Methods, devices, systems, equipment, and media for handling vehicle-to-everything (V2X) security alarms

Abstract

This invention provides a method, apparatus, system, device, and medium for processing vehicle-to-everything (V2X) security alarms, relating to the field of V2X network security technology. The method includes: acquiring multi-source heterogeneous alarm data from alarm source nodes; performing standardized preprocessing to uniformly map it into standardized alarm data; inputting the data into a pre-trained semantic analysis model for noise reduction to obtain real alarm data; performing multi-dimensional correlation analysis and aggregation on the real alarm data based on a preset time window, vehicle identification code, network parameters, and preset V2X attack chain logic to obtain core alarm events; inputting the core alarm events and associated historical threat intelligence into the semantic analysis model for root cause reasoning to obtain the alarm root cause type and impact scope, and generating security control instructions for the target control node. The beneficial effect of this invention is that by combining a semantic analysis model with a baseline of normal V2X behavior, it accurately distinguishes between normal business behavior and real security threats.

Description

Technical Field

[0001] This application relates to the field of vehicle network security technology, and more specifically, to a method, apparatus, system, device, and medium for processing vehicle network security alarms. Background Technology

[0002] With the rapid development of vehicle-to-everything (V2X) technology, data interaction between vehicles and external networks, cloud platforms, and various electronic control units within the vehicle is becoming increasingly frequent. To ensure vehicle operational safety, V2X safety operation systems typically deploy various safety monitoring devices to collect real-time safety alarm data from multiple heterogeneous sources, including in-vehicle communication terminals, in-vehicle operating systems, and cloud service platforms.

[0003] Existing vehicle-to-everything (V2X) security alarm handling mechanisms primarily rely on traditional rule engines and feature matching technologies to trigger and classify alarms. This approach has several inherent drawbacks: First, a single security attack often triggers a large number of repetitive or related alarms, leading to an exponential increase in alarm data and creating an alarm storm that drowns out genuine core threat alarms, severely delaying threat response. Second, traditional rules lack the semantic understanding of complex business scenarios, easily misclassifying normal vehicle network switching, compliant system upgrades, or device restarts as security threats, resulting in a high false alarm rate and significantly consuming the analytical resources of security operations personnel. Finally, existing alarm handling systems typically only display single anomalies, lacking the ability to perform deep correlation analysis on multi-source alarms, failing to effectively trace the core attack source behind the alarms, leading to long root cause localization cycles and low accuracy. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a method, apparatus, system, device, and medium for processing vehicle network security alarms, which is particularly suitable for large-scale concurrent alarm processing scenarios in vehicle network security operation centers (VSOCs), and can achieve intelligent noise reduction, accurate merging, and automatic root cause reasoning functions for alarms.

[0005] The technical solution adopted by this invention is as follows: Firstly, a method for processing vehicle-to-everything (V2X) security alarms is provided, applied to a V2X security operation platform, comprising the following steps: Acquire multi-source heterogeneous alarm data from alarm source nodes; The multi-source heterogeneous alarm data is standardized and preprocessed to be uniformly mapped into standardized alarm data containing vehicle identification code, terminal identifier, network parameters and alarm type. The standardized alarm data is input into a pre-trained semantic analysis model for noise reduction processing to filter false alarms and obtain real alarm data. The noise reduction processing includes: extracting alarm semantic features through the semantic analysis model, comparing the alarm semantic features with a preset baseline of normal vehicle network behavior, and identifying and eliminating false alarms that belong to at least one of normal network switching, compliant system upgrades, and normal device restarts. Based on a preset time window, the vehicle identification code, the network parameters, and a preset vehicle network attack chain logic, the real alarm data is subjected to multi-dimensional correlation analysis and aggregation to obtain at least one core alarm event. The core alarm events and associated historical threat intelligence are input into the semantic analysis model for root cause reasoning to obtain the alarm root cause type and impact range. Based on the alarm root cause type and the scope of impact, a security control instruction is generated for the target control node, and the security control instruction is sent to the target control node.

[0006] Furthermore, the alarm source nodes include in-vehicle communication terminals, in-vehicle operating systems, vehicle network information service platforms, network security equipment, and certificate auditing systems.

[0007] Furthermore, the training process of the semantic analysis model includes: Obtain historical alarm logs of the Internet of Vehicles (IoV), IoV vulnerability database, and fake base station attack characteristic data to construct a domain training set containing normal behavior samples and threat behavior samples; An efficient parameter fine-tuning algorithm is adopted to fine-tune the base language model using the domain training set, thereby optimizing the feature extraction weights of the base language model for vehicle network alarm fields and attack chain logic, and obtaining the semantic analysis model.

[0008] Furthermore, the standardized alarm data is input into a pre-trained semantic analysis model for noise reduction processing to filter false alarms and obtain the true alarm data, specifically including: The standardized alarm data is converted into structured prompt word templates and input into the semantic analysis model; The semantic analysis model outputs a structured noise reduction result that includes false alarm determination results and confidence levels. When the false alarm determination result is a false alarm and the confidence level is greater than the preset confidence level threshold, the corresponding standardized alarm data will be filtered as a false alarm. Unfiltered, standardized alarm data is used as the actual alarm data.

[0009] Furthermore, the actual alarm data undergoes multi-dimensional correlation analysis and aggregation, specifically including: Within the preset time window, extract the real alarm data that have the same vehicle identification code or the same network parameters, and construct a candidate alarm set; Match the alarm types in the candidate alarm set with the attack stage nodes in the vehicle network attack chain logic; If the number of successfully matched attack phase nodes is greater than or equal to a preset threshold, the candidate alarm set is used as a homogeneous alarm set, merged and aggregated to generate the core alarm event, and the alarm scope, number of vehicles involved and total number of alarms of the core alarm event are marked.

[0010] Furthermore, the core alarm events and associated historical threat intelligence are input into the semantic analysis model for root cause reasoning, specifically including: Based on the feature vectors of the core alarm events, vector retrieval is performed in the preset vehicle network threat intelligence database and historical case database to obtain the associated historical threat intelligence; The context data of the core alarm event is concatenated with the historical threat intelligence to construct root cause reasoning prompts, which are then input into the semantic analysis model. The root cause type of the alarm and the scope of its impact are obtained by reasoning through the semantic analysis model. The root cause type of the alarm includes fake base station hijacking, improper access control of the vehicle system, failure of two-way authentication certificate, port scanning reconnaissance and abnormal injection of CAN bus.

[0011] Secondly, a device for processing vehicle network security alarms is provided, comprising: The data standardization module is used to acquire multi-source heterogeneous alarm data of the Internet of Vehicles and perform standardized preprocessing on the multi-source heterogeneous alarm data to uniformly map it into standardized alarm data containing vehicle identification code, network parameters and alarm type. The intelligent noise reduction module is used to input the standardized alarm data into a pre-trained semantic analysis model for noise reduction processing to obtain real alarm data; The merging and aggregation module is used to perform multi-dimensional correlation analysis and merging and aggregation on the real alarm data based on a preset time window, the vehicle identification code, the network parameters, and a preset vehicle network attack chain logic, to obtain at least one core alarm event. The root cause reasoning and control module is used to input the core alarm events and associated historical threat intelligence into the semantic analysis model for root cause reasoning to obtain the alarm root cause type and impact range; based on the alarm root cause type and impact range, it generates security control instructions and sends the security control instructions to the corresponding target execution node to change the network security status of the target execution node.

[0012] Thirdly, a vehicle-to-everything (V2X) security alarm processing system is provided, including vehicle-side edge nodes and a cloud-based security operation platform: The vehicle-side edge node is used to collect the original alarms from the vehicle communication terminal and the vehicle operating system, run a lightweight semantic analysis model to perform preliminary noise reduction and filtering, and upload the filtered alarm data to the cloud security operation platform. The cloud-based security operation platform is used to execute the vehicle network security alarm processing method provided in this disclosure and to issue the security control instructions to the vehicle edge node.

[0013] Fourthly, a computer device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute the vehicle network security alarm processing method provided in this disclosure.

[0014] Fifthly, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute the vehicle network security alarm processing method provided in this disclosure.

[0015] The advantages and positive effects of this invention are as follows: By adopting the above-mentioned technical solution, and combining the semantic analysis model with the baseline of normal vehicle network behavior, it accurately distinguishes between normal business behavior and real security threats, effectively solving the problem that traditional rule engines misjudge normal network switching, compliance system upgrades, and other behaviors as attacks, and significantly reducing ineffective manual investigations; Based on time windows, vehicle identification codes, and vehicle network attack chain logic, multiple scattered alarms triggered by the same attack event are aggregated into a core alarm event, greatly reducing the number of alarms and preventing core threats from being overwhelmed by massive alarms; The core alarm event and historical threat intelligence are input into the semantic analysis model for thought chain reasoning, automatically analyzing the attack path and locating the root cause, transforming root cause location from relying on human experience to intelligent reasoning, greatly improving the accuracy and efficiency of judgment. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating a method for processing vehicle network security alarms according to an embodiment of the present invention. Detailed Implementation

[0018] The present disclosure will now be described more fully with reference to the accompanying drawings, which illustrate exemplary embodiments of the present disclosure. The technical solutions of the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present disclosure, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present disclosure without creative effort are within the scope of protection of the present disclosure.

[0019] like Figure 1 As shown, this invention provides a method for processing vehicle network security alarms, applied to a vehicle network security operation platform, including the following steps: S10. Obtain multi-source heterogeneous alarm data from the alarm source node; Specifically, alarm source nodes must include at least in-vehicle communication terminals (such as TBOX), in-vehicle operating systems (such as DilinkOS), vehicle-to-everything (TSP) information service platforms, network security devices (such as IDPS), and certificate auditing systems; alarm source nodes may also include, but are not limited to, roadside units (RSUs), in-vehicle entertainment systems, and any other nodes capable of generating security logs. Multi-source heterogeneous alarm data refers to security alarm logs from different devices, different systems, and using different data formats and protocols (alarm source nodes).

[0020] S20. Perform standardized preprocessing on multi-source heterogeneous alarm data and uniformly map it into standardized alarm data containing vehicle identification code, terminal identifier, network parameters and alarm type. Specifically, standardized preprocessing includes, but is not limited to, data cleaning, missing value imputation, sensitive data anonymization, and unified field mapping. Standardized alarm data after unified mapping must include the vehicle identification number (VIN), terminal identifier, network parameters (such as IP address, port, base station information), and alarm type; standardized alarm data after unified mapping may also include, but is not limited to, fields such as risk level, occurrence time, and original log fragments.

[0021] S30. Input the standardized alarm data into the pre-trained semantic analysis model for noise reduction processing, filter false alarm reports, and obtain real alarm data; the noise reduction processing includes: extracting alarm semantic features through the semantic analysis model, comparing the alarm semantic features with the preset vehicle network normal behavior baseline, identifying and eliminating false alarm reports that belong to at least one of normal network switching, compliant system upgrades, and normal device restarts. Specifically, the semantic analysis model is based on a large language model (LLM) using deep learning. The core of the noise reduction process lies in extracting the semantic features of alarms through the semantic analysis model and comparing them with a preset baseline of normal vehicle network behavior. The normal behavior baseline includes, but is not limited to, features of normal vehicle network switching, features of compliant system upgrades, features of normal device restarts, features of normal CAN bus message interactions, and features of legitimate OTA commands. Methods for identifying and eliminating false alarms include, but are not limited to, converting data into structured prompt word templates and inputting them into the model, and comparing the confidence level of the model output with a preset threshold for judgment.

[0022] S40. Based on the preset time window, vehicle identification code, network parameters and preset vehicle network attack chain logic, perform multi-dimensional correlation analysis and aggregation on real alarm data to obtain at least one core alarm event. Specifically, the merging and aggregation are based on a preset time window, vehicle identification number, network parameters, and vehicle-to-everything (V2X) attack chain logic. The V2X attack chain logic refers to dividing the attack behavior into multiple attack stage nodes (such as reconnaissance, exploitation, privilege escalation, persistence, etc.). The triggering condition for merging and aggregation includes at least a number of successfully matched attack stage nodes greater than or equal to a preset threshold (preferably, the preset threshold is 3); the triggering condition for merging and aggregation can also include, but is not limited to, any multi-dimensional association rules based on IP aggregation, alarm type aggregation, etc.

[0023] S50. Input the core alarm events and related historical threat intelligence into the semantic analysis model to perform root cause reasoning and obtain the alarm root cause type and impact range. Specifically, the root cause reasoning process involves using the feature vectors of core alarm events to perform vector retrieval (e.g., using a RAG architecture) in a pre-defined threat intelligence database and historical case database to obtain related intelligence. This intelligence is then concatenated to construct prompt words, which are input into the model for CoT (Co-Thread) reasoning. The alarm root cause type can be any root cause of connected vehicle security threats, including but not limited to: fake base station hijacking, improper access control of the vehicle system, invalid two-way authentication certificates, port scanning reconnaissance, abnormal injection of CAN bus, denial-of-service attacks, and malicious firmware flashing.

[0024] S60. Based on the alarm root cause type and impact range, generate security control instructions for the target control node and send the security control instructions to the target control node.

[0025] Specifically, security control commands include at least network isolation commands, base station reselection commands, or patch push commands; security control commands may also include, but are not limited to, certificate revocation commands, port blocking commands, and vehicle speed limit commands. Target control nodes (or target execution nodes) include in-vehicle communication terminals or vehicle-to-everything (V2X) information service platforms.

[0026] By employing the above methods, standardized preprocessing through unified mapping eliminates format barriers between multi-source heterogeneous data, significantly improving the compatibility and efficiency of subsequent data processing. Introducing a semantic analysis model combined with normal behavior baselines for noise reduction accurately identifies and eliminates false alarms in complex scenarios, significantly reducing the workload of manual, ineffective investigations. Multi-dimensional merging using time windows, vehicle identification, and attack chain logic effectively compresses the number of alarms, resolving the alarm storm problem and making core threats readily apparent. Root cause reasoning based on a large model and automatic generation of security control instructions automates the entire process from alarm discovery to handling suggestion generation, improving the accuracy and timeliness of threat handling.

[0027] In one embodiment, the training process of the semantic analysis model includes: acquiring historical alarm logs of the vehicle network, a vehicle network vulnerability database, and fake base station attack feature data; constructing a domain training set containing normal behavior samples and threat behavior samples; and using a parameter-efficient fine-tuning algorithm (such as LoRA, P-Tuning, Adapter, etc.) to fine-tune the base language model using the domain training set, optimizing the feature extraction weights of the base language model for vehicle network alarm fields and attack chain logic, thereby obtaining the semantic analysis model. The pre-training process can also employ any training method that can improve the model's feature extraction capabilities in the field of vehicle network security, including but not limited to full fine-tuning and prompt tuning.

[0028] In one embodiment, standardized alarm data is input into a pre-trained semantic analysis model for noise reduction processing to filter false alarms and obtain real alarm data, specifically including: Convert standardized alarm data into structured prompt templates (e.g., a Prompt template structure includes: [Role Setting] You are a connected vehicle safety analysis expert; [Event Context] Includes event name, level, type, occurrence time, and associated alarm list; [Analysis Task] Please determine whether it is a false alarm and output the confidence level; [Output Format] JSON format), and input them into the semantic analysis model; The semantic analysis model outputs structured noise reduction results that include false alarm judgment results and confidence levels. When the false alarm is determined to be a false alarm and the confidence level is greater than the preset confidence level threshold, the corresponding standardized alarm data will be filtered as a false alarm. Unfiltered, standardized alarm data will be treated as real alarm data.

[0029] In one embodiment, multi-dimensional correlation analysis and aggregation of real alarm data are performed, specifically including: Within a preset time window, extract real alarm data with the same vehicle identification code or the same network parameters, and construct a candidate alarm set. Match the alarm types in the candidate alarm set with the attack stage nodes in the vehicle network attack chain logic; If the number of successfully matched attack phase nodes is greater than or equal to a preset threshold, the candidate alarm set will be treated as related alarms from the same source, merged and aggregated to generate core alarm events, and the alarm scope, number of vehicles involved, and total number of alarms of the core alarm events will be marked.

[0030] In one embodiment, core alarm events and associated historical threat intelligence are input into a semantic analysis model for root cause reasoning, specifically including: Based on the feature vectors of core alarm events, vector retrieval is performed in the preset vehicle network threat intelligence database and historical case database to obtain related historical threat intelligence; By combining the contextual data of core alarm events with historical threat intelligence, a semantic analysis model for root cause reasoning prompt words is constructed. By using a semantic analysis model to perform thought chain reasoning, the root cause types and impact range of alarms are obtained. The root cause types of alarms include fake base station hijacking, improper access control of vehicle systems, failure of two-way authentication certificates, port scanning reconnaissance, and abnormal injection of CAN bus.

[0031] Using the methods described above, traditional technologies lack standardized handling guidelines for alarms of different levels and types. Manual handling is highly subjective and prone to improper handling or response delays. This application automatically generates and executes security control instructions for target control nodes based on the root cause type and scope of the alarm. This transforms threat handling from a passive response relying on human experience to proactive control based on intelligent reasoning, significantly improving the accuracy and timeliness of threat handling and shortening the entire response time from threat discovery to resolution completion.

[0032] In one embodiment, during the risk level review and response suggestion generation stage, the semantic analysis model not only outputs the root cause type and impact scope of the alarm, but also automatically reviews and dynamically adjusts the risk level of the alarm (classified as extremely high risk, high risk, medium risk, and low risk) based on the root cause type, impact scope, and threat level. For different risk levels and root cause types, the system automatically matches and generates standardized response suggestions.

[0033] In one embodiment, during the closed-loop handling and incremental model optimization phase, the system pushes the final alarm results and handling suggestions after noise reduction, merging, and root cause analysis to the front-end display page of the Vehicle-to-Everything (VSOC) safety operation platform. After the maintenance personnel perform the handling, the system supports feeding back the deviation between the actual handling result and the judgment conclusion to the large model as a reward signal for reinforcement learning, thereby achieving incremental optimization of the model and continuously improving the judgment accuracy.

[0034] This embodiment provides a preferred implementation method and describes in detail the complete technical solution of this application.

[0035] Qwen-14B was selected as the base language model, and the LoRA parameter efficient fine-tuning algorithm was used for domain adaptation. Specifically, the system froze all the original weights of Qwen-14B and injected trainable rank decomposition matrices (composed of a reduced-dimensional matrix A and an increased-dimensional matrix B) into each attention module of the Transformer architecture, optimizing only these low-rank matrices to adapt to the vehicle-to-everything (V2X) security scenario. For training data, the system extracted 500,000 alarm logs from a car manufacturer's historical V2X security operation platform over the past 12 months. Combined with vulnerability description data related to V2X in the National Vehicle Vulnerability Database (CAVD) and simulated fake base station attack characteristics from the laboratory, a domain training set containing 300,000 normal behavior samples and 200,000 threat behavior samples was constructed. The normal behavior samples cover scenarios such as normal network switching, compliant OTA upgrades, and normal device restarts; the threat behavior samples cover attack scenarios such as fake base station hijacking, port scanning, and abnormal injection into the CAN bus. After 8 epochs of micron-level training, a trained semantic analysis model was obtained.

[0036] During actual operation, a certain model of new energy vehicle was driving on urban roads. When the vehicle entered the vicinity of an underground parking garage in a commercial area, the vehicle-mounted communication terminal (TBOX) was suppressed by a strong signal emitted by a fake base station, forcing it to downgrade from the normal 4G network to a 2G network. Upon detecting the abnormal network downgrade, the TBOX's local security monitoring component immediately generated a security alarm log. Simultaneously, due to unstable data transmission under the 2G network environment, the heartbeat connection between the TBOX and the cloud-based vehicle network information service platform was interrupted. The network security equipment deployed on the platform detected the loss of the vehicle's heartbeat packet after a timeout and generated a connection anomaly alarm log. Almost simultaneously, the TBOX's local certificate auditing module detected a failure in the verification of the two-way authentication certificate with the currently accessed base station because the certificate signature of the other base station could not be matched in the legitimate certificate chain. The certificate auditing module then generated a certificate verification anomaly alarm log. In addition, due to interference from fake base station signals with the GPS positioning module, the vehicle operating system detected an unreasonable jump in the vehicle's positioning coordinates within a short period of time, generating a location drift alarm log; the TBOX failed to report data multiple times due to insufficient 2G network bandwidth, generating a network offline alarm log.

[0037] The five alarms mentioned above originated from the vehicle communication terminal TBOX, the network security equipment of the vehicle network information service platform, the certificate auditing system, and the vehicle operating system, respectively. Their data formats varied, and their field naming was inconsistent. The system performed standardized preprocessing on these five multi-source heterogeneous alarm data, mapping them uniformly into standardized alarm data. After standardization, the event generated five standardized alarm data, corresponding to: network degradation, heartbeat loss, certificate verification failure, location drift, and network offline.

[0038] The five standardized alarm data points were converted into structured prompt word templates and input into the trained semantic analysis model. The semantic analysis model analyzed the "network degradation" alarm; since it was determined to be a valid false alarm, it was retained as a real alarm. For the "location drift" alarm, since it was determined to be a false alarm and its confidence level of 88% was greater than the preset confidence threshold of 85%, the system determined that this alarm was caused by a fake base station interfering with GPS signals, which is a normal phenomenon and not a real attack, and therefore filtered out as a false alarm. After noise reduction, one false alarm was filtered out from the five standardized alarm data points, and the remaining four valid alarm data points proceeded to the next step.

[0039] Within a preset time window (5 minutes), four real alarm data entries with the same vehicle identification number are extracted to construct a candidate alarm set. Subsequently, the system matches the four alarm types in the candidate set with attack stage nodes in the preset vehicle network attack chain logic. The vehicle network attack chain logic in this embodiment includes the following attack stage nodes: reconnaissance and detection, network hijacking, authentication bypass, data tampering, command injection, and persistent control. The number of successfully matched attack stage nodes is three (network hijacking, authentication bypass, and persistent control), which is greater than the preset threshold of three. Therefore, the system treats this candidate alarm set as a homogeneous alarm, merges and aggregates it to generate a core alarm event, and marks it as follows: alarm scope is a single vehicle (recording vehicle identification number), number of vehicles involved is one, and total number of alarms is four.

[0040] Based on the feature vector of the core alarm event, the system performs a vector search in a pre-set vehicle network threat intelligence database, recalling the top-5 most similar historical threat intelligence entries. This includes a historical case: "In 2024, a certain model of TBOX was suppressed by a fake base station signal, forcibly downgraded to a 2G network, and then launched a man-in-the-middle attack." The system concatenates the context data of the core alarm event with the recalled historical threat intelligence to construct a root cause reasoning input semantic analysis model. The prompts include a thought chain guidance instruction: "Please analyze the attack path step by step." After step-by-step reasoning, the semantic analysis model outputs the following results: Alarm root cause type: fake base station hijacking; Impact scope: single vehicle affected, TBOX communication link hijacked, posing a man-in-the-middle attack risk.

[0041] Based on the root cause type and scope of impact, the system generates a security control instruction: forcing the TBOX to reselect a 4G / 5G base station and temporarily blocking the abnormal base station identifier. This instruction is sent to the target control node (i.e., the vehicle's TBOX). After executing the instruction, the TBOX reconnects to a compliant base station, and the network security status returns to normal.

[0042] To better utilize the vehicle-to-everything (V2X) security alarm processing method, this application also provides a V2X security alarm processing device, comprising: The data standardization module is used to acquire multi-source heterogeneous alarm data of the Internet of Vehicles and perform standardized preprocessing on the multi-source heterogeneous alarm data, uniformly mapping it into standardized alarm data containing vehicle identification code, network parameters and alarm type. The intelligent noise reduction module is used to input standardized alarm data into a pre-trained semantic analysis model for noise reduction processing to obtain real alarm data; The merging and aggregation module is used to perform multi-dimensional correlation analysis and merging and aggregation of real alarm data based on preset time windows, vehicle identification codes, network parameters, and preset vehicle network attack chain logic, to obtain at least one core alarm event. The root cause reasoning and control module is used to input core alarm events and associated historical threat intelligence into the semantic analysis model for root cause reasoning to obtain the alarm root cause type and impact scope; based on the alarm root cause type and impact scope, it generates security control instructions and sends the security control instructions to the corresponding target execution nodes to change the network security status of the target execution nodes.

[0043] To better utilize the methods for handling vehicle-to-everything (V2X) security alarms, this application also provides a V2X security alarm processing system, including vehicle-side edge nodes and a cloud-based security operations platform: The vehicle-side edge node is used to collect the original alarms from the vehicle communication terminal and the vehicle operating system, and run a lightweight semantic analysis model to perform preliminary noise reduction and filtering, and upload the filtered alarm data to the cloud security operation platform. The cloud-based security operations platform is used to execute the above-mentioned methods for handling vehicle network security alarms and to issue security control instructions to the vehicle edge nodes.

[0044] In one embodiment, the system introduces a dual-engine collaboration mechanism: the AI ​​confidence scoring engine is responsible for quantitative calculation (automatically triggered when an event is generated, with no API call cost) for the initial screening of all events; the AI ​​large model analysis engine is responsible for qualitative analysis (manually triggered by the user or automatically triggered by high-confidence events, consuming Tokens) for in-depth analysis of attack intent, attack stage and scope of impact.

[0045] Based on embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0046] An electronic device includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the vehicle network security alarm processing method provided in this disclosure.

[0047] Electronic devices are intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0048] A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the vehicle network security alarm processing method provided in this disclosure.

[0049] The various embodiments of this disclosure can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0050] A computer program product includes a computer program / instructions, which are executed by a processor to provide a method for processing vehicle network security alarms.

[0051] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0052] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0053] The embodiments of the present invention have been described in detail above, but the content described is only a preferred embodiment of the present invention and should not be considered as limiting the scope of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the patent coverage of the present invention.

Claims

1. A method for handling vehicle network security alarms, characterized in that, Applied to the vehicle-to-everything (V2X) security operation platform, it includes the following steps: Acquire multi-source heterogeneous alarm data from alarm source nodes; The multi-source heterogeneous alarm data is standardized and preprocessed to be uniformly mapped into standardized alarm data containing vehicle identification code, terminal identifier, network parameters and alarm type. The standardized alarm data is input into a pre-trained semantic analysis model for noise reduction processing to filter false alarms and obtain real alarm data. The noise reduction processing includes: extracting alarm semantic features through the semantic analysis model, comparing the alarm semantic features with a preset baseline of normal vehicle network behavior, and identifying and eliminating false alarms that belong to at least one of normal network switching, compliant system upgrades, and normal device restarts. Based on a preset time window, the vehicle identification code, the network parameters, and a preset vehicle network attack chain logic, the real alarm data is subjected to multi-dimensional correlation analysis and aggregation to obtain at least one core alarm event. The core alarm events and associated historical threat intelligence are input into the semantic analysis model for root cause reasoning to obtain the alarm root cause type and impact range. Based on the alarm root cause type and the scope of impact, a security control instruction is generated for the target control node, and the security control instruction is sent to the target control node.

2. The method for processing vehicle network security alarms according to claim 1, characterized in that: The alarm source nodes include vehicle communication terminals, vehicle operating systems, vehicle network information service platforms, network security equipment, and certificate auditing systems.

3. The method for processing vehicle network security alarms according to claim 1, characterized in that, The training process of the semantic analysis model includes: Obtain historical alarm logs of the Internet of Vehicles (IoV), IoV vulnerability database, and fake base station attack characteristic data to construct a domain training set containing normal behavior samples and threat behavior samples; An efficient parameter fine-tuning algorithm is adopted to fine-tune the base language model using the domain training set, thereby optimizing the feature extraction weights of the base language model for vehicle network alarm fields and attack chain logic, and obtaining the semantic analysis model.

4. The method for processing vehicle network security alarms according to claim 1, characterized in that, The standardized alarm data is input into a pre-trained semantic analysis model for noise reduction to filter false alarms and obtain the true alarm data, specifically including: The standardized alarm data is converted into structured prompt word templates and input into the semantic analysis model; The semantic analysis model outputs a structured noise reduction result that includes false alarm determination results and confidence levels. When the false alarm determination result is a false alarm and the confidence level is greater than the preset confidence level threshold, the corresponding standardized alarm data will be filtered as a false alarm. Unfiltered, standardized alarm data is used as the actual alarm data.

5. The method for processing vehicle network security alarms according to claim 1, characterized in that, The real alarm data is subjected to multi-dimensional correlation analysis and aggregation, specifically including: Within the preset time window, extract the real alarm data that have the same vehicle identification code or the same network parameters, and construct a candidate alarm set; Match the alarm types in the candidate alarm set with the attack stage nodes in the vehicle network attack chain logic; If the number of successfully matched attack phase nodes is greater than or equal to a preset threshold, the candidate alarm set is used as a homogeneous alarm set, merged and aggregated to generate the core alarm event, and the alarm scope, number of vehicles involved and total number of alarms of the core alarm event are marked.

6. The method for processing vehicle network security alarms according to claim 1, characterized in that, The core alert events and associated historical threat intelligence are input into the semantic analysis model for root cause reasoning, specifically including: Based on the feature vectors of the core alarm events, vector retrieval is performed in the preset vehicle network threat intelligence database and historical case database to obtain the associated historical threat intelligence; The context data of the core alarm event is combined with the historical threat intelligence to construct root cause reasoning prompts, which are then input into the semantic analysis model. The root cause type of the alarm and the scope of its impact are obtained by reasoning through the semantic analysis model. The root cause type of the alarm includes fake base station hijacking, improper access control of the vehicle system, failure of two-way authentication certificate, port scanning reconnaissance and abnormal injection of CAN bus.

7. A device for processing vehicle network security alarms, characterized in that, include: The data standardization module is used to acquire multi-source heterogeneous alarm data of the Internet of Vehicles and perform standardized preprocessing on the multi-source heterogeneous alarm data to uniformly map it into standardized alarm data containing vehicle identification code, network parameters and alarm type. The intelligent noise reduction module is used to input the standardized alarm data into a pre-trained semantic analysis model for noise reduction processing to obtain real alarm data; The merging and aggregation module is used to perform multi-dimensional correlation analysis and merging and aggregation on the real alarm data based on a preset time window, the vehicle identification code, the network parameters, and a preset vehicle network attack chain logic, to obtain at least one core alarm event. The root cause reasoning and control module is used to input the core alarm events and associated historical threat intelligence into the semantic analysis model for root cause reasoning to obtain the alarm root cause type and impact range; based on the alarm root cause type and impact range, it generates security control instructions and sends the security control instructions to the corresponding target execution node to change the network security status of the target execution node.

8. A vehicle-to-everything (V2X) security alarm processing system, characterized in that: Including vehicle-side edge nodes and cloud-based security operations platforms: The vehicle-side edge node is used to collect the original alarms from the vehicle communication terminal and the vehicle operating system, run a lightweight semantic analysis model to perform preliminary noise reduction and filtering, and upload the filtered alarm data to the cloud security operation platform. The cloud-based security operation platform is used to execute the vehicle network security alarm processing method as described in any one of claims 1 to 6, and to issue the security control instructions to the vehicle edge node.

9. A computer device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the vehicle network security alarm processing method as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions for causing the computer to execute the processing method for vehicle network security alarms as described in any one of claims 1 to 6.

Images