SOVD covert attack identification method and system based on call graph embedding

Abstract

The application provides a SOVD covert attack identification method and system based on call graph embedding, which constructs a diagnostic service interface call sequence into a directed call graph, the node is a diagnostic service interface endpoint, the edge is a time sequence transition, and the edge attribute contains a transition frequency and a time interval distribution; a node embedding vector and a graph embedding vector are obtained through a graph neural network embedding, a baseline is fitted in a normal stage, and a transition probability matrix is counted; a subgraph is sampled according to a sliding window for a real-time sequence, the deviation degree of the subgraph relative to the baseline is calculated as an anomaly score, the anomaly score is accumulated along time, and when the anomaly score exceeds a threshold, the anomaly is marked and key transitions are traced back; the abnormal subgraph sequence is input into a graph attention network in sequence, and a probability distribution of scanning attacks, privilege escalation, denial of service or information theft is output; a defense strategy is matched according to the attack type and is executed through a gateway interface. The application can identify legal credential abuse, detect slow attacks and implement differentiated defense, and supports autonomous response of a vehicle end.

Description

Technical Field

[0001] This invention relates to the field of vehicle information security technology, specifically to a method and system for identifying SOVD covert attacks based on call graph embedding. Background Technology

[0002] SOVD is a next-generation vehicle diagnostic technology standard based on Service-Oriented Architecture (SOA). The ISO 17978 series of standards systematically specifies SOVD, with ISO 17978-1 defining the basic rules and principles, and ISO 17978-3 defining the SOVD application programming interface (API), standardizing the methods for diagnosing high-performance computers (HPCs) and traditional electronic control units (ECUs). The SOVD API follows RESTful architecture principles, uses JavaScript Object Notation (JSON) to encode data transmission, and defines the API and vehicle diagnostic capabilities through the OpenAPI specification. The SOVD API provides functions such as fault access (including reading fault entries, reading environmental data, and deleting fault entries), measurement and identification, routine execution, input / output control, and vehicle configuration. SOVD supports modern information technologies such as HTTP / HTTPS, JSON, and OAuth, aligning with internet-based and cloud-native development and operation models. Regarding authentication and authorization, SOVD is built on OpenID Connect and OAuth 2.0; vehicle manufacturers can also use certificates and other authentication mechanisms.

[0003] Currently, the security of the SOVD system primarily relies on static access control lists (ACLs) and transport layer encryption (TLS). After successful authentication, the system performs a single-use permission check on the diagnostic request based on the ACL to determine whether to allow the API call. This protection model has the following shortcomings: 1. Static ACLs cannot detect the abuse of legitimate credentials. After an attacker steals a legitimate SOVD client certificate, all their requests are deemed legitimate at the ACL level, and the system cannot distinguish between normal diagnostic operation sequences and malicious diagnostic operation sequences.

[0004] 2. The existing SOVD server only performs authorization verification on a single request and lacks understanding of the context of the diagnostic call sequence. The system does not analyze the temporal dependencies and semantic relationships between API calls and cannot identify attack intentions such as "attempting to bypass security procedures".

[0005] 3. Existing systems cannot effectively identify slow, low-speed attacks. Attackers can spread malicious diagnostic operations across long time windows, rendering frequency-based detection methods ineffective, while existing systems lack the ability to model time-sparse anomalous sequences.

[0006] 4. Even if an anomaly is detected, the existing system cannot automatically distinguish the attack type, making it difficult to trigger differentiated and precise defense strategies.

[0007] In the field of vehicle intrusion detection, numerous studies have proposed anomaly detection methods based on features such as frequency and entropy for Controller Area Network (CAN) buses. However, research on attack detection targeting SOVD application layer API call sequences remains relatively scarce, primarily due to the relatively new SOVD protocol and the high semantic complexity of diagnostic API call sequences. In the area of ​​API sequence analysis, existing research has converted API call sequences into graph structures and applied graph neural networks for malware detection. However, in vehicle diagnostic scenarios, a technical solution combining diagnostic service call graph embedding with anomaly behavior sequence detection to identify SOVD covert attacks has not yet been reported. Summary of the Invention

[0008] In view of this, embodiments of the present invention provide a method and system for identifying SOVD covert attacks based on call graph embedding, in order to solve the technical problems in the prior art that the abuse of legitimate credentials cannot be identified due to reliance on static ACLs, the intent to bypass security processes cannot be captured due to the lack of call sequence context analysis, the slow attacks are difficult to detect due to the lack of cumulative anomaly detection mechanism, and the lack of automatic attack type classification and policy response based on attack type leads to the inability to differentiate responses.

[0009] This invention proposes a method for identifying SOVD covert attacks based on call graph embedding, comprising: The sequence of diagnostic service interface calls received by the service-oriented vehicle diagnostic server is constructed into a directed call graph, where nodes are endpoints of the diagnostic service interface, and directed edges are transitions between two adjacent calls. Edge attributes include the number of transitions and the distribution of time intervals. The graph structure captures the topological relationships and temporal dependencies between calls, providing a structured data foundation for subsequent analysis. This transforms semi-structured logs into computable graph data, enabling subsequent graph embedding and anomaly detection to be implemented on the graph structure, thereby overcoming the limitation that static access control lists cannot perceive the context of the call sequence. Graph neural network embedding is performed on the directed call graph to obtain the node embedding vector and graph embedding vector of each node; during normal operation, the graph embedding vector is collected to fit the baseline, and the transition probability matrix between nodes is calculated; the graph structure is mapped into a low-dimensional vector through graph embedding, and a quantitative benchmark of normal behavior is established with the help of the baseline to complete feature extraction and benchmark establishment, provide a comparison basis for online detection, and solve the problem of not being able to distinguish between normal and abnormal call patterns due to the lack of a normal behavior baseline. The system samples subgraphs of the real-time call sequence using a sliding window, calculates the deviation of the subgraph from the baseline, and obtains anomaly scores. The anomaly scores are accumulated over time. If the accumulated score exceeds a threshold, an anomaly is marked, and the transition that contributes the most to the anomaly score is traced back to locate the transition. Continuous monitoring is achieved through a sliding window. By accumulating and detecting, sparse but persistent anomalies are accumulated over time, and the source of the anomaly is located by tracing back. This enables online detection of slow attacks and accurate location of anomaly transition edges, overcoming the problem of blind spots in the detection of slow attacks by the frequency threshold method. Subgraphs marked as anomalous are sorted by time to form a subgraph sequence. The attack type is classified according to the graph structure of the subgraph sequence over time. By capturing the dynamic evolution pattern of attack behavior through time series analysis, the attack type can be automatically distinguished. Thus, the anomaly is classified into a specific attack method, enabling subsequent responses to be precise and solving the problem of not being able to automatically classify the attack type after anomaly detection. The method determines the defense strategy based on the attack type and sends the defense strategy to the vehicle gateway access control interface for execution. It matches and sends differentiated defense strategies based on the attack type, so that the detection results directly trigger the corresponding actions, thereby transforming the classification results into specific defense actions and making them effective in real time. This enables the vehicle to respond locally and overcomes the problem that existing solutions lack differentiated defense capabilities corresponding to attack types. Overall, this method is used to upgrade SOVD security from static access control to dynamic anomaly detection and automatic response based on behavioral graph models.

[0010] Furthermore, the diagnostic service interface endpoint is jointly identified by the request method and resource path, and similar resource paths are aggregated into a type of node; the time interval distribution includes the mean and variance of the time interval between two adjacent calls; the directed call graph is constructed as subgraphs according to the diagnostic session or time window; this limitation clarifies the node definition method and graph construction rules, so as to unify node identification, control the graph size, and support behavior modeling at different time scales through multi-granularity subgraph construction, making the method adaptable to different diagnostic scenarios.

[0011] Furthermore, the node embedding vector is obtained by aggregating the features of the node's neighbors through a graph neural network of graph sampling and aggregation. The node features include risk level, average response time, and parameter entropy value. The graph embedding vector is obtained by reading out the node embedding vectors of each node in the subgraph. The baseline is obtained by fitting the graph embedding vectors collected during the normal operation phase using a Gaussian mixture model. Each element of the transition probability matrix is ​​a normalized probability of transitioning from one node to another. This definition clarifies the specific implementation of graph embedding and baseline learning, namely, aggregating neighbor features through GraphSAGE to generate node representations that preserve topological semantics, obtaining graph-level behavioral fingerprints through readout operations, and fitting the normal distribution through a Gaussian mixture model to provide a benchmark for anomaly measurement, thereby providing a multi-dimensional reference for anomaly score calculation.

[0012] Furthermore, the anomaly score is the negative log-likelihood of the graph embedding vector of the subgraph relative to the baseline represented by the Gaussian mixture model, or the relative entropy of the transition probability matrix within the sliding window relative to the baseline transition probability matrix; the accumulation along time adopts the cumulative sum operation, adding the accumulated amount of the previous time step to the anomaly score of the current time step and subtracting the drift amount to obtain the median value, and taking the larger of zero and the median value as the accumulated amount of the current time step, the drift amount is used to suppress the continuous accumulation of normal fluctuations; if the accumulated amount exceeds the preset threshold, an anomaly is marked, and the transition that contributes the most to the anomaly score within the sliding window is traced back; this definition clarifies the specific method of anomaly score calculation and accumulation detection, provides two optional anomaly measurement methods to adapt to different deployment scenarios, introduces the time dimension into the detection decision by the cumulative sum operation to overcome the limitations of the single-point threshold method, and outputs interpretable anomaly location results through backtracking to assist operation and maintenance personnel in confirming the attack path.

[0013] Furthermore, the attack type classification is obtained by processing subgraph sequences through a temporal graph attention network and outputting the probability distribution of each attack type. This network runs on the vehicle or in the cloud. The attack types include scanning attacks, privilege escalation, denial of service, and information theft. This definition clarifies the specific implementation method of attack classification, uses a graph attention mechanism to capture the dynamic changes of the graph structure in the time dimension, and outputs probabilistic classification results to quantify confidence. Running on the vehicle or in the cloud is used to balance computing power consumption and real-time requirements. The classification results are used to guide the accurate matching of subsequent strategies.

[0014] Furthermore, scanning attacks correspond to graph features characterized by high out-degree nodes, high node diversity, and strong randomness in transitions; privilege escalation corresponds to unauthorized transitions from low-risk interfaces to high-risk interfaces; denial-of-service attacks correspond to high self-loop edge weights and short call intervals; and information theft corresponds to long call paths, a high proportion of read-type requests, and low entropy values ​​in the transition probability matrix. This constraint clearly defines the distinguishable features of various attacks in the graph structure, enabling the classifier to have clear discrimination criteria. At the same time, it provides rule-based fallback classification capabilities when neural network inference is unavailable, thereby improving system robustness.

[0015] Furthermore, the defense strategy corresponds to the attack type. For scanning attacks, it reduces the call frequency of the corresponding source; for privilege escalation attacks, it blocks write operations of the corresponding session and triggers an alarm; for denial-of-service attacks, it disables high-risk routines of the corresponding source and records forensic logs; for information theft attacks, it maintains the corresponding session and injects false data into it. The defense strategy is issued and executed on the vehicle end via the service-oriented communication access control interface of the vehicle's central gateway and recovers after a preset time. This definition clarifies the specific content and execution method of the strategy response, establishes a mapping relationship between attack types and defense actions, ensures security in network outage scenarios through local execution on the vehicle end, reduces the impact of false blocking on normal operation and maintenance through a timed recovery mechanism, and records response actions to the security audit log for post-event traceability.

[0016] This invention also proposes a SOVD covert attack identification system based on call graph embedding, comprising: The call graph construction unit is used to construct a directed call graph from the sequence of diagnostic service interface calls received by the service-oriented vehicle diagnostic server. Nodes are the endpoints of the diagnostic service interfaces, and directed edges are the transitions between two adjacent calls. The edge attributes include the number of transitions and the distribution of time intervals. The graph embedding and baseline learning unit is used to perform graph neural network embedding on the directed call graph, obtain the node embedding vector and graph embedding vector of each node, collect the graph embedding vector to fit the baseline during normal operation, and count the transition probability matrix between nodes. The anomaly detection unit is used to sample subgraphs of the real-time call sequence by a sliding window, calculate the degree of deviation of the subgraph from the baseline, obtain an anomaly score, accumulate the anomaly score over time, and mark an anomaly if the accumulated result exceeds the threshold, and backtrack the transfer that contributed the most to the anomaly score. The attack classification unit is used to sort subgraphs marked as anomalous by time to form a subgraph sequence, and classify the attack type according to the evolution of the graph structure of the subgraph sequence over time. The policy response unit is used to determine the defense policy based on the attack type and to send the defense policy to the vehicle gateway access control interface for execution. The above units are connected in sequence to form a five-stage processing architecture, which upgrades SOVD security from static access control to dynamic anomaly detection and automatic response based on behavioral graph models. Each unit can be deployed on the vehicle or in the cloud, supporting two operating modes: edge autonomy and cloud collaboration. All detection and response actions are recorded in the security audit log for traceability.

[0017] Furthermore, in the call graph construction unit, the diagnostic service interface endpoint is jointly identified by the request method and resource path, the time interval distribution includes mean and variance, and the directed call graph is constructed as subgraphs according to the diagnostic session or time window; in the graph embedding and baseline learning unit, the node embedding vector is obtained by aggregating the features of the node's neighbors through a graph neural network of graph sampling and aggregation, the graph embedding vector is obtained by reading the node embedding vector of each node in the subgraph, and the baseline is obtained by fitting a Gaussian mixture model; this definition clarifies the specific implementation of the first two units of the system, so as to standardize the data flow format, ensure the standardization of graph construction and feature extraction, and support the real-time processing of the online detection unit.

[0018] Furthermore, the attack types in the attack classification unit are obtained by processing subgraph sequences and outputting probability distributions through a temporal graph attention network. The attack types include scanning attacks, privilege escalation, denial of service, and information theft. The defense strategies in the policy response unit correspond to the attack types. For different attack types, strategies such as reducing call frequency, blocking write operations, disabling high-risk routines, or injecting false data are executed. These strategies are then sent to the vehicle via the service-oriented communication access control interface of the vehicle's central gateway. This definition clarifies the specific implementation of the latter two units of the system, ensuring seamless integration of attack classification results with policy execution. Local delivery to the vehicle avoids cloud transmission delays to meet the real-time requirements of in-vehicle scenarios. The execution results of each response strategy are written to the security audit log, forming a complete and traceable record.

[0019] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention constructs a directed call graph from the sequence of diagnostic service interface calls, using diagnostic service interface endpoints as nodes, temporal transitions as edges, and the distribution of transition counts and time intervals as edge attributes to capture the topological structure and temporal dependencies between calls. It generates node embedding vectors for each node and graph embedding vectors for subgraphs through graph neural network embedding. During normal operation, it fits a Gaussian mixture model baseline and statistically analyzes the transition probability matrix to establish a quantitative benchmark for normal behavior. It calculates negative log-likelihood or relative entropy as anomaly scores by sampling subgraphs through a sliding window, and accumulates these anomaly scores over time using a cumulative sum operation. This allows sparse and continuous low-speed attacks to trigger alarms cumulatively within a long time window. Simultaneously, it backtracks the transitions that contribute the most to the anomaly score to pinpoint the source of the anomaly. Based on this, the system distinguishes between normal diagnostic operation flows and malicious operation flows, identifies the abuse of legitimate credentials, and overcomes the detection blind spot of low-speed attacks using fixed frequency thresholds.

[0020] 2. This invention classifies subgraph sequences deemed abnormal using a temporal graph attention network. Based on the temporal evolution of the subgraph structure, it outputs probability distributions for four attack types: scanning attacks, privilege escalation, denial-of-service attacks, and information theft, achieving automated attack type differentiation. Through differentiated defense strategies corresponding to attack types, it reduces the call frequency for scanning attacks, blocks session write operations and triggers alarms for privilege escalation attacks, disables high-risk routines and records forensic logs for denial-of-service attacks, and injects false data for information theft attacks. Furthermore, the defense strategies are deployed and executed locally on the vehicle via the service-oriented communication access control interface of the vehicle's central gateway and recover after a preset time. Blocking continues even when the network connection is lost. Therefore, the system avoids overreaction or underreaction with a one-size-fits-all approach, forming a complete processing flow from anomaly detection and attack classification to policy response. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is the main flowchart of the SOVD covert attack identification method based on call graph embedding in an embodiment of the present invention; Figure 2 This is a schematic block diagram illustrating the construction of a directed call graph in an embodiment of the present invention; Figure 3 This is a flowchart illustrating the graph embedding and baseline learning process in an embodiment of the present invention. Figure 4 This is a flowchart illustrating the anomaly detection and time accumulation process in an embodiment of the present invention. Figure 5 This is a block diagram illustrating the attack type classification and graph features of each attack type in an embodiment of the present invention. Figure 6 This is a block diagram of the attack type-driven strategy response in an embodiment of the present invention; Figure 7 This is a structural block diagram of the SOVD covert attack identification system based on call graph embedding, according to an embodiment of the present invention. Detailed Implementation

[0023] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of the invention. However, those skilled in the art will understand that the invention can be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods are omitted so as not to obscure the description of the invention with unnecessary detail.

[0024] This invention provides a method and system for identifying SOVD covert attacks based on call graph embedding. This method is particularly suitable for application layer security protection of service-oriented vehicle diagnostic systems, and can also be extended to other vehicle communication protocol security protection fields that require abnormal behavior detection based on API call sequences.

[0025] In practical operation, existing SOVD security solutions have long faced the following challenges: Due to reliance on static access control lists, after an attacker steals a legitimate certificate, all their requests are deemed legitimate, and the system cannot distinguish between normal diagnostic operation flows and malicious operation flows; due to a lack of contextual understanding of diagnostic call sequences, the system fails to analyze the temporal dependencies and semantic relationships between API calls, making it unable to identify attack intentions that bypass the security unlocking process to execute high-risk operations; due to a lack of a temporal accumulation mechanism for anomaly scores, single-point or frequency-based detection methods cannot detect when attackers distribute malicious operations across long-term windows; due to a lack of automatic attack type classification and attack type-based policy responses, differentiated defense strategies cannot be automatically matched after anomaly detection, resulting in only uniform blocking or complete allowance. Traditional solutions often use the independent characteristics of a single request as input, failing to incorporate the graph structure of the call sequence into the analysis; they do not use a combination of sliding windows and graph embedding to generate behavioral fingerprints; they lack a cumulative and driven sparse anomaly accumulation detection mechanism; they do not introduce temporal graph attention networks to classify anomaly subgraph sequences by attack type; and the response layer lacks the ability to execute differentiated policies corresponding to attack types. The aforementioned shortcomings make it difficult for existing technologies to simultaneously address the four core requirements of legitimate credential abuse detection, sequence context awareness, low-speed and slow attack identification, and precise policy response in complex and ever-changing diagnostic access scenarios, thus hindering further improvement of the application-layer security protection capabilities of the SOVD system.

[0026] This invention models the diagnostic service interface call sequence as a directed call graph, using diagnostic service interface endpoints as nodes and temporal transitions as edges, capturing the topological structure and semantic relationships between calls. It maps the subgraph to a fixed-dimensional vector using graph neural network embedding, establishing a normal behavior baseline based on a Gaussian mixture model. By sampling the subgraph through a sliding window and calculating the negative log-likelihood or relative entropy relative to the baseline as an anomaly score, it uses a cumulative sum operation to accumulate the anomaly score temporally, allowing slow attacks to trigger alarms cumulatively over a long window. A temporal graph attention network is used to classify the anomaly subgraph sequences, distinguishing between four attack types: scanning attacks, privilege escalation, denial of service, and information theft. Through differentiated strategies corresponding to the attack type, it achieves precise responses such as rate limiting, blocking, disabling high-risk routines, or injecting fake data, forming a complete processing flow from behavior modeling to anomaly detection to automatic response. The technical solution provided by this invention will be described in detail below with reference to specific embodiments.

[0027] Example 1 This embodiment proposes a method for identifying SOVD covert attacks based on call graph embedding, such as... Figure 1 As shown, the method mainly includes: constructing a directed call graph from the diagnostic service interface call sequence received by the diagnostic server, where nodes are endpoints of the diagnostic service interface, directed edges are transitions between two adjacent calls, and edge attributes include the number of transitions and the distribution of time intervals; embedding the directed call graph into a graph neural network to obtain the node embedding vector and graph embedding vector of each node; collecting graph embedding vectors to fit the baseline during normal operation and statistically analyzing the transition probability matrix between nodes; sampling subgraphs of the real-time call sequence using a sliding window, calculating the deviation of the graph embedding vector of the subgraph from the baseline to obtain an anomaly score, accumulating the anomaly score over time, marking an anomaly if the accumulated result exceeds a threshold, and backtracking the transition that contributes the most to the anomaly score; sorting the marked anomaly subgraphs by time to form a subgraph sequence, and classifying attack types according to the evolution of the graph structure of the subgraph sequence over time; determining a defense strategy based on the attack type and distributing the defense strategy to the vehicle gateway access control interface for execution. The following describes each step of this method in detail with reference to the accompanying drawings.

[0028] In applications, such as Figure 2As shown, the sequence of diagnostic service interface calls received by the service-oriented vehicle diagnostic server is constructed into a directed call graph. The diagnostic service interface call sequence refers to a series of requests initiated sequentially by the diagnostic tool to the service-oriented vehicle diagnostic server over a period of time. Each request corresponds to a read, execute, or delete action on a diagnostic resource, such as a request to read an identifier resource, a request to execute a routine resource, or a request to delete a faulty resource. The nodes of the directed call graph are diagnostic service interface endpoints. An endpoint is determined by the method used in the request and the resource path accessed, uniquely representing a type of diagnostic action. The directed edges of the directed call graph represent transitions between two adjacent calls, i.e., the next call that occurs immediately after the previous call, with the edge pointing from the previous call to the next. Edge attributes include the number of transitions and the time interval distribution. The number of transitions records the number of times the same transition occurs within a statistical period, and the time interval distribution records the distribution of the time interval between two adjacent calls within the statistical period. The purpose of constructing the directed call graph is to transform the originally discrete call records into a structured representation that can express the sequential dependencies between calls, providing a foundation for subsequent behavior modeling.

[0029] In applications, such as Figure 3 As shown, a graph neural network embedding is performed on the directed call graph to obtain the node embedding vector and graph embedding vector for each node. Graph neural network embedding refers to the process of aggregating the features of nodes and their neighbors layer by layer in the graph, mapping each node to a low-dimensional vector. The resulting vector is called the node embedding vector, which reflects the local structure and semantics of the node in the graph. The graph embedding vector is a fixed-dimensional vector obtained by summing all node embedding vectors of the entire subgraph, used to characterize the overall behavioral characteristics of the call sequence. During the normal operation phase, graph embedding vectors are collected to fit a baseline. The normal operation phase refers to the period of routine diagnostic use of the vehicle without attacks. Graph embedding vectors during this period are collected and used to fit a baseline describing the distribution of normal behavior. The transition probability matrix between nodes is statistically analyzed. Each element of the transition probability matrix represents the normalized probability of transitioning from one node to another, used to characterize the transition patterns between calls under normal conditions. The purpose of this step is to transform the graph structure into quantitatively comparable vectors and probabilities and to establish a reference for normal behavior.

[0030] In applications, such as Figure 4As shown, a sliding window is used to sample subgraphs of the real-time call sequence. The deviation of the subgraph's graph embedding vector from the baseline is calculated to obtain an anomaly score. The anomaly score is accumulated over time. If the accumulated score exceeds a threshold, an anomaly is marked, and the transfer that contributed the most to the anomaly is traced back. The sliding window refers to setting a fixed-length observation window on the real-time call sequence and sliding it forward over time. Each call within the window constitutes a subgraph. The deviation refers to the difference between the graph embedding vector of the current subgraph and the baseline of normal behavior. The larger the difference, the less normal the current behavior is; this difference is quantified as an anomaly score. Accumulation over time means gradually accumulating the anomaly scores obtained from each window sequentially. The purpose of accumulation is to allow small anomalies scattered over a long period to gradually converge, thus maintaining sensitivity to slow, low-speed attacks. If the accumulated score exceeds a preset threshold, an anomaly is marked, and the transfer within the sliding window that contributed the most to the anomaly score is traced back, identifying this transfer as the source of the anomaly and providing a basis for subsequent analysis.

[0031] In applications, such as Figure 5 As shown, subgraphs marked as anomalous are sorted chronologically to form a subgraph sequence. Attack types are then categorized based on the evolution of the graph structure over time. A subgraph sequence refers to a sequence of multiple subgraphs marked as anomalous arranged from earliest to latest occurrence, reflecting the evolution of anomalous behavior over time. The evolution of the graph structure over time refers to the changes in the composition of nodes and edges, as well as the transition strength, between adjacent subgraphs. These changes contain information about the attack's unfolding pattern. Attack type categorization involves classifying the current anomaly into a predefined attack type based on the aforementioned evolutionary pattern, allowing for targeted selection of appropriate handling methods. The purpose of this step is to further identify the nature of the anomaly from simple anomaly judgment, refining coarse-grained anomaly alerts into specific attack types.

[0032] In applications, such as Figure 6 As shown, a defense strategy is determined based on the attack type and then deployed to the vehicle gateway access control interface for execution. The defense strategy refers to pre-defined actions for different attack types, such as limiting call frequency, blocking write operations, disabling high-risk routines, or injecting false data. The vehicle gateway access control interface is the control entry point located at the vehicle's central gateway, capable of allowing or blocking diagnostic requests. Deploying and executing means sending the selected defense strategy to the access control interface as a configuration update, allowing it to implement corresponding controls on subsequent requests locally on the vehicle. The purpose of this step is to translate the detection and classification results into actual attack handling, with the handling completed locally on the vehicle, remaining effective even during network outages.

[0033] Specifically, in the application scenario of identifying covert attacks in service-oriented vehicle diagnostics, the service-oriented vehicle diagnostic server continuously receives call requests from diagnostic tools. It first organizes the requests into call sequences according to the diagnostic session and constructs a directed call graph. Nodes cover diagnostic actions such as reading identifiers, executing routines, and deleting faults, while recording the number of transitions and time intervals between adjacent actions. For example, a normal diagnostic process typically forms a transition from the fault code reading endpoint to the freeze frame reading endpoint and then to the fault code clearing endpoint. However, when an attacker repeatedly clears fault codes, a self-loop transition is formed at the fault code clearing endpoint. The system collects graph embedding vectors and fits a baseline within the first 100 diagnostic sessions after the vehicle leaves the factory, while simultaneously calculating the transition probability matrix between nodes. After entering the online phase, the system samples subgraphs of the real-time call sequence using a sliding window of 20 calls. It calculates the deviation of the graph embedding vector from the baseline window by window to obtain an anomaly score, which is accumulated over time. Once the accumulated result exceeds a threshold, an anomaly is marked, and the transition contributing the most is traced back to its origin. The system then sorts the marked abnormal subgraphs by time to form a subgraph sequence, determining that it belongs to one of the following: scanning attack, privilege escalation, denial of service, or information theft. Based on this, the system sends the corresponding defense policy to the vehicle gateway access control interface, and performs local processing on the vehicle to limit the rate of attack, block, disable, or inject false data. The entire process can be completed without cloud intervention.

[0034] The graph neural network embedding can employ graph sampling and aggregation to aggregate neighbor node features layer by layer, or graph convolution or graph attention to weighted aggregate neighbor node features. The time-based accumulation can use a cumulative sum method to recursively accumulate window-by-window anomaly scores, or an exponentially weighted moving average method to smooth the window-by-window anomaly scores before determination. The defense strategy can be deployed either through a service-oriented communication access control interface that takes effect directly on the vehicle, or by having the central gateway forward control commands to relevant electronic control units one by one.

[0035] This embodiment upgrades static access control to dynamic identification and handling based on a behavioral graph model. Even if an attacker possesses legitimate credentials, their abnormal calling patterns will still be revealed through graph embedding and baseline comparison, avoiding missed detections caused by relying solely on the legitimacy of a single request. Accumulation over time allows sparse anomalies scattered over long time windows to gradually converge and trigger alarms, overcoming the detection blind spots of fixed-frequency thresholds for low-speed, slow attacks. Attack type classification shifts the handling process from a one-size-fits-all approach to differentiated execution based on type, reducing overreaction or underreaction. Defense strategies are executed locally on the vehicle, ensuring that attacks can still be blocked even when the vehicle is disconnected from the network, meeting the needs of real-time handling.

[0036] In applications, diagnostic service interface endpoints are jointly identified by the request method and the resource path, with similar resource paths aggregated into a single node. The request method refers to the type of action the diagnostic request applies to a resource, such as read, execute, or delete. The resource path refers to the location information of the diagnostic resource targeted by the diagnostic request, such as the location of an identifier resource, routine resource, or faulty resource. Being jointly identified by the request method and resource path means combining the action category and resource location into a single endpoint name, thus distinguishing different actions like reading identifiers and deleting faults into different nodes. Aggregating similar resource paths into a single node means grouping resource paths that differ only in their variable parts but are structurally identical into the same node; for example, grouping reads targeting different fault numbers into the "read fault" node category. This aims to control the number of nodes and highlight the calling pattern.

[0037] In applications, the time interval distribution includes the mean and variance of the time interval between two adjacent calls. The time interval refers to the interval between the occurrence of the previous and subsequent calls connected by a directed edge. The mean refers to the average level of all time intervals for the same transition within the statistical period, reflecting how quickly the transition typically occurs. The variance refers to the dispersion of these time intervals around the mean, reflecting the temporal stability of the transition. Recording both the mean and variance as edge attributes aims to characterize both the speed and regularity of transitions, providing a basis for identifying high-frequency repetitions or abnormal intervals.

[0038] In applications, directed call graphs are constructed as subgraphs based on either diagnostic sessions or time windows. A diagnostic session refers to all calls included in a complete diagnostic connection from establishment to termination; constructing a subgraph based on diagnostic sessions reflects the complete behavioral profile of a diagnostic process. A time window refers to a fixed-duration observation interval; constructing a subgraph based on time windows reflects the intensity of behavior within that time period. Constructing subgraphs in these two ways aims to characterize call behavior at different granularities: session granularity focuses on the complete process, while time granularity focuses on intensity changes; the two complement each other.

[0039] Specifically, in the application scenario of identifying covert attacks in service-oriented vehicle diagnostics, when parsing diagnostic server logs, the system first extracts the request method and resource path of each request and concatenates them into an endpoint name. Paths that differ only in variable parts such as fault number or identifier number are merged to obtain a controllable group of nodes. When establishing transitions between adjacent calls, the system records the number of times each transition occurs within a statistical period and calculates the mean and variance of its time interval sequence, writing them into the edge attributes. Simultaneously, the system constructs a subgraph reflecting the complete process on a diagnostic session basis and a subgraph reflecting intensity on a fixed-duration time window basis. Both types of subgraphs are input into subsequent embedding and detection stages, thus detecting anomalies in both process structure and temporal intensity.

[0040] The identification of request methods and resource paths can be achieved by directly concatenating the method name and path string, or by encoding the method and path separately and then combining them. The statistical analysis of time interval distribution can be done by calculating the mean and variance of adjacent call intervals, or by creating a histogram of the interval sequence. The scope of the subgraph can be divided by diagnostic sessions, or by a fixed-duration time window.

[0041] This embodiment identifies endpoints by combining request methods with resource paths, clearly distinguishing different diagnostic actions on the graph and avoiding pattern confusion caused by relying solely on resource paths without differentiating between read and delete actions. Merging similar paths reduces the massive number of fine-grained requests into a limited number of nodes, decreasing the graph size and highlighting the true call patterns. Recording the mean and variance of time intervals allows high-frequency repetitive calls and abnormal call rhythms to be directly reflected in edge attributes. Constructing graphs at both session and time window granularities ensures that both complete process anomalies and time-intensity anomalies are covered, improving adaptability to different attack patterns.

[0042] In applications, node embedding vectors are obtained by aggregating features from a node's neighbors using a graph neural network that employs graph sampling and aggregation. These features include risk level, average response time, and parameter entropy. A graph neural network that uses graph sampling and aggregation first samples a subset of nodes from the target node's neighbors and then aggregates these neighbors' features layer by layer into the target node's representation. Aggregating neighbor features involves merging the features of other nodes connected to the target node into the target node's representation according to certain rules. Risk level refers to the security sensitivity of the diagnostic service interface; for example, interfaces involving write or erase operations have a higher risk level. Average response time refers to the average processing time of the interface under normal conditions. Parameter entropy refers to the degree of uncertainty in the parameter values ​​carried by the interface. Aggregating these features into the node embedding vector aims to ensure that each node's vector simultaneously carries its own attributes and neighbor environment information.

[0043] In application, graph embedding vectors are obtained by reading out the node embedding vectors of each node within a subgraph. The readout operation refers to summing the node embedding vectors of all nodes in a subgraph into a fixed-dimensional vector, such as averaging the node vectors by their dimensions. The graph embedding vector obtained through the readout operation represents the behavioral fingerprint of the entire subgraph, and its dimension remains unchanged regardless of the number of nodes. The purpose of this step is to elevate the node-level local representation to a graph-level global representation, facilitating a unified comparison of the entire call sequence.

[0044] In this application, the baseline is obtained by fitting a Gaussian mixture model to the graph embedding vectors collected during normal operation. A Gaussian mixture model is a model that uses a weighted combination of several Gaussian distributions to describe the data distribution, capable of characterizing multiple clustered regions of normal behavior in the vector space. The graph embedding vectors collected during normal operation refer to the graph embedding vectors generated by the vehicle during routine diagnostics without attacks. Fitting these vectors to the Gaussian mixture model yields the baseline describing the distribution of normal behavior. The purpose of this step is to establish a probabilistic description of normal behavior in an unsupervised manner, thus enabling deviation detection without pre-labeling attack samples.

[0045] In application, each element of the transition probability matrix is ​​a normalized probability of transitioning from one node to another. The elements of the transition probability matrix are expressed as: in, For the node To the node The normalized transition probability, For the node To the node The number of transfers within the statistical period. For the node The sum of the number of transitions from the starting point to all nodes. and This refers to the node's sequence number. The normalized probability is the ratio obtained by dividing the number of each transition originating from a given node by the total number of transitions originating from that node; its value ranges from 0 to 1. The purpose of this step is to characterize the transition patterns between calls under normal circumstances using probabilistic terms, providing a baseline for subsequent deviation measurement using relative entropy.

[0046] Specifically, in the application scenario of service-oriented vehicle diagnostic covert attack identification, the system assigns three types of features to each diagnostic service interface endpoint: risk level, average response time, and parameter entropy value. A graph neural network using graph sampling and aggregation is employed to aggregate the features of neighboring endpoints layer by layer to the target endpoint, obtaining node embedding vectors carrying local structural information. The system performs a readout operation by averaging all node embedding vectors within each subgraph along its dimensions, obtaining a graph embedding vector representing the behavioral fingerprint of that session. The system collects graph embedding vectors during the first 100 diagnostic sessions after the vehicle leaves the factory, fits them using a Gaussian mixture model to obtain a baseline of normal behavior, and simultaneously calculates the normalized transition probabilities between each endpoint according to the aforementioned expression, forming a transition probability matrix. This establishes a normal reference at both the vector distribution and transition pattern levels.

[0047] The neighbor aggregation for node embedding can be achieved by averaging the features of sampled neighbors or by weighted summation of the features. The readout operation for graph embedding can be performed by averaging the node vectors along their dimensions or by taking the maximum value of the node vectors along their dimensions. The establishment of a baseline for normal behavior can be achieved by fitting the graph embedding vectors with a Gaussian mixture model or by statistically normalizing the transition probabilities between nodes.

[0048] This embodiment aggregates its own features, such as risk level, average response time, and parameter entropy, along with neighbor features. This allows the node embedding vector to reflect both endpoint attributes and its position within the call structure, thus better expressing the call semantics than using a single feature. The graph embedding vector obtained from the readout operation has a fixed dimension, enabling comparison of call sequences of varying lengths within the same space. A Gaussian mixture model is used to fit the baseline in an unsupervised manner, allowing the system to determine behavioral deviations without prior access to attack samples, reducing reliance on labeled data. The normalized transition probability matrix characterizes normal transition patterns, providing a stable reference for measuring transition deviations within a window using relative entropy. Furthermore, graph embedding preserves the topological structure and semantic relationships between calls, and compared to traditional Markov chains or N-gram models, it can capture multi-step dependencies and indirect associations, demonstrating stronger expressive power for complex attack patterns.

[0049] In applications, the anomaly score is either the negative log-likelihood of the graph embedding vector of the subgraph relative to the baseline represented by the Gaussian mixture model, or the relative entropy of the transition probability matrix within the sliding window relative to the baseline transition probability matrix. The negative log-likelihood is expressed as: in, This represents the abnormal score for the window at the current moment. The graph embedding vector for the current subgraph. for The probability density represented by the Gaussian mixture model at the baseline indicates that the current behavior deviates more from the normal distribution, and the negative log-likelihood is larger. The relative entropy is expressed as: in, For relative entropy, This is the transition probability matrix obtained statistically within the current sliding window. The baseline transition probability matrix is ​​obtained during normal operation. The relative entropy measures the difference between the transition pattern of the current window and the baseline transition pattern. The two expressions measure the deviation from the perspectives of distribution density and transition pattern, respectively. Either one can be used to obtain the anomaly score.

[0050] In application, the accumulation over time is performed using a cumulative sum operation. The accumulated amount from the previous time step is added to the anomaly score at the current time step, and the drift is subtracted to obtain the median value. The larger of zero and the median value is taken as the accumulated amount at the current time step. The cumulative sum operation is expressed as: in, This is the cumulative amount at the current moment. This is the cumulative amount from the previous moment. The abnormal score at the current moment, This is the drift amount, used to suppress the continuous accumulation of normal fluctuations. This indicates taking the larger of zero and the value within the parentheses. When the anomaly score at each moment is only slightly higher than the drift, the cumulative amount slowly increases, causing small anomalies scattered over a long period to gradually converge.

[0051] In the application, if the accumulated amount exceeds a preset threshold, an anomaly is marked, and the transfer that contributes the most to the anomaly score within the sliding window is traced back. The preset threshold is the limit used to determine whether the accumulated amount has reached the alarm condition; once the accumulated amount exceeds this threshold, an anomaly is determined to exist. Tracing back involves examining the contribution of each transfer to the anomaly score within the window that triggered the alarm, identifying the transfer with the largest contribution. The transfer with the largest contribution is the one whose removal results in the most significant decrease in the anomaly score; this is identified as the source of the anomaly, thus providing an interpretable basis for the alarm.

[0052] Specifically, in the application scenario of service-oriented vehicle diagnostic covert attack identification, the system samples subgraphs on the real-time call sequence using a sliding window of 20 calls. It calculates the negative log-likelihood of the graph embedding vector relative to the baseline for each window, or calculates the relative entropy of the transition probability matrix within the window relative to the baseline, to obtain the anomaly score for that window. The system calculates the accumulated amount from the previous time step using the cumulative sum expression. Add to the current abnormal score and subtract the drift amount Take the larger of it and zero as... When an attacker spreads malicious actions over a longer period, making each anomaly very weak, the small overshoots above the drift amount will still gradually accumulate. The value then rises slowly, and once it exceeds a preset threshold, the system marks it as an anomaly. Within this window, it traces back to locate the transfer that contributed the most, such as a self-loop transfer from repeated fault clearing to fault clearing, thereby identifying the source of the anomaly.

[0053] The outlier score can be calculated using either the negative log-likelihood of the graph embedding vector relative to the Gaussian mixture model, or the relative entropy of the transition probability matrix within the window relative to the baseline. The temporal accumulation of the outlier score can be achieved using a cumulative sum operation, or by setting a forgetting factor to accumulate the accumulated amount for finite memory accumulation. The source of the outlier can be located by looking back at the transitions within the window that contribute the most to the outlier score, or by comparing the decrease in probability of each transition within the window relative to the baseline.

[0054] This embodiment measures deviation using either negative log-likelihood or relative entropy, enabling the system to capture both distributional anomalies in graph embedding vectors and anomalies in transition patterns. Accumulation and summation aggregate minute anomalies window by window over time, ensuring that even if an attacker dilutes malicious operations over a long period, the accumulated amount will be detected, overcoming the blind spot of fixed-frequency thresholds for low-speed, slow attacks. The introduction of drift prevents normal fluctuations from accumulating indefinitely, reducing false alarms. Backtracking the transition that contributes the most to the alert pinpoints a specific abnormal call, providing interpretable evidence for handling and forensics.

[0055] In applications, attack types are categorized by processing subgraph sequences using a temporal graph attention network and outputting the probability distribution of each attack type. This network runs either on the vehicle or in the cloud. A temporal graph attention network is a neural network capable of handling graph structures that change over time and assigning different weights to different nodes and at different times through an attention mechanism. Processing the subgraph sequence involves sequentially inputting multiple anomalous subgraphs ordered by time into the network, which then extracts features of the graph structure's evolution over time. Outputting the probability distribution of each attack type means the network estimates the likelihood of the current anomaly belonging to each predefined attack type, selecting the type with the highest probability as the determination result. Running the network on the vehicle or in the cloud means it can be deployed on the vehicle's local computing unit for faster response times or in the cloud for greater computing power, depending on the available computing resources.

[0056] In applications, attack types include four categories: scanning attacks, privilege escalation, denial-of-service attacks, and information theft. Scanning attacks refer to attackers traversing numerous different diagnostic resources to probe system information. Privilege escalation refers to attackers attempting to gain operational capabilities beyond their current privileges. Denial-of-service attacks refer to attackers frequently occupying resources to disable normal diagnostic functions. Information theft refers to attackers exporting sensitive data such as identifiers or configurations in bulk. Categorizing anomalies into these four types aims to provide a basis for subsequent differentiated handling.

[0057] Specifically, in the application scenario of service-oriented vehicle diagnostics and covert attack identification, the system sorts the subgraphs marked as anomalous in sequence according to time to form a subgraph sequence, which is then input into a temporal graph attention network. This network uses an attention mechanism to assign weights to the importance of different nodes and different time points in the subgraph sequence, extracting features of the graph structure's evolution over time, and providing probability distributions for four types of attacks at the output layer: scanning attacks, privilege escalation, denial-of-service attacks, and information theft. The system selects the type with the highest probability as the attack type determination result for the current anomaly. When the vehicle's local computing power is sufficient, the network runs on the vehicle to shorten response latency; when local computing power is limited, the network runs in the cloud to leverage stronger computing power for inference, and the determination result is then returned to the vehicle for further processing.

[0058] The attack type classification can be achieved by using a temporal graph attention network to process subgraph sequences, or by first extracting graph-level features from the subgraph sequences and then classifying them using a sequence model. The classification network can be deployed either by running it on a local computing unit on the vehicle or by running it on a cloud server and then transmitting the results back.

[0059] This embodiment models anomalous subgraph sequences using a temporal graph attention network. This allows the system to utilize information about the graph structure's evolution over time, providing a more accurate characterization of the attack's unfolding process than simply classifying a single subgraph, thus improving the accuracy of attack type determination. The attention mechanism assigns higher weights to key nodes and critical moments, highlighting the attack's discriminative characteristics. Anomalies are subdivided into four types: scanning attacks, privilege escalation, denial-of-service attacks, and information theft. This allows subsequent handling to select appropriate actions based on the type, avoiding over- or under-treatment caused by uniform handling without differentiation. The network can be flexibly deployed on vehicle-side or in the cloud, adapting the solution to different computing power conditions.

[0060] In applications, scanning attacks are characterized by graph features such as high node out-degree, high node diversity, and strong randomness in transitions. Node out-degree refers to the number of edges pointing from a given node to other nodes; a high out-degree indicates that subsequent calls initiated by that node have numerous destinations. High node diversity means that the subgraph involves a wide variety of different node types, reflecting that the attacker has traversed a large number of different diagnostic resources. Strong randomness in transitions means that the transitions between calls lack a stable pattern, reflecting that the attacker accesses resources one by one in a probing manner rather than following a fixed procedure. These graph features collectively characterize the behavior of scanning attacks, which involve reading a large number of different resources in no fixed order.

[0061] In applications, privilege escalation corresponds to a graph feature of unauthorized transfers from low-risk interfaces to high-risk interfaces. Low-risk interfaces refer to interfaces with low security sensitivity, such as those involving only reading, while high-risk interfaces refer to interfaces with high security sensitivity, such as those involving writing or erasing. Unauthorized transfer refers to the transition edge formed when a call jumps directly from a low-risk interface to a high-risk interface without completing the necessary security unlocking. This graph feature characterizes the behavior of attackers attempting to access high-privilege operations without authorization.

[0062] In applications, denial-of-service (DoS) attacks correspond to graph features characterized by high weighted self-loop edges and short call intervals. A self-loop edge is a transition edge whose origin and destination are the same node, representing repeated calls to the same diagnostic action. High weighted self-loop edges indicate that the repeated call occurs frequently within the statistical period. Short call intervals mean that the time between two adjacent calls is very short, reflecting high-frequency resource consumption. These graph features collectively characterize the behavior of DoS attacks, which consume resources by repeatedly calling the same heavyweight routines, such as programming or erasing routines, at high frequency.

[0063] In applications, information theft is characterized by long call paths, a high proportion of read-type requests, and low entropy values ​​in the transition probability matrix. Long call paths refer to long call chains that can extend along the transition direction in the subgraph, reflecting batch and continuous operations. A high proportion of read-type requests means that read actions constitute a large percentage of all actions in the subgraph, reflecting a data acquisition objective. Low entropy values ​​in the transition probability matrix indicate that the transition distribution is concentrated and regular, reflecting the batch export of data in a fixed order. These graph features collectively characterize the behavior of information theft in exporting identifier or configuration data in batches and in an orderly manner.

[0064] Specifically, in the application scenario of identifying covert attacks in service-oriented vehicle diagnostics, the system uses the above four types of graph features as the basis for determining the type of abnormal subgraph sequences. When the subgraph exhibits high degree, a wide variety of nodes, and no fixed pattern of transitions, the system tends to identify it as a scanning attack. When the subgraph shows unauthorized transitions from read-type interfaces to write- or erase-type interfaces without secure unlocking, the system tends to identify it as privilege escalation. When the subgraph has many self-loop edges in the same heavy routine and short intervals between adjacent calls, the system tends to identify it as a denial-of-service attack. When the subgraph exhibits long call paths, a high proportion of read actions, and a highly concentrated distribution of transitions, the system tends to identify it as information theft, thus mapping the behavioral characteristics of different attacks to a clear graph structure representation.

[0065] The detection of scanning attacks can be achieved by statistically analyzing the out-degree of nodes and the number of node types, or by measuring the randomness of the transfer direction. The detection of privilege escalation can be achieved by detecting unauthorized transfers from low-risk interfaces to high-risk interfaces, or by checking for security unlocking records prior to high-risk calls. The detection of denial-of-service attacks can be achieved by statistically analyzing the weight of self-loop edges and the interval between adjacent calls, or by monitoring the frequency of repeated calls to the same heavyweight routine. The detection of information theft can be achieved by measuring the call path length and the proportion of reads, or by calculating the entropy value of the transfer probability matrix.

[0066] This embodiment translates the behavioral characteristics of the four types of attacks into computable graph features, providing clear and specific criteria for type determination and reducing misjudgments between different attacks. Scanning is characterized by node out-degree and diversity, enabling the identification of traversal-style probing. Privilege escalation is characterized by unauthorized transfers, ensuring that attempts to bypass security processes leave traces on the graph even if a single request is rejected. Denial-of-service is characterized by self-loop edge weights and call intervals, directly reflecting high-frequency repeated access. Information theft is characterized by path length, read ratio, and transfer entropy, highlighting the behavior of batch-orderly data export, thus providing accurate input for differentiated handling based on attack type.

[0067] In application, defense strategies correspond to attack types. For scanning attacks, the call frequency of the corresponding source is reduced; for privilege escalation attacks, write operations to the corresponding session are blocked and alarms are triggered; for denial-of-service attacks, high-risk routines of the corresponding source are disabled and forensic logs are recorded; for information theft attacks, the corresponding session is maintained and false data is injected into it. Reducing the call frequency of the corresponding source means limiting the number of calls that a request source identified as a scanning attack can initiate per unit of time. Blocking write operations to the corresponding session means refusing all write requests to the session identified as having privilege escalation and issuing alarms simultaneously. Disabling high-risk routines of the corresponding source and recording forensic logs means disabling the ability of sources identified as having denial-of-service attacks to call heavy routines such as programming or erasing, while recording relevant requests for traceability. Maintaining the corresponding session and injecting false data means not directly cutting off the session identified as having information theft, but instead returning false identifiers or configuration data to confuse the attacker.

[0068] In application, the defense policy is issued and executed on the vehicle end via the service-oriented communication (SOC) access control interface of the vehicle's central gateway, and then restored after a preset duration. The SOC access control interface of the vehicle's central gateway refers to the control entry point located at the central gateway, which allows or blocks diagnostic requests based on the service-oriented communication mechanism. Issuing and executing on the vehicle end means that the selected policy is delivered to this interface via configuration update, allowing it to control subsequent requests locally in the vehicle without cloud intervention. Restoring after a preset duration means that the policy's effect lasts for a pre-defined period, after which it is automatically lifted and normal access is restored, preventing long-term false negatives for legitimate diagnostics.

[0069] Specifically, in the application scenario of service-oriented vehicle diagnostics and covert attack identification, after obtaining the attack type determination result, the system selects the corresponding defense strategy from the predefined mapping relationship. For scanning attacks, the system reduces the call frequency of the corresponding source to one-tenth of the normal level and maintains this for 1800 seconds. For privilege escalation attacks, the system blocks all write operations of the corresponding session and triggers an alarm simultaneously. For denial-of-service attacks, the system disables high-risk routines such as programming or erasure for the corresponding source for 3600 seconds and records forensic logs. For information theft attacks, the system maintains the corresponding session but injects it with false identifiers or configuration data. All of the above strategies take effect locally on the vehicle through the service-oriented communication access control interface of the vehicle's central gateway. After the preset duration is reached, normal access is automatically restored, and the entire process can be completed without cloud intervention.

[0070] The handling of scanning attacks can be achieved by limiting the number of calls made by the source per unit time, or by queuing and rate-limiting the source's requests. The handling of information theft can be achieved by injecting false identifiers or configuration data into the session, or by redirecting the session to an isolated environment and returning misleading data. The distribution of policies can be achieved by updating configurations via the service-oriented communication access control interface of the central gateway, or by issuing control commands to relevant electronic control units one by one.

[0071] This embodiment establishes a clear mapping between attack types and corresponding actions, ensuring that different attacks receive appropriate responses to their severity, avoiding overreaction or underreaction caused by uniform handling. Rate limiting is used for scanning, write operations are blocked for privilege escalation, high-risk routines are disabled and forensics are collected for denial-of-service attacks, and fake data is injected for information theft. This approach balances interception and deception, with the injection of fake data for information theft further delaying attackers and buying time for attribution. Policies take effect locally via the vehicle-side gateway, allowing actions to continue even when the network connection is lost, meeting millisecond-level real-time response requirements. Automatic policy expiration and recovery reduce long-term false positives for legitimate diagnostics.

[0072] Example 2 This embodiment also provides a SOVD covert attack identification system based on call graph embedding, such as Figure 7 As shown, the system includes: a call graph construction unit, used to construct a directed call graph from the diagnostic service interface call sequence received by the diagnostic server, where nodes are endpoints of the diagnostic service interface, directed edges are transitions between adjacent calls, and edge attributes include the number of transitions and the distribution of time intervals; a graph embedding and baseline learning unit, used to perform graph neural network embedding on the directed call graph to obtain the node embedding vector and graph embedding vector of each node, collect graph embedding vectors to fit the baseline during normal operation, and statistically analyze the transition probability matrix between nodes; an anomaly detection unit, used to sample subgraphs of the real-time call sequence by a sliding window, calculate the deviation of the graph embedding vector of the subgraph from the baseline to obtain an anomaly score, accumulate the anomaly score over time, mark an anomaly if the accumulated result exceeds a threshold, and backtrack the transition that contributes the most to the anomaly score; an attack classification unit, used to sort the marked anomaly subgraphs by time to form a subgraph sequence, and classify the attack type according to the evolution of the graph structure of the subgraph sequence over time; and a policy response unit, used to determine the defense policy according to the attack type and distribute the defense policy to the vehicle gateway access control interface for execution. The following describes each unit of the system in detail with reference to the accompanying drawings.

[0073] In the application, the call graph construction unit constructs a directed call graph from the sequence of diagnostic service interface calls received by the service-oriented vehicle diagnostic server. The call graph construction unit is the functional component responsible for transforming diagnostic call records into a graph structure. It receives the call sequence from the service-oriented vehicle diagnostic server, uses diagnostic service interface endpoints as nodes, and directs the transitions between adjacent calls as edges, recording the number of transitions and the distribution of time intervals on the edges. The role of this unit is to provide a structured behavioral representation for the entire system, serving as the input source for subsequent embedding and detection.

[0074] In application, the graph embedding and baseline learning unit performs graph neural network embedding on the directed call graph to obtain node embedding vectors and graph embedding vectors for each node. During normal operation, it collects graph embedding vectors to fit the baseline and calculates the transition probability matrix between nodes. The graph embedding and baseline learning unit is the functional component responsible for transforming the graph structure into vectors and establishing normal references. It aggregates the features of nodes and their neighbors into node embedding vectors through a graph neural network, then summarizes them into graph embedding vectors representing the entire behavior. During normal operation, it uses these vectors to fit the baseline and calculates the transition probability matrix. The role of this unit is to transform the graph into a quantifiable and comparable quantity and establish a benchmark for normal behavior.

[0075] In the application, the anomaly detection unit samples subgraphs of the real-time call sequence using a sliding window, calculates the deviation of the graph embedding vector of the subgraph from the baseline to obtain an anomaly score, accumulates the anomaly score over time, and if the accumulated score exceeds a threshold, it marks an anomaly and backtracks to locate the transfer that contributed the most. The anomaly detection unit is the functional component responsible for online determination of whether behavior deviates from normal. It samples subgraphs of the real-time call sequence using a sliding window, calculates the deviation of the graph embedding vector from the baseline to obtain an anomaly score, accumulates it over time, compares it with a threshold, and if it exceeds the threshold, it marks an anomaly and backtracks to locate the transfer that contributed the most. The role of this unit is to discover anomalies, including slow attacks, and to identify the source of the anomaly.

[0076] In application, the attack classification unit sorts subgraphs marked as anomalous by time to form a subgraph sequence, and classifies the attack type based on the evolution of the graph structure of the subgraph sequence over time. The attack classification unit is the functional component responsible for identifying the nature of the anomaly. It sorts subgraphs marked as anomalous sequentially by time to form a subgraph sequence, and classifies the current anomaly into a specific attack type based on the characteristics of its graph structure evolution over time. The role of this unit is to refine coarse-grained anomaly alerts into specific attack types, providing a basis for differentiated handling.

[0077] In application, the policy response unit determines the defense policy based on the attack type and distributes the defense policy to the vehicle gateway access control interface for execution. The policy response unit is the functional component responsible for translating the identification results into actionable responses. It selects the corresponding defense policy from a predefined mapping based on the attack type and distributes the policy to the vehicle gateway's access control interface, which then controls subsequent requests locally on the vehicle. The role of this unit is to complete the actual handling of the attack and ensure that the handling takes effect locally on the vehicle.

[0078] Specifically, in the application scenario of service-oriented vehicle diagnostic covert attack identification, the call graph construction unit continuously builds a directed call graph from the call sequence received by the diagnostic server. The graph embedding and baseline learning unit collects graph embedding vectors to fit the baseline and calculates the transition probability matrix in the first 100 diagnostic sessions after the vehicle leaves the factory. The anomaly detection unit calculates the anomaly score online with a sliding window of 20 calls and accumulates it over time. Once the threshold is exceeded, the anomaly is marked and the transfer with the greatest contribution is backtracked to locate it. The attack classification unit sorts the anomaly subgraphs by time to form a subgraph sequence and determines whether it belongs to one of the following: scanning attack, privilege escalation, denial of service, or information theft. Based on this, the policy response unit sends the corresponding policy to the vehicle gateway access control interface for local execution on the vehicle. The five units are connected in sequence to complete the entire process from behavior modeling to anomaly detection to classification and handling.

[0079] The graph embedding and baseline learning unit can generate embeddings using graph neural networks that combine graph sampling and aggregation, and fit the baseline using a Gaussian mixture model. Alternatively, it can generate embeddings using graph convolutional networks and statistically analyze the transition probability matrix. The anomaly detection unit can determine anomalies using a combination of negative log-likelihood and cumulative summation, or it can determine anomalies using a combination of relative entropy and cumulative summation. The policy response unit can take effect locally on the vehicle via the central gateway access control interface, or it can issue control commands to relevant electronic control units one by one.

[0080] This embodiment uses five interconnected functional units to identify and handle covert attacks. The call graph construction unit transforms discrete calls into an analyzable structure; the graph embedding and baseline learning unit establishes normal references in an unsupervised manner; the anomaly detection unit remains sensitive to slow, low-speed attacks by accumulating over time; the attack classification unit refines anomalies into specific types; and the policy response unit handles the attacks locally on the vehicle according to their type. The clear division of labor and seamless integration of these units enable the system to identify attacks based on abnormal call patterns, even against attackers with legitimate credentials, and to continue handling attacks even when the network connection is lost, thereby improving the application-layer security protection capabilities of vehicle diagnostics.

[0081] In the application, within the call graph construction unit, the diagnostic service interface endpoints are jointly identified by the request method and resource path. The time interval distribution includes mean and variance, and the directed call graph is constructed as subgraphs according to diagnostic sessions or time windows. The identification of diagnostic service interface endpoints by request method and resource path means that this unit combines the action type used in the request with the location of the accessed resource as the node name. The inclusion of mean and variance in the time interval distribution means that this unit records both the average level and the dispersion of adjacent call intervals on the edge attributes. The construction of subgraphs according to diagnostic sessions or time windows means that this unit constructs the graph both on a complete diagnostic connection unit and on a fixed duration unit. These refinements enable the call graph construction unit to produce graphs that can distinguish different diagnostic actions, reflect the speed and stability of transitions, and characterize behavior at both process and intensity granularities.

[0082] In the application, within the graph embedding and baseline learning unit, node embedding vectors are obtained by aggregating features of node neighbors through a graph neural network using graph sampling and aggregation. Graph embedding vectors are obtained by reading the node embedding vectors of each node within a subgraph, and the baseline is obtained by fitting a Gaussian mixture model. Obtaining node embedding vectors by aggregating features of node neighbors through a graph neural network using graph sampling and aggregation means that this unit first samples from the neighbors of the target node and then aggregates the neighbor features layer by layer to the target node. Obtaining graph embedding vectors by reading the node embedding vectors of each node within a subgraph means that this unit summarizes all node vectors within the subgraph into a fixed-dimensional vector. Obtaining the baseline by fitting a Gaussian mixture model means that this unit uses a Gaussian mixture model to describe the distribution of normal graph embedding vectors. These refinements enable the graph embedding and baseline learning unit to establish normal references that contain both local structure and global behavior in an unsupervised manner.

[0083] Specifically, in the application scenario of service-oriented vehicle diagnostic covert attack identification, the call graph construction unit concatenates the request method and resource path of each request into an endpoint name, calculates the mean and variance of the time interval between adjacent calls and writes them into the edge attributes, and constructs graphs in two ways: diagnostic sessions and fixed-duration time windows. The graph embedding and baseline learning unit uses a graph neural network with graph sampling and aggregation to aggregate the features of neighboring endpoints layer by layer to the target endpoint to obtain node embedding vectors. The average of the node vectors in the subgraph is taken by dimension to obtain the graph embedding vector. In the first 100 diagnostic sessions after the vehicle leaves the factory, a Gaussian mixture model is used to fit these vectors to obtain the baseline, thereby providing a graph structure that is both subdivided in terms of action and distinguishes in terms of granularity for online detection, as well as a normal reference established in unsupervised manner.

[0084] The endpoint identifiers for the graph construction units can be obtained by concatenating the request method and resource path, or by encoding and combining the method and path separately. Neighbor aggregation for graph embedding and baseline learning units can be achieved by averaging the features of sampled neighbors, or by weighted summation of the features. Establishing normal references can be done by fitting the graph embedding vectors using a Gaussian mixture model, or by normalizing the transition probabilities between nodes.

[0085] This embodiment refines the graph construction unit and the graph embedding and baseline learning unit. The former produces graphs that can distinguish between different actions such as reading and writing, reflect the speed and stability of transitions on edges, and characterize behavior at both session and temporal granularities. The latter generates node embeddings with local structure through graph sampling and aggregation, obtains fixed-dimensional graph embeddings through readout, and establishes a baseline unsupervised using a Gaussian mixture model. This refinement of the two units enables the system to establish accurate and stable normal references without the need for attack sample annotation, laying the foundation for the sensitivity and comparability of subsequent detection.

[0086] In the application, the attack types in the attack classification unit are obtained by processing subgraph sequences through a temporal graph attention network and outputting a probability distribution. Attack types include scanning attacks, privilege escalation, denial-of-service attacks, and information theft. "Attack types are obtained by processing subgraph sequences through a temporal graph attention network and outputting a probability distribution" means that the unit inputs a time-ordered sequence of anomalous subgraphs into the temporal graph attention network, which extracts features of the graph structure's evolution over time and provides probabilities for each type. The one with the highest probability is taken as the judgment result. "Attack types include scanning attacks, privilege escalation, denial-of-service attacks, and information theft" means that the unit categorizes the current anomaly into one of these four predefined types. This refinement enables the attack classification unit to accurately determine the type using information about the anomaly's evolution over time.

[0087] In application, the defense strategies in the policy response unit correspond to attack types. For different attack types, measures such as reducing call frequency, blocking write operations, disabling high-risk routines, or injecting false data are implemented, and these measures are issued and executed on the vehicle side via the service-oriented communication access control interface of the vehicle's central gateway. "Defense strategies corresponding to attack types" means that this unit pre-defines appropriate actions for each attack type. "Reducing call frequency, blocking write operations, disabling high-risk routines, or injecting false data" means that the unit selects appropriate actions for scanning attacks, privilege escalation, denial-of-service attacks, and information theft. "Issued and executed on the vehicle side via the service-oriented communication access control interface of the vehicle's central gateway" means that the actions are delivered to the gateway interface via configuration updates and take effect locally on the vehicle. This refinement allows the policy response unit to handle attacks differently based on attack type and complete the process locally on the vehicle side.

[0088] Specifically, in the application scenario of service-oriented vehicle diagnostics and covert attack identification, the attack classification unit sorts the subgraphs marked as abnormal in sequence by time to form a subgraph sequence, which is then input into a time-series graph attention network. The network assigns weights to key nodes and key moments through an attention mechanism, outputting a probability distribution of four categories: scanning attack, privilege escalation, denial-of-service attack, and information theft. The highest probability is taken as the judgment result. The policy response unit selects the corresponding policy accordingly: for scanning attacks, it reduces the call frequency of the corresponding source; for privilege escalation, it blocks write operations of the corresponding session; for denial-of-service, it disables high-risk routines of the corresponding source; and for information theft, it injects false data into the corresponding session. The policy is then issued and executed locally on the vehicle via the service-oriented communication access control interface of the vehicle's central gateway. From classification to handling, the entire process can be completed on the vehicle.

[0089] The attack type determination can be achieved by using a temporal graph attention network to process subgraph sequences, or by extracting graph-level features from the subgraph sequences and then classifying them using a sequence model. The selection of response actions can be done by looking up a predefined mapping table based on the attack type, or by determining the response intensity based on both the attack type and the severity of the attack. The policy can be issued at the vehicle end via the central gateway's service-oriented communication access control interface, or by issuing policies to relevant electronic control units one by one.

[0090] This embodiment refines the attack classification unit and the policy response unit. The former utilizes a time-series graph attention network to leverage the information of anomalies evolving over time, making the type determination more accurate. The latter establishes a clear mapping between the type and the response and executes it locally on the vehicle, ensuring that different attacks receive differentiated responses commensurate with their severity. Both classification and response can be completed on the vehicle, allowing the system to still identify and handle attacks even when the network connection is lost. The use of injecting false data to address information theft adds a means of deceiving attackers beyond interception, buying time for attribution and thus improving the overall targeting and real-time performance of the protection.

[0091] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for identifying SOVD covert attacks based on call graph embedding, characterized in that, include: The sequence of diagnostic service interface calls received by the service-oriented vehicle diagnostic server is constructed into a directed call graph, where nodes are endpoints of the diagnostic service interface, directed edges are transitions between two adjacent calls, and edge attributes include the number of transitions and the distribution of time intervals. Perform graph neural network embedding on the directed call graph to obtain the node embedding vector and graph embedding vector of each node; During normal operation, the graph embedding vector is collected to fit the baseline, and the transition probability matrix between nodes is calculated. The real-time call sequence is sampled into subgraphs using a sliding window. The deviation of the subgraph from the baseline is calculated to obtain an anomaly score. The anomaly score is accumulated over time. If the accumulated score exceeds a threshold, an anomaly is marked, and the transition that contributes the most to the anomaly score is traced back to locate that transition. Subgraphs marked as anomalous are sorted by time to form a subgraph sequence, and attack types are classified according to the evolution of the graph structure of the subgraph sequence over time. Determine the defense strategy based on the attack type, and then distribute the defense strategy to the vehicle gateway access control interface for execution.

2. The SOVD covert attack identification method based on call graph embedding according to claim 1, characterized in that, The diagnostic service interface endpoint is jointly identified by the request method and the resource path, and similar resource paths are aggregated into a type of node; the time interval distribution includes the mean and variance of the time interval between two adjacent calls; the directed call graph is constructed as a subgraph according to the diagnostic session or time window respectively; The node embedding vector is obtained by aggregating the features of the node's neighbors through a graph neural network of graph sampling and aggregation. The node features include risk level, average response time, and parameter entropy value. The graph embedding vector is obtained by reading out the node embedding vectors of each node in the subgraph. The baseline is obtained by fitting the graph embedding vectors collected during normal operation using a Gaussian mixture model. Each element of the transition probability matrix is ​​the normalized probability of transitioning from one node to another.

3. The SOVD covert attack identification method based on call graph embedding according to claim 1, characterized in that, The anomaly score is the negative log-likelihood of the graph embedding vector of the subgraph relative to the baseline represented by the Gaussian mixture model, or the relative entropy of the transition probability matrix within the sliding window relative to the baseline transition probability matrix; the accumulation over time adopts a cumulative sum operation, adding the accumulated amount of the previous time step to the anomaly score of the current time step and subtracting the drift amount to obtain the median value, and taking the larger of zero and the median value as the accumulated amount of the current time step, the drift amount is used to suppress the continuous accumulation of normal fluctuations; if the accumulated amount exceeds a preset threshold, anomalies are marked, and the transitions that contribute the most to the anomaly score within the sliding window are traced back.

4. The SOVD covert attack identification method based on call graph embedding according to claim 1, characterized in that, The attack types are classified by processing subgraph sequences and outputting the probability distribution of each attack type through a temporal graph attention network, which runs on the vehicle or in the cloud. The attack types include scanning attacks, privilege escalation, denial of service, and information theft.

5. The SOVD covert attack identification method based on call graph embedding according to claim 4, characterized in that, Scan attacks target graph features characterized by high out-degree nodes, high node diversity, and strong randomness in node transitions. Privilege escalation corresponds to an unauthorized transfer from a low-risk interface to a high-risk interface; Denial of service corresponds to high self-loop edge weights and short call intervals; information theft corresponds to long call paths, a high proportion of read-type requests, and low entropy values ​​in the transition probability matrix.

6. The SOVD covert attack identification method based on call graph embedding according to claim 1, characterized in that, The defense strategies correspond to the attack types. For scanning attacks, the call frequency of the corresponding source is reduced. For privilege escalation, write operations of the corresponding session are blocked and alarms are triggered. For denial-of-service attacks, high-risk routines of the corresponding source are disabled and forensic logs are recorded. For information theft, the corresponding session is maintained and false data is injected into it. The defense strategies are issued and executed on the vehicle end through the service-oriented communication access control interface of the vehicle central gateway and are restored after a preset time.

7. A SOVD covert attack identification system based on call graph embedding, characterized in that, include: The call graph construction unit is used to construct a directed call graph from the sequence of diagnostic service interface calls received by the service-oriented vehicle diagnostic server. Nodes are the endpoints of the diagnostic service interfaces, and directed edges are the transitions between two adjacent calls. The edge attributes include the number of transitions and the distribution of time intervals. The graph embedding and baseline learning unit is used to perform graph neural network embedding on the directed call graph, obtain the node embedding vector and graph embedding vector of each node, collect the graph embedding vector to fit the baseline during normal operation, and count the transition probability matrix between nodes. The anomaly detection unit is used to sample subgraphs of the real-time call sequence by a sliding window, calculate the degree of deviation of the subgraph from the baseline, obtain an anomaly score, accumulate the anomaly score over time, and mark an anomaly if the accumulated result exceeds the threshold, and backtrack the transfer that contributed the most to the anomaly score. The attack classification unit is used to sort subgraphs marked as anomalous by time to form a subgraph sequence, and classify the attack type according to the evolution of the graph structure of the subgraph sequence over time. The policy response unit is used to determine the defense policy based on the attack type and to send the defense policy to the vehicle gateway access control interface for execution.

8. The SOVD covert attack identification system based on call graph embedding according to claim 7, characterized in that, In the call graph construction unit, the diagnostic service interface endpoint is jointly identified by the request method and resource path, the time interval distribution includes mean and variance, and the directed call graph is constructed as subgraphs according to the diagnostic session or time window; in the graph embedding and baseline learning unit, the node embedding vector is obtained by aggregating the features of the node's neighbors through a graph neural network of graph sampling and aggregation, the graph embedding vector is obtained by reading the node embedding vector of each node in the subgraph, and the baseline is obtained by fitting a Gaussian mixture model.

9. The SOVD covert attack identification system based on call graph embedding according to claim 7, characterized in that, The attack types in the attack classification unit are obtained by processing subgraph sequences and outputting probability distributions through a temporal graph attention network. The attack types include scanning attacks, privilege escalation, denial of service, and information theft. The defense strategies in the policy response unit correspond to the attack types. For different attack types, the strategies include reducing the call frequency, blocking write operations, disabling high-risk routines, or injecting false data. These strategies are then issued and executed on the vehicle side via the service-oriented communication access control interface of the vehicle central gateway.

10. The SOVD covert attack identification system based on call graph embedding according to claim 7, characterized in that, The anomaly score in the anomaly detection unit is either the negative log-likelihood of the graph embedding vector of the subgraph relative to the baseline represented by the Gaussian mixture model, or the relative entropy of the transition probability matrix within the sliding window relative to the baseline transition probability matrix. The anomaly detection unit accumulates the anomaly score over time using a cumulative sum operation, adding the accumulated amount from the previous time step to the anomaly score at the current time step and subtracting the drift amount to obtain an intermediate value. The larger of zero and the intermediate value is taken as the accumulated amount at the current time step. The drift amount is used to suppress the continuous accumulation of normal fluctuations. If the accumulated amount exceeds a preset threshold, an anomaly is marked, and the transitions within the sliding window that contribute the most to the anomaly score are traced back.

Images