An octet-based vehicle-mounted network target field traffic data analysis method and system

Abstract

The application discloses a kind of eight-tuple-based vehicle-mounted network target field flow data analysis method and system, for vehicle-mounted network flow data packet, extract eight-tuple data in the data packet that meets DOIP protocol and SomeIP protocol;Attack behavior analysis is carried out to eight-tuple data using abnormal behavior judgment rule, improve the identification and root mining of vehicle-mounted network flow attack behavior.

Description

Technical Field

[0001] This invention belongs to the field of vehicle network data packet detection technology, and particularly relates to a method and system for analyzing vehicle network range traffic data based on octets. Background Technology

[0002] In the field of automotive network ranges, in order to solve the problems of attack behavior monitoring and vulnerability discovery, traditional network ranges are based on traffic monitoring solutions, which use network packet capture tools to capture network card traffic.

[0003] Traditional attack monitoring and analysis methods primarily rely on extracting traffic information using five-tuples for analysis. However, five-tuple analysis cannot parse application-layer data. Since SomeIP and DoIP protocols are based on TCP / UDP protocols, some header data resides in the TCP / UDP data segment and is not recorded by the five-tuple method. Therefore, using the five-tuple approach to analyze traffic from common SomeIP and DoIP protocols in automotive Ethernet suffers from low analytical dimensionality and inaccuracy.

[0004] Based on the above problems, this paper proposes a method and system for analyzing vehicle network range traffic data based on octet. Summary of the Invention

[0005] To address the above problems, this invention proposes a method for analyzing vehicular network test range traffic data based on octet pairs. The method specifically includes the following steps: S1. Capture vehicle network traffic data packets, and obtain data packets that conform to the DOIP and SomeIP protocols from the data packets as the first data packet; S2. Extract the octet data from the first data packet; the octet data includes: protocol type, source IP address, destination IP address, source port, destination port, logical source address, logical destination address, and timestamp; S3. Perform data analysis based on the octet data of the first data packet to identify attack behaviors in the vehicle network.

[0006] Furthermore, step S1 specifically includes: Extract the protocol type from the vehicle network traffic data packets. If the protocol type is DOIP or SomeIP, use that data packet as the first data packet.

[0007] Furthermore, step S2 specifically includes: When the first data packet is a data packet conforming to the DOIP protocol, the sourceaddress field and target address field in the first data packet are extracted as the logical source address and logical destination address in the octet data, respectively. When the first data packet is a data packet conforming to the SomeIP protocol, the ServiceID and MethodID fields in the first data packet are extracted as the logical source address in the 8-tuple, and the ClientID and SessionID fields in the first data packet are extracted as the logical destination address in the 8-tuple.

[0008] Furthermore, step S3 specifically includes the following steps: S31. Retrieve all first data packets whose timestamp is equal to the current time. The first data packet can be one or more; S32. Obtain the first data packet that conforms to the SomeIP protocol from all the first data packets. When the first data packet that conforms to the SomeIP protocol has a first abnormal behavior, determine whether the first data packet has an attack behavior based on the first abnormal behavior. S33. Obtain all second data packets conforming to the DOIP and SomeIP protocols within a preset time T before the current time, and merge all first data packets and all second data packets at the current time to form multiple third data packets; When multiple third data packets exhibit second abnormal behavior, determine whether the multiple third data packets exhibit attack behavior based on the second abnormal behavior. The rules for judging the first abnormal behavior and the rules for judging the second abnormal behavior are obtained from the set of rules for judging abnormal behavior; The set of abnormal behavior judgment rules is stored on a cloud server; the set of abnormal behavior judgment rules stores... The judgment rule, .

[0009] Furthermore, the set of rules for judging abnormal behavior includes at least: a first judgment rule and a second judgment rule; Inspectors are able to add and update rules for judging abnormal behavior; The first judgment rule includes at least: judging whether the type of the specific operation corresponding to the MethodID field in the octet data corresponding to the first data packet is a restricted operation; The mapping relationship between specific operations and their types is stored on the cloud server. The second judgment rule includes at least: judging whether the number of times the same field appears in the octet data corresponding to multiple third data packets is greater than a preset number.

[0010] A vehicle-mounted network range traffic data analysis system based on octet, the system comprising a detection device, a vehicle-mounted terminal, and a cloud server; wherein the detection device is connected to both the vehicle-mounted terminal and the cloud server; The vehicle-mounted terminal includes a vehicle-mounted gateway and multiple ECUs; the detection device executes a vehicle network range traffic data analysis method based on octet.

[0011] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above description and other objects, features and advantages of the present invention more obvious and understandable, preferred embodiments are provided and described in detail below. Attached Figure Description

[0012] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings.

[0013] Figure 1 This is a flowchart of a method for analyzing vehicle network test range traffic data based on octet. Detailed Implementation

[0014] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0015] In the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," "fixing," etc., should be interpreted broadly. For example, they can refer to a connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0016] Example 1 A method for analyzing vehicular network test range traffic data based on octet, the method comprising the following steps: S1. Capture vehicle network traffic data packets, and obtain data packets that conform to the DOIP and SomeIP protocols from the data packets as the first data packet; S2. Extract the octet data from the first data packet; the octet data includes: protocol type, source IP address, destination IP address, source port, destination port, logical source address, logical destination address, and timestamp; S3. Perform data analysis based on the octet data of the first data packet to identify attack behaviors in the vehicle network.

[0017] Furthermore, step S1 specifically includes: Extract the protocol type from the vehicle network traffic data packets. If the protocol type is DOIP or SomeIP, use that data packet as the first data packet.

[0018] Furthermore, step S2 specifically includes: When the first data packet is a data packet conforming to the DOIP protocol, the sourceaddress field and target address field in the first data packet are extracted as the logical source address and logical destination address in the octet data, respectively. When the first data packet is a data packet conforming to the SomeIP protocol, the ServiceID and MethodID fields in the first data packet are extracted as the logical source address in the 8-tuple, and the ClientID and SessionID fields in the first data packet are extracted as the logical destination address in the 8-tuple.

[0019] Furthermore, step S3 specifically includes the following steps: S31. Retrieve all first data packets whose timestamp is equal to the current time. The first data packet can be one or more; S32. Obtain the first data packet that conforms to the SomeIP protocol from all the first data packets. When the first data packet that conforms to the SomeIP protocol has a first abnormal behavior, determine whether the first data packet has an attack behavior based on the first abnormal behavior. S33. Obtain all second data packets conforming to the DOIP and SomeIP protocols within a preset time T before the current time, and merge all first data packets and all second data packets at the current time to form multiple third data packets; When multiple third data packets exhibit second abnormal behavior, determine whether the multiple third data packets exhibit attack behavior based on the second abnormal behavior. The rules for judging the first abnormal behavior and the rules for judging the second abnormal behavior are obtained from the set of rules for judging abnormal behavior; The set of abnormal behavior judgment rules is stored on a cloud server; the set of abnormal behavior judgment rules stores... The judgment rule, .

[0020] Furthermore, the set of rules for judging abnormal behavior includes at least: a first judgment rule and a second judgment rule; Inspectors are able to add and update rules for judging abnormal behavior; The first judgment rule includes at least: judging whether the type of the specific operation corresponding to the MethodID field in the octet data corresponding to the first data packet is a restricted operation; The mapping relationship between specific operations and their types is stored on the cloud server. The second judgment rule includes at least: judging whether the number of times the same field appears in the octet data corresponding to multiple third data packets is greater than a preset number.

[0021] Furthermore, step S32 specifically includes the following steps: S321. When the protocol type in the octet data corresponding to the first data packet is SomeIP, obtain the ServiceID field and MethodID field in the octet data. Parse the target service corresponding to the ServiceID field, and parse the specific operation under the target service corresponding to the MethodID field to determine the type of the specific operation; The specific operation types include: restricted operations and unrestricted operations; wherein, the mapping relationship between specific operations and specific operation types is stored on the cloud server. When the specific operation type is a restricted operation, the first data packet contains an abnormal operation instruction, and step S322 is executed; When the specific operation type is unrestricted operation, the first data packet does not have the first attack behavior, and step S324 is executed; S322. Determine that the first data packet contains a first attack behavior; obtain the source IP address in the octet data corresponding to the first data packet; if the source IP address is the vehicle gateway IP address, execute step S323; if the source IP address is not the gateway IP address, feed back the source IP address in the octet data corresponding to the first data packet to the detection personnel. S323. Obtain all first data packets conforming to the DOIP protocol within a preset time T before the current time; obtain the octet data corresponding to all first data packets conforming to the DOIP protocol; when the octet data meets the first preset condition, extract the source IP address and logical source address from the octet data, and feed back the source IP address and logical source address to the testing personnel. The first preset condition is that the destination IP address in the octet data is the same as the destination IP address in the octet data corresponding to the first data packet in step S321.

[0022] S324. For all the first data packets in step S31, repeat steps S321 to S323.

[0023] Furthermore, step S33 specifically includes the following steps: S331. Obtain one or more octet data corresponding to one or more third packets conforming to the DOIP protocol from multiple third packets, and execute step S333; S332. Obtain one or more octet data corresponding to one or more third packets conforming to the SomeIP protocol from multiple third packets, and execute step S334; S333. Count the number of times each logical source address and each logical destination address appears in the one or more octets of data; When a logical source address appears more times than a preset number If it is determined that multiple third data packets in step S33 exhibit second abnormal behavior, then step S335 is executed. When a logical destination address appears more times than a preset number If it is determined that multiple third data packets in step S33 exhibit second abnormal behavior, then step S336 is executed. S334. Count the number of times each destination IP address, each destination port, and each ServiceID field appears in the one or more octet data sets; When a destination IP address appears more times than a preset number Or, a destination port appears more than a preset number of times. Or, a ServiceID field appears more than the preset number of times. If it is determined that multiple third data packets in step S33 exhibit second abnormal behavior, then step S337 is executed. When no destination IP address appears more than the preset number of times. No destination port appears more than the preset number of times. No ServiceID field appears more than the preset number of times. And the number of the one or more third data packets is greater than When the time comes, proceed to step S338; S335. Determine that multiple third-party data packets in step S33 contain attack behavior; Obtain one or more logical destination addresses from one or more octets of data containing the logical source address, and provide the logical source address, the number of times the logical source address appears, and one or more logical destination addresses back to the testing personnel; S336. Determine if multiple third-party data packets in step S33 contain attack behavior; Obtain one or more logical source addresses from one or more octets of data containing the logical destination address, and provide feedback on the one or more logical source addresses, logical destination addresses, and the number of times the logical destination address appears to the testing personnel. S337. Determine that multiple third-party data packets in step S33 contain attack behavior; S338. Based on one or more third data packets in step S334, determine whether there is any attack behavior in the multiple data packets in step S33.

[0024] Furthermore, step S337 specifically includes the following steps: S3371. When a destination IP address appears more than a preset number of times. When the destination IP address is contained in the one or more octet data in step S334, step S3372 is executed. When a destination port appears more times than a preset number When the destination port is included in the data of the one or more octets in step S334, step S3372 is executed. When a ServiceID field appears more than the preset number of times When the ServiceID field is included in the data of the one or more octets in step S334, step S3372 is executed. S3372. For each octet A in one or more octet data sets, when the source IP address in the octet A is the vehicle gateway IP address, obtain all first data packets conforming to the DOIP protocol within a preset time T before the current time. When the destination IP address and destination port in the octet B corresponding to the first data packet are the same as the destination IP address and destination port in the octet A, add the source IP address of the octet B to the attacker list. When the source IP address in the octet data A is not a vehicle network IP address, add the source IP address to the attacker list; S3373. For each octet of data in one or more octets obtained in step S3371, repeat step S3372 to obtain the attacker list; S3374. Provide the list of attackers to the detection personnel.

[0025] Furthermore, step S338 specifically includes the following steps: S3381. Obtain one or more source IP addresses from one or more octets of data corresponding to one or more third data packets in step S334; When the proportion of vehicle gateway IP addresses in one or more source IP addresses is less than a preset threshold When the time comes, execute step S3382; When the proportion of vehicle gateway IP addresses in one or more source IP addresses is greater than or equal to a preset threshold When this happens, proceed to step S3383; S3382. Remove the vehicle gateway IP address from the one or more source IP addresses to obtain one or more first source IP addresses; For each first source IP address, the ECU corresponding to the first source IP address, and the ServiceID and MethodID fields in the octet data containing the first source IP address are used as the combined data corresponding to the first source IP address; thus, one or more combined data corresponding to the one or more first source IP addresses are obtained. When there are mutually exclusive combinations of data in one or more combinations, it is determined that the multiple third data packets in step S33 contain attack behavior, and the mutually exclusive combinations of data are fed back to the detection personnel; otherwise, it is determined that the multiple third data packets in step S33 do not contain attack behavior. The mutually exclusive combination data is defined as follows: within the same preset time T, when a third data packet contains combination data E, another third data packet containing combination data F cannot appear. S3383. Obtain all first data packets conforming to the DOIP protocol within a preset time T prior to the current time. When the total number of first data packets conforming to the DOIP protocol exceeds a preset threshold... If it is determined that multiple third data packets in step S33 contain attack behavior, the source IP address in the octet data corresponding to all first data packets conforming to the DOIP protocol is fed back to the detection personnel. When all first packets conforming to the DOIP protocol are less than or equal to a preset threshold At that time, execute step S3382.

[0026] Example 2 A vehicle-mounted network range traffic data analysis system based on octet, the system comprising a detection device, a vehicle-mounted terminal, and a cloud server; wherein the detection device is connected to both the vehicle-mounted terminal and the cloud server; The vehicle-mounted terminal includes a vehicle-mounted gateway and multiple ECUs; the detection device executes a vehicle network range traffic data analysis method based on octet as described in Embodiment 1.

[0027] The beneficial effects of this invention are as follows: (1) This invention extracts different data contents from DOIP protocol data packets and SomeIP protocol data packets in the vehicle network, supplements the traditional five-tuple data, forms eight-tuple data, and analyzes and monitors the vehicle network traffic to identify attack behavior. This not only improves the accuracy of attack behavior analysis and breaks through the limitations of five-tuple traffic analysis, but also does not increase the data calculation consumption.

[0028] (2) This invention further improves the accuracy of vehicular network traffic attack behavior analysis by targeting cross-protocol combinations of SomeIP protocol data packets, DOIP protocol data packets and SomeIP data packets, and judging attack behavior according to the abnormal behavior judgment rules in the abnormal behavior judgment rule set. Based on traffic analysis based on octet data, this invention further improves the accuracy of vehicular network traffic attack behavior analysis.

[0029] (3) This invention utilizes the gateway IP address, source IP address, source port, destination IP address, destination port and ServiceID field to realize cross-protocol analysis of DOIP protocol data packets and SomeIP data packets, identify attack behavior and dig out the root cause of attack behavior, and improve the accuracy of identifying vehicle network traffic attack behavior.

[0030] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for analyzing vehicle network range traffic data based on octet, characterized in that, The method includes the following steps: S1. Capture vehicle network traffic data packets, and obtain data packets that conform to the DOIP and SomeIP protocols from the data packets as the first data packet; S2. Extract the octet data from the first data packet; The octet data includes: protocol type, source IP address, destination IP address, source port, destination port, logical source address, logical destination address, and timestamp; S3. Perform data analysis based on the octet data of the first data packet to identify attack behaviors in the vehicle network.

2. The method for analyzing vehicle network range traffic data based on octet as described in claim 1, characterized in that, Step S1 specifically includes: Extract the protocol type from the vehicle network traffic data packets. If the protocol type is DOIP or SomeIP, use that data packet as the first data packet.

3. The method for analyzing vehicle network range traffic data based on octet as described in claim 1, characterized in that, Step S2 specifically includes: When the first data packet is a data packet conforming to the DOIP protocol, the source address field and target address field in the first data packet are extracted as the logical source address and logical destination address in the octet data, respectively. When the first data packet is a data packet conforming to the SomeIP protocol, the ServiceID and MethodID fields in the first data packet are extracted as the logical source address in the octet data, and the ClientID and SessionID fields in the first data packet are extracted as the logical destination address in the octet data.

4. The method for analyzing vehicle network range traffic data based on octet as described in claim 3, characterized in that, Step S3 specifically includes the following steps: S31. Retrieve all first data packets whose timestamp is equal to the current time. The first data packet can be one or more; S32. Obtain the first data packet that conforms to the SomeIP protocol from all the first data packets. When the first data packet that conforms to the SomeIP protocol has a first abnormal behavior, determine whether the first data packet has an attack behavior based on the first abnormal behavior. S33. Obtain all second data packets conforming to the DOIP and SomeIP protocols within a preset time T before the current time, and merge all first data packets and all second data packets at the current time to form multiple third data packets; When multiple third data packets exhibit second abnormal behavior, determine whether the multiple third data packets exhibit attack behavior based on the second abnormal behavior. The rules for judging the first abnormal behavior and the rules for judging the second abnormal behavior are obtained from the set of rules for judging abnormal behavior; The set of abnormal behavior judgment rules is stored on a cloud server; the set of abnormal behavior judgment rules stores... The judgment rule, .

5. The method for analyzing vehicle network range traffic data based on octet as described in claim 4, characterized in that: The set of rules for judging abnormal behavior includes at least: a first judgment rule and a second judgment rule; Inspectors are able to add and update rules for judging abnormal behavior; The first judgment rule includes at least: judging whether the type of the specific operation corresponding to the MethodID field in the octet data corresponding to the first data packet is a restricted operation; The mapping relationship between specific operations and their types is stored on the cloud server. The second judgment rule includes at least: judging whether the number of times the same field appears in the octet data corresponding to multiple third data packets is greater than a preset number.

6. A vehicle-mounted network range traffic data analysis system based on octet, the system comprising detection equipment, a vehicle-mounted terminal, and a cloud server; wherein, The testing equipment is connected to both the vehicle-mounted terminal and the cloud server. The vehicle terminal includes a vehicle gateway and multiple ECUs; the detection device performs the method as described in any one of claims 1-5.

Images