysis.

[0106] It is understandable that, due to the long lifespan of commercial vehicle controllers, many controllers cannot be configured with IDS network intrusion monitoring components due to limitations in computing power and storage space. Therefore, a low-overhead method is designed for network intrusion monitoring and defense. The vehicle network intrusion monitoring and defense device provided in this embodiment has low controller overhead and low overall development cost. Applying it to commercial vehicle network intrusion monitoring and defense can at least improve vehicle operation safety during the operation phase of commercial vehicles and help ensure the quality of commercial vehicle information security development.

[0107] This embodiment provides an electronic device. Figure 5This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. See also: Figure 5 The electronic device 1000 includes a processor 1001 and a memory 1002. The memory 1002 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 1001, the steps in any of the above-described vehicle network intrusion detection and defense methods are performed. Through the above technical solution, the processor 1001 and the memory 1002 are interconnected and communicate with each other via a communication bus and / or other forms of connection mechanisms (not shown). The memory 1002 stores a processor-executable computer program. When the electronic device 1000 is running, the processor 1001 executes the computer program to perform the vehicle network intrusion detection and defense method in any optional implementation of the above embodiments, to at least achieve the following functions: monitoring the abnormal behavior of at least one vehicle CAN subnet through the vehicle-side CAN subnet controller; when the abnormal behavior of any vehicle CAN subnet meets preset judgment conditions, generating network attack event information through the vehicle-side CAN subnet controller and reporting it to the vehicle-side main controller in a first preset form; Each subnet controller in the vehicle-side CAN subnet monitors subnet diagnostic attack behavior information and uploads the subnet diagnostic attack behavior information and subnet controller code to the vehicle-side CAN subnet controller in a first preset form. The vehicle-side CAN subnet controller then transmits the information to the vehicle-side main controller. The vehicle-side main controller converts the network attack event information, subnet diagnostic attack behavior information, and subnet controller code in the first preset form into a second preset form, adds vehicle VIN information to form a first cloud upload file, uploads the first cloud upload file to the cloud platform gateway, and transmits the first cloud upload file to the cloud analysis platform through the cloud platform gateway to achieve at least network intrusion monitoring display and data statistical analysis.

[0108] This embodiment provides a computer-readable storage medium storing a computer program. When executed by a processor, the program implements the vehicle network intrusion detection and defense method provided in all embodiments of this application: The vehicle-side CAN subnet controller monitors the abnormal behavior of at least one vehicle-side CAN subnet. When the abnormal behavior of any vehicle-side CAN subnet meets preset judgment conditions, the vehicle-side CAN subnet controller generates network attack event information and reports it to the vehicle-side main controller in a first preset form. Each subnet controller in each vehicle-side CAN subnet monitors subnet diagnostic attack behavior information and uploads at least the subnet diagnostic attack behavior information and subnet controller code to the vehicle-side CAN subnet controller in a first preset form, which then transmits it to the vehicle-side main controller. The vehicle-side main controller converts the network attack event information, subnet diagnostic attack behavior information, and subnet controller code existing in the first preset form into a second preset form, adds at least vehicle VIN information to form a first cloud upload file, uploads the first cloud upload file to the cloud platform gateway, and transmits the first cloud upload file to the cloud analysis platform through the cloud platform gateway, thereby at least realizing network intrusion detection display and data statistical analysis.

[0109] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0110] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0111] The program code contained on a computer-readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0112] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0113] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An automotive network intrusion monitoring and defense system, comprising: It includes at least a cloud subsystem and a vehicle subsystem; the cloud subsystem includes at least a cloud analysis platform and a cloud platform gateway; the vehicle subsystem includes at least a vehicle main controller, a vehicle CAN subnet controller, a vehicle operating system USB controller, a vehicle operating system Ethernet controller, and a vehicle operating system domain controller. The cloud analytics platform establishes a connection with the cloud platform gateway using at least a hardware communication method; the cloud platform gateway connects to the first end of the vehicle-side main controller via at least a preset secure link; the second end of the vehicle-side main controller establishes a connection with the output end of the vehicle-side CAN subnet controller using at least a CAN communication method; the third end of the vehicle-side main controller establishes a connection with the vehicle-side operating system USB controller using at least a USB communication method; the fourth end of the vehicle-side main controller establishes a connection with the vehicle-side operating system Ethernet controller via at least an Ethernet connection; and the fifth end of the vehicle-side main controller establishes a connection with the output end of the vehicle-side operating system domain controller via at least an Ethernet connection; the input end of the vehicle-side CAN subnet controller is connected to at least one in-vehicle CAN gateway of the vehicle-side CAN subnet; and the input end of the vehicle-side operating system domain controller is connected to at least one on-board CAN gateway of the vehicle-side operating system domain control subnet.

2. A method for monitoring and defending against network intrusion for a vehicle, the method comprising: The vehicle network intrusion detection and defense system according to claim 1 is implemented, and the vehicle network intrusion detection and defense method includes at least: The vehicle-side CAN subnet controller monitors the abnormal behavior of at least one vehicle-side CAN subnet. When the abnormal behavior of any vehicle-side CAN subnet meets the preset judgment conditions, the vehicle-side CAN subnet controller generates network attack event information and reports it to the vehicle-side main controller in a first preset form. Each subnet controller in the vehicle-side CAN subnet monitors subnet diagnostic attack behavior information, and uploads the subnet diagnostic attack behavior information and subnet controller code to the vehicle-side CAN subnet controller in the first preset form, and then the vehicle-side CAN subnet controller transmits the information to the vehicle-side main controller. After the vehicle-side main controller converts the network attack event information, the subnet diagnostic attack behavior information, and the subnet controller code, which exist in the first preset form, into a second preset form, it adds at least the vehicle VIN information to form a first cloud upload file. Then, the first cloud upload file is uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

3. The vehicle network intrusion detection and defense method according to claim 2, further comprising at least: The vehicle-side operating system USB controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format. After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a second cloud upload file. The second cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

4. The vehicle network intrusion detection and defense method according to claim 2, further comprising at least: The vehicle-side operating system Ethernet controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format. After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a third cloud upload file. The third cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

5. The vehicle network intrusion detection and defense method according to claim 2, further comprising at least: The vehicle-side operating system domain controller monitors the abnormal behavior of at least one of the vehicle-side operating system domain controller subnets. When the abnormal behavior of any of the vehicle-side operating system domain controller subnets meets the set judgment conditions, the vehicle-side operating system domain controller generates network attack event information and reports it to the vehicle-side main controller in a third preset form. The subnet controller in each of the vehicle operating system domain control subnets monitors the subnet diagnostic attack information and uploads the subnet diagnostic attack information and the subnet controller code to the vehicle operating system domain controller in the first preset form, and then the vehicle operating system domain controller transmits it to the vehicle main controller in the third preset form. After the vehicle-side main controller converts the network attack event information, the subnet diagnostic attack information, and the subnet controller code, which exist in the third preset form, into the second preset form, it adds at least the vehicle VIN information to form a fourth cloud upload file. Then, the fourth cloud upload file is uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

6. A vehicle network intrusion detection and defense device, characterized in that, Used to execute the vehicle network intrusion detection and defense method according to any one of claims 2-5; The vehicle network intrusion detection and defense device includes at least a vehicle-side CAN subnet monitoring module; The vehicle-side CAN subnet monitoring module is used for at least: The vehicle-side CAN subnet controller monitors the abnormal behavior of at least one vehicle-side CAN subnet. When the abnormal behavior of any vehicle-side CAN subnet meets the preset judgment conditions, the vehicle-side CAN subnet controller generates network attack event information and reports it to the vehicle-side main controller in a first preset form. Each subnet controller in the vehicle-side CAN subnet monitors subnet diagnostic attack behavior information, and uploads the subnet diagnostic attack behavior information and subnet controller code to the vehicle-side CAN subnet controller in the first preset form, and then the vehicle-side CAN subnet controller transmits the information to the vehicle-side main controller. After the vehicle-side main controller converts the network attack event information, the subnet diagnostic attack behavior information, and the subnet controller code, which exist in the first preset form, into a second preset form, it adds at least the vehicle VIN information to form a first cloud upload file. Then, the first cloud upload file is uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion monitoring display and data statistical analysis.

7. The vehicle network intrusion detection and defense device according to claim 6, characterized in that, It should also include at least the first vehicle-side operating system monitoring module; The first vehicle-side operating system monitoring module is used for at least: The vehicle-side operating system USB controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format. After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a second cloud upload file. The second cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

8. The vehicle network intrusion detection and defense device according to claim 6, characterized in that, It should also include at least a second vehicle-side operating system monitoring module; The second vehicle-side operating system monitoring module is used for at least: The vehicle-side operating system Ethernet controller monitors network attack events on the vehicle-side Ethernet, operating system, and external interfaces, and uploads the controller code, attack type, event handling result, and event occurrence time at the time of the attack to the vehicle-side main controller in a third preset format. After the vehicle-side main controller converts the controller code, attack type, event handling result, and event occurrence time of the attack behavior (which exists in the third preset form) into the second preset form, it adds at least the vehicle VIN information to form a third cloud upload file. The third cloud upload file is then uploaded to the cloud platform gateway and transparently transmitted to the cloud analysis platform through the cloud platform gateway, so as to at least realize network intrusion detection display and data statistical analysis.

9. An electronic device comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the vehicle network intrusion detection and defense method according to any one of claims 2-5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the vehicle network intrusion detection and defense method according to any one of claims 2-5.

Images