Method for dynamic adjustment of logical address in vehicle-mounted ethernet

Abstract

This invention discloses a method for dynamically adjusting logical addresses in vehicular Ethernet, belonging to the field of vehicular network security technology. By capturing vehicular network traffic data packets within a preset time period, extracting the octet data of the data packets, and obtaining the feature data of service instances in the vehicular network based on the octet data, the attacked service instances are obtained based on the feature data, and the IP address and port corresponding to the attacked service instances are dynamically adjusted, thereby improving the security of vehicular Ethernet.

Description

Technical Field

[0001] This invention belongs to the field of vehicle network security technology, and particularly relates to a method for dynamically adjusting logical addresses in vehicle Ethernet. Background Technology

[0002] Currently, with the continuous iteration and upgrading of intelligent connected vehicle technology, in-vehicle networks are becoming increasingly complex. However, these more complex in-vehicle networks pose certain challenges to vehicle safety, especially in-vehicle network security.

[0003] In current vehicle networks, calling various service instances based on the SomeIP protocol has become the mainstream solution. However, while encapsulating service functions into service instances to provide functional services to various ECUs in the vehicle makes in-vehicle function calls more convenient and flexible, it also introduces more security risks.

[0004] In the traditional field of vehicle network security, network packet capture tools are often used to extract five-tuple data from vehicle network traffic packets for attack behavior identification and defense scheme formulation. However, traditional five-tuples cannot effectively identify attack behaviors specific to service instances, and attack behavior identification based on five-tuples has significant limitations, resulting in the inability to formulate effective solutions to prevent network attacks.

[0005] Based on the above problems, this paper proposes a method for dynamically adjusting logical addresses in vehicular Ethernet. Summary of the Invention

[0006] To address the above problems, this invention proposes a method for dynamically adjusting logical addresses in vehicular Ethernet, the method specifically including the following steps: S1. During the preset time period Capture in-vehicle network traffic data packets and obtain data packets conforming to the SomeIP protocol from the data packets; S2. Extract the octet data corresponding to the data packet conforming to the SomeIP protocol; the octet data includes: protocol type, source IP address, destination IP address, source port, destination port, logical source address, logical destination address, and timestamp; S3. Based on the octet data, obtain the feature data of the service instance in the vehicle network, input the feature data of the service instance into the trained neural network model, and obtain the output result; If the output includes an attacked service instance, proceed to step S4; otherwise, repeat steps S1 to S3. S4. Dynamically adjust the IP address and port corresponding to the attacked service instance.

[0007] Furthermore, step S2 specifically includes: Extract the ServiceID and MethodID fields from the SomeIP protocol as the logical source address in the octet data, and extract the ClientID and SessionID fields from the first data packet as the logical destination address in the octet data.

[0008] Furthermore, step S3 specifically includes: S31. For all service instances in the vehicular network, initialize the feature data of each service instance: {first feature, second feature, third feature}; The first and second features are the ServiceID and MethodID fields corresponding to the service instance, respectively; the third feature is the service instance within a preset time period. The number of times it appears in the value is initialized to 0. Each combination of the ServiceID and MethodID fields corresponds to a service instance; S32. For all octet data corresponding to all packets conforming to the SomeIP protocol, count the number of times n appears for each logical source address in all octet data, and use this number n as the service instance corresponding to that logical source address within a preset time period. The number of times n appears within the context; modify the third feature in the feature data of the service instance corresponding to the logical source address to n; Each logical source address corresponds to one service instance; S33. Obtain the preset time period Operating scenarios for vehicles inside the vehicle; S34. The vehicle's operating scenario and the feature data corresponding to all service instances are used as the feature data of the service instances in step S3, and input into the neural network model to obtain the output results of the neural network model; Among them, the feature data corresponding to all service instances are sorted according to the preset arrangement order of the service instances; The output of the neural network model includes a first result and a second result; The first result is the combination of the ServiceID and MethodID fields corresponding to the attacked service instance. The second result is: No attacked service instance exists; When the output result is the first result, execute step S4; when the output result is the second result, repeat steps S1 to S3.

[0009] Furthermore, the vehicle's operating scenarios include: stationary and power-off scenario, startup self-test scenario, low-speed driving scenario, high-speed driving scenario, charging status scenario, and OTA upgrade scenario.

[0010] Furthermore, the training process of the neural network model includes: S01. For each operating scenario of the vehicle, obtain the preset time period within that operating scenario. Within the vehicle network traffic data packets conforming to the SomeIP protocol, extract the corresponding octet data of the data packets, and obtain the feature data of the service instances in the vehicle network based on the octet data; use the feature data of the service instances in the vehicle network as positive samples, and use the non-attacked service instances as the labels of the positive samples; S02. For each operating scenario of the vehicle, select different preset time periods. Repeat step S01 to obtain multiple positive samples and the label corresponding to each positive sample; S03. Retrieve an attack behavior and its corresponding service instance from the attack behavior database; For each operating scenario of the vehicle, attack the vehicle according to the attack behavior, and obtain the preset time period in that operating scenario. Within the vehicle network traffic data packets conforming to the SomeIP protocol, extract the corresponding octet data of the data packets, and obtain the feature data of the service instance in the vehicle network based on the octet data; use the feature data of the service instance in the vehicle network as a negative sample, and use the combination of the ServiceID field and the MethodID field corresponding to the service instance of the attack behavior as the label of the negative sample; The attack behavior database stores multiple data entries, with each entry containing an attack behavior and the corresponding service instance. S04. For each attack behavior in the behavior database, repeat step S03 to obtain multiple negative samples and the label corresponding to each negative sample; S05. Select 70% of the positive samples and 70% of the negative samples from the plurality of positive samples and the plurality of negative samples respectively as the training sample set, and select 30% of the positive samples and 30% of the negative samples as the test sample set; S06. Train the neural network model using the training sample set and test the neural network model using the test sample set to obtain the trained neural network model.

[0011] Furthermore, after step S34 in step S3, the following steps are also included: S301. Obtain the occurrence count of each service instance in step S32, and obtain the preset time period in step S33. Operating scenarios for vehicles inside the vehicle; S302. Determine whether the service instance is abnormal based on the number of times it appears and the operating scenario of the vehicle; When an anomaly exists and the output of the neural network model in step S34 is the first result, the service instance with the anomaly is taken as the attacked service instance, the first result in step S34 is replaced, and step S303 is executed. When an anomaly exists and the output of the neural network model in step S34 is the second result, change the output in step S34, treat the service instance with the anomaly as the attacked service instance, and execute step S303. If no anomalies are found, the output of the neural network model obtained in step S34 will not be modified. S303. The feature data of the service instance described in step S3 is used as an abnormal sample. The combination of the ServiceID field and the MethodID field corresponding to the abnormal service instance in step S301 is used as the label of the abnormal sample. The trained neural network model is then trained to obtain the optimized neural network model.

[0012] Further, in step S302, it is determined whether the service instance is abnormal based on the number of times it appears and the operating scenario of the vehicle, specifically including: S3021. Obtain the abnormal behavior data items corresponding to the vehicle's operating scenario from the abnormal behavior check table; The abnormal behavior check table stores multiple data entries, each corresponding to an abnormal behavior data item. The data format of an abnormal behavior data item is: vehicle operating scenario, service instance, and range of frequency of occurrence of the service instance; S3022. For each service instance, if the abnormal behavior data item in step S3021 includes the service instance and the occurrence count of the service instance is not within the range of the occurrence count of the service instance in the abnormal behavior data item that includes the service instance, then the service instance is determined to be abnormal; otherwise, the service instance is determined not to be abnormal, and step S3022 is repeated until a service instance with an abnormality is found, or until all service instances have been traversed.

[0013] Furthermore, step S4 specifically includes the following steps: S41. The attacked service instance sends an address change request to the vehicle gateway, and the vehicle gateway sends the changed IP address and port back to the attacked service instance. The address change request is a request to change the IP address and port of the attacked service instance; S42. Configure the attacked service instance to periodically... Send an address change request to the vehicle gateway; the interval between each address change request sent by the attacked service instance to the vehicle gateway. During the time period [ Random value selection; S43. The attacked service instance associates the ServiceID and MethodID fields corresponding to the service instance with the changed IP address and port, and broadcasts the changed IP address and port.

[0014] Furthermore, step S43 is followed by: S431. The attacked service instance is at time After the broadcast is completed, within the preset time period to The system captures vehicular network traffic data packets conforming to the SomeIP protocol, extracts the corresponding octet data of the data packets, and obtains the feature data of service instances in the vehicular network based on the octet data; the feature data is then input into a neural network model to obtain the output result. in, ; If the output includes an attacked service instance, and the attacked service instance is the same as the attacked service instance described in step S41, then step S432 is executed; otherwise, the attacked service instance is executed according to the interval set in step S42. Send an address change request to the vehicle gateway; S432. When the attacked service instance supports dynamic scaling, add a new service instance; wherein the ServiceID and MethodID fields of the new service instance are the same as those of the attacked service instance, and the IP address and port of the new service instance are different from those of the attacked service instance; when the attacked service instance does not support dynamic scaling, report the attacked service instance to the cloud server. S433. Assign weight values ​​to attacked service instances and newly added service instances. , And configure newly added service instances to be added every time. Send an address change request to the vehicle gateway; the interval between each address change request sent by a newly added service instance to the vehicle gateway. During the time period [ Randomly selected values; where, ; .

[0015] Furthermore, when the network load of a newly added service instance exceeds a preset threshold... When, decrease And increase ; When the network load corresponding to the attacked service instance exceeds a preset threshold When, decrease And increase .

[0016] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above description and other objects, features and advantages of the present invention more obvious and understandable, preferred embodiments are provided and described in detail below. Attached Figure Description

[0017] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings.

[0018] Figure 1 This is a flowchart of a method for dynamically adjusting logical addresses in an in-vehicle Ethernet network. Detailed Implementation

[0019] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0020] In the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," "fixing," etc., should be interpreted broadly. For example, they can refer to a connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0021] Figure 1 This is a flowchart illustrating a method for dynamically adjusting logical addresses in an in-vehicle Ethernet system. For example... Figure 1 As shown, the method includes the following steps: S1. During the preset time period Capture in-vehicle network traffic data packets and obtain data packets conforming to the SomeIP protocol from the data packets; Among them, the vehicle network traffic data packets captured within the preset time period T are any vehicle network traffic data packets captured within the time interval T.

[0022] S2. Extract the octet data corresponding to the data packet conforming to the SomeIP protocol; the octet data includes: protocol type, source IP address, destination IP address, source port, destination port, logical source address, logical destination address, and timestamp; S3. Based on the octet data, obtain the feature data of the service instance in the vehicle network, input the feature data of the service instance into the trained neural network model, and obtain the output result; If the output includes an attacked service instance, proceed to step S4; otherwise, repeat steps S1 to S3. S4. Dynamically adjust the IP address and port corresponding to the attacked service instance.

[0023] Furthermore, step S2 specifically includes: Extract the ServiceID and MethodID fields from the SomeIP protocol as the logical source address in the octet data, and extract the ClientID and SessionID fields from the first data packet as the logical destination address in the octet data.

[0024] Furthermore, step S3 specifically includes: S31. For all service instances in the vehicular network, initialize the feature data of each service instance: {first feature, second feature, third feature}; The first and second features are the ServiceID and MethodID fields corresponding to the service instance, respectively; the third feature is the service instance within a preset time period. The number of times it appears in the value is initialized to 0. Each combination of the ServiceID and MethodID fields corresponds to a service instance; S32. For all octet data corresponding to all packets conforming to the SomeIP protocol, count the number of times n appears for each logical source address in all octet data, and use this number n as the service instance corresponding to that logical source address within a preset time period. The number of times n appears within the context; modify the third feature in the feature data of the service instance corresponding to the logical source address to n; Each logical source address corresponds to one service instance; A service instance is the basic unit in an in-vehicle system, and each service instance represents a specific functional service within that system. The combination of the ServiceID and MethodID fields in the SomeIP protocol serves as a logical address, corresponding to a unique service instance. In other words, each service instance can uniquely correspond to a single combination of the ServiceID and MethodID fields, i.e., a unique logical address. However, the IP address and port of each service instance are not fixed; that is, the mapping between the logical address, IP address, and port of a service instance is not static.

[0025] S33. Obtain the preset time period Operating scenarios for vehicles inside the vehicle; S34. The vehicle's operating scenario and the feature data corresponding to all service instances are used as the feature data of the service instances in step S3, and input into the neural network model to obtain the output results of the neural network model; Among them, the feature data corresponding to all service instances are sorted according to the preset arrangement order of the service instances; The output of the neural network model includes a first result and a second result; The first result is the combination of the ServiceID and MethodID fields corresponding to the attacked service instance. The second result is: No attacked service instance exists; When the output result is the first result, execute step S4; when the output result is the second result, repeat steps S1 to S3.

[0026] Furthermore, the vehicle's operating scenarios include: stationary and power-off scenario, startup self-test scenario, low-speed driving scenario, high-speed driving scenario, charging status scenario, and OTA upgrade scenario.

[0027] For example, in a stationary, unpowered scenario, some ECUs may be operating in a low-power state, which could lead to abnormal vehicle startup if an attack is launched against the service instance.

[0028] Furthermore, the training process of the neural network model includes: S01. For each operating scenario of the vehicle, obtain the preset time period within that operating scenario. Within the vehicle network traffic data packets conforming to the SomeIP protocol, extract the corresponding octet data of the data packets, and obtain the feature data of the service instances in the vehicle network based on the octet data; use the feature data of the service instances in the vehicle network as positive samples, and use the non-attacked service instances as the labels of the positive samples; S02. For each operating scenario of the vehicle, select different preset time periods. Repeat step S01 to obtain multiple positive samples and the label corresponding to each positive sample; S03. Retrieve an attack behavior and its corresponding service instance from the attack behavior database; For each operating scenario of the vehicle, attack the vehicle according to the attack behavior, and obtain the preset time period in that operating scenario. Within the vehicle network traffic data packets conforming to the SomeIP protocol, extract the corresponding octet data of the data packets, and obtain the feature data of the service instance in the vehicle network based on the octet data; use the feature data of the service instance in the vehicle network as a negative sample, and use the combination of the ServiceID field and the MethodID field corresponding to the service instance of the attack behavior as the label of the negative sample; The attack behavior database stores multiple data entries, with each entry containing an attack behavior and the corresponding service instance. S04. For each attack behavior in the behavior database, repeat step S03 to obtain multiple negative samples and the label corresponding to each negative sample; S05. Select 70% of the positive samples and 70% of the negative samples from the plurality of positive samples and the plurality of negative samples respectively as the training sample set, and select 30% of the positive samples and 30% of the negative samples as the test sample set; S06. Train the neural network model using the training sample set and test the neural network model using the test sample set to obtain the trained neural network model.

[0029] The training methods for neural networks and the iterative methods based on loss functions adopt conventional approaches, and this paper does not impose specific limitations.

[0030] Furthermore, after step S34 in step S3, the following steps are also included: S301. Obtain the occurrence count of each service instance in step S32, and obtain the preset time period in step S33. Operating scenarios for vehicles inside the vehicle; S302. Determine whether the service instance is abnormal based on the number of times it appears and the operating scenario of the vehicle; When an anomaly exists and the output of the neural network model in step S34 is the first result, the service instance with the anomaly is taken as the attacked service instance, the first result in step S34 is replaced, and step S303 is executed. When an anomaly exists and the output of the neural network model in step S34 is the second result, change the output in step S34, treat the service instance with the anomaly as the attacked service instance, and execute step S303. If no anomalies are found, the output of the neural network model obtained in step S34 will not be modified. S303. The feature data of the service instance described in step S3 is used as an abnormal sample. The combination of the ServiceID field and the MethodID field corresponding to the abnormal service instance in step S301 is used as the label of the abnormal sample. The trained neural network model is then trained to obtain the optimized neural network model.

[0031] Further, in step S302, it is determined whether the service instance is abnormal based on the number of times it appears and the operating scenario of the vehicle, specifically including: S3021. Obtain the abnormal behavior data items corresponding to the vehicle's operating scenario from the abnormal behavior check table; The abnormal behavior check table stores multiple data entries, each corresponding to an abnormal behavior data item. The data format of an abnormal behavior data item is: vehicle operating scenario, service instance, and range of frequency of occurrence of the service instance; S3022. For each service instance, if the abnormal behavior data item in step S3021 includes the service instance and the occurrence count of the service instance is not within the range of the occurrence count of the service instance in the abnormal behavior data item that includes the service instance, then the service instance is determined to be abnormal; otherwise, the service instance is determined not to be abnormal, and step S3022 is repeated until a service instance with an abnormality is found, or until all service instances have been traversed.

[0032] Furthermore, step S4 specifically includes the following steps: S41. The attacked service instance sends an address change request to the vehicle gateway, and the vehicle gateway sends the changed IP address and port back to the attacked service instance. The address change request is a request to change the IP address and port of the attacked service instance; S42. Configure the attacked service instance to periodically... Send an address change request to the vehicle gateway; the interval between each address change request sent by the attacked service instance to the vehicle gateway. During the time period [ Random value selection; S43. The attacked service instance associates the ServiceID and MethodID fields corresponding to the service instance with the changed IP address and port, and broadcasts the changed IP address and port.

[0033] Furthermore, step S43 is followed by: S431. The attacked service instance is at time After the broadcast is completed, within the preset time period to The system captures vehicular network traffic data packets conforming to the SomeIP protocol, extracts the corresponding octet data of the data packets, and obtains the feature data of service instances in the vehicular network based on the octet data; the feature data is then input into a neural network model to obtain the output result. in, ; If the output includes an attacked service instance, and the attacked service instance is the same as the attacked service instance described in step S41, then step S432 is executed; otherwise, the attacked service instance is executed according to the interval set in step S42. Send an address change request to the vehicle gateway; S432. When the attacked service instance supports dynamic scaling, add a new service instance; wherein the ServiceID and MethodID fields of the new service instance are the same as those of the attacked service instance, and the IP address and port of the new service instance are different from those of the attacked service instance; when the attacked service instance does not support dynamic scaling, report the attacked service instance to the cloud server. S433. Assign weight values ​​to attacked service instances and newly added service instances. , And configure newly added service instances to be added every time. Send an address change request to the vehicle gateway; the interval between each address change request sent by a newly added service instance to the vehicle gateway. During the time period [ Randomly selected values; where, ; .

[0034] Furthermore, when the network load of a newly added service instance exceeds a preset threshold... When, decrease And increase ; When the network load corresponding to the attacked service instance exceeds a preset threshold When, decrease And increase .

[0035] The beneficial effects of this invention are as follows: (1) This invention uses octet data to extract data from packets conforming to the SomeIP protocol and extracts features based on the octet data, so that it can identify service instance-based attack behavior without increasing the consumption of more computing resources, thereby improving the accuracy of identifying in-vehicle network attack behavior and providing accurate data support for the formulation of in-vehicle network security defense measures.

[0036] (2) The present invention uses octet data to identify attack behavior based on service instance. After obtaining the attacked service instance, the correspondence between the logical source address (ServiceID and MethodID) of the service instance and the IP address and port is dynamically adjusted, which increases the complexity of the attack on the vehicle network and reduces the risk of the vehicle network being attacked.

[0037] (3) This invention dynamically adjusts the address change request time interval for the attacked service instance, and adds a new service instance for the case where the attack still occurs after the address change. By adjusting the weight values ​​of the attacked service instance and the new service instance, as well as the address change request time interval of the new service instance, the risk of the vehicle network being attacked is greatly reduced. At the same time, the application of multiple service instances prompts the activation of the risk response mechanism in the load balancing of the vehicle gateway, further improving the anti-attack capability of the vehicle network.

[0038] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for dynamically adjusting logical addresses in an in-vehicle Ethernet network, characterized in that, The method includes the following steps: S1. During the preset time period Capture in-vehicle network traffic data packets and obtain data packets conforming to the SomeIP protocol from the data packets; S2. Extract the octet data corresponding to the data packet conforming to the SomeIP protocol; The octet data includes: protocol type, source IP address, destination IP address, source port, destination port, logical source address, logical destination address, and timestamp; S3. Based on the octet data, obtain the feature data of the service instance in the vehicle network, input the feature data of the service instance into the trained neural network model, and obtain the output result; If the output includes an attacked service instance, proceed to step S4; otherwise, repeat steps S1 to S3. S4. Dynamically adjust the IP address and port corresponding to the attacked service instance.

2. The method for dynamically adjusting logical addresses in an in-vehicle Ethernet network according to claim 1, characterized in that, Step S2 specifically includes: Extract the ServiceID and MethodID fields from the SomeIP protocol as the logical source address in the octet data, and extract the ClientID and SessionID fields from the first data packet as the logical destination address in the octet data.

3. The method for dynamically adjusting logical addresses in an in-vehicle Ethernet network according to claim 2, characterized in that, Step S3 specifically includes: S31. For all service instances in the vehicular network, initialize the feature data of each service instance: {first feature, second feature, third feature}; The first and second features are the ServiceID and MethodID fields corresponding to the service instance, respectively; the third feature is the service instance within a preset time period. The number of times it appears in the value is initialized to 0. Each combination of the ServiceID and MethodID fields corresponds to a service instance; S32. For all octet data corresponding to all packets conforming to the SomeIP protocol, count the number of times n appears for each logical source address in all octet data, and use this number n as the service instance corresponding to that logical source address within a preset time period. The number of times n appears within the context; modify the third feature in the feature data of the service instance corresponding to the logical source address to n; Each logical source address corresponds to one service instance; S33. Obtain the preset time period Operating scenarios for vehicles inside the vehicle; S34. The vehicle's operating scenario and the feature data corresponding to all service instances are used as the feature data of the service instances in step S3, and input into the neural network model to obtain the output results of the neural network model; Among them, the feature data corresponding to all service instances are sorted according to the preset arrangement order of the service instances; The output of the neural network model includes a first result and a second result; The first result is the combination of the ServiceID and MethodID fields corresponding to the attacked service instance. The second result is: No attacked service instance exists; When the output result is the first result, execute step S4; when the output result is the second result, repeat steps S1 to S3.

4. The method for dynamically adjusting logical addresses in an in-vehicle Ethernet network according to claim 3, characterized in that: The vehicle's operating scenarios include: stationary and not powered on scenario, startup self-test scenario, low-speed driving scenario, high-speed driving scenario, charging scenario, and OTA upgrade scenario.

5. The method for dynamically adjusting logical addresses in an in-vehicle Ethernet network according to claim 3, characterized in that, Following step S34 in step S3, the following steps are also included: S301. Obtain the occurrence count of each service instance in step S32, and obtain the preset time period in step S33. Operating scenarios for vehicles inside the vehicle; S302. Determine whether the service instance is abnormal based on the number of times it appears and the operating scenario of the vehicle; When an anomaly exists and the output of the neural network model in step S34 is the first result, the service instance with the anomaly is taken as the attacked service instance, the first result in step S34 is replaced, and step S303 is executed. When an anomaly exists and the output of the neural network model in step S34 is the second result, change the output in step S34, treat the service instance with the anomaly as the attacked service instance, and execute step S303. If no anomalies are found, the output of the neural network model obtained in step S34 will not be modified. S303. The feature data of the service instance described in step S3 is used as an abnormal sample. The combination of the ServiceID field and the MethodID field corresponding to the abnormal service instance in step S301 is used as the label of the abnormal sample. The trained neural network model is then trained to obtain the optimized neural network model.

6. The method for dynamically adjusting logical addresses in an in-vehicle Ethernet network according to claim 5, characterized in that, In step S302, it is determined whether the service instance is abnormal based on the number of times the service instance appears and the operating scenario of the vehicle. Specifically, this includes: S3021. Obtain the abnormal behavior data items corresponding to the vehicle's operating scenario from the abnormal behavior check table; The abnormal behavior check table stores multiple data entries, each corresponding to an abnormal behavior data item. The data format of an abnormal behavior data item is: vehicle operating scenario, service instance, and range of frequency of occurrence of the service instance; S3022. For each service instance, if the abnormal behavior data item in step S3021 includes the service instance and the occurrence count of the service instance is not within the range of the occurrence count of the service instance in the abnormal behavior data item that includes the service instance, then the service instance is determined to be abnormal; otherwise, the service instance is determined not to be abnormal, and step S3022 is repeated until a service instance with an abnormality is found, or until all service instances have been traversed.

7. The method for dynamically adjusting logical addresses in an in-vehicle Ethernet network according to claim 2, characterized in that, Step S4 specifically includes the following steps: S41. The attacked service instance sends an address change request to the vehicle gateway, and the vehicle gateway sends the changed IP address and port back to the attacked service instance. The address change request is a request to change the IP address and port of the attacked service instance; S42. Configure the attacked service instance to periodically... Send an address change request to the vehicle gateway; the interval between each address change request sent by the attacked service instance to the vehicle gateway. During the time period [ Random value selection; S43. The attacked service instance associates the ServiceID and MethodID fields corresponding to the service instance with the changed IP address and port, and broadcasts the changed IP address and port.

8. The method for dynamically adjusting logical addresses in an in-vehicle Ethernet according to claim 7, characterized in that, Step S43 is followed by: S431. The attacked service instance is at time After the broadcast is completed, within the preset time period to The system captures vehicular network traffic data packets conforming to the SomeIP protocol, extracts the corresponding octet data of the data packets, and obtains the feature data of service instances in the vehicular network based on the octet data; the feature data is then input into a neural network model to obtain the output result. in, ; If the output includes an attacked service instance, and the attacked service instance is the same as the attacked service instance described in step S41, then step S432 is executed; otherwise, the attacked service instance is executed according to the interval set in step S42. Send an address change request to the vehicle gateway; S432. When the attacked service instance supports dynamic scaling, add a new service instance; wherein the ServiceID and MethodID fields of the new service instance are the same as those of the attacked service instance, and the IP address and port of the new service instance are different from those of the attacked service instance; when the attacked service instance does not support dynamic scaling, report the attacked service instance to the cloud server. S433. Assign weight values ​​to attacked service instances and newly added service instances. , And configure newly added service instances to be added every time. Send an address change request to the vehicle gateway; the interval between each address change request sent by a newly added service instance to the vehicle gateway. During the time period [ Randomly selected values; where, ; .

9. The method for dynamically adjusting logical addresses in an in-vehicle Ethernet according to claim 8, characterized in that: When the network load of a newly added service instance exceeds a preset threshold When, decrease And increase ; When the network load corresponding to the attacked service instance exceeds a preset threshold When, decrease And increase .

Images