A distributed vehicle-mounted network security event detection system and a detection method thereof

Abstract

The application discloses a kind of distributed vehicle-mounted network security event detection systems, including distributed security detection probe module, cross-node cooperative detection engine module, event classification and response decision module, strategy unified arrangement and dynamic configuration module and security event storage and reporting module.The application also discloses the detection method of the detection system.The above technical scheme is used, and the security event detection accuracy and comprehensiveness under complex attack scene can be significantly improved;Enhance the timeliness, pertinence and effectiveness of security event response;Greatly reduce the workload of strategy adaptation and operation and maintenance, improve the adaptability and scalability of detection system;Build a complete distributed security event detection closed loop, provide all-round, multi-level monitoring support for vehicle network security, help to meet the technical requirements of relevant regulations, standards for vehicle-mounted network security event detection.

Description

Technical Field

[0001] This invention belongs to the field of security technology for intelligent connected vehicles, and relates to a distributed in-vehicle network security event detection system and a detection method applied to the detection system. Background Technology

[0002] With the continuous improvement of vehicle intelligence and connectivity, the in-vehicle electronic and electrical architecture is moving from closed to open, and the number of external connection interfaces of vehicles is increasing. As a result, the security threats faced by in-vehicle networks are intensifying. Attack methods such as CAN bus message tampering, malicious injection of ECU firmware, in-vehicle Ethernet DDoS attacks, and remote OTA hijacking are emerging one after another. In-vehicle network security incident detection has become a key link in ensuring vehicle driving safety and data security.

[0003] Intrusion Detection and Prevention Systems (IDPS), as a core component of in-vehicle network security protection systems, identify abnormal activities and potential attacks by collecting and analyzing in-vehicle network traffic and system behavior in real time, and take corresponding defensive measures. They have become a widely adopted security protection method in the industry.

[0004] At the industrial application level, major domestic and foreign automakers and security vendors have gradually promoted the mass production and implementation of in-vehicle IDPS. Some high-end models have adopted a layered IDPS architecture, which distributes detection capabilities across gateways and critical domain controllers to achieve millisecond-level attack response. At the same time, the introduction of regulations and standards such as UNR155 and ISO / SAE21434 has also put forward clear requirements for in-vehicle network security incident detection capabilities, promoting the development of IDPS technology towards standardization and systematization.

[0005] Overall, in-vehicle IDPS technology is continuously evolving from single detection to multi-dimensional collaborative detection, from rule-driven to intelligent-driven, and from independent vehicle-side protection to integrated vehicle-cloud protection.

[0006] Deficiencies of existing technology:

[0007] Although existing distributed vehicle intrusion detection technologies have certain security event monitoring capabilities, they still have the following shortcomings in practical engineering applications:

[0008] First, existing distributed solutions mostly adopt a mode of independent detection by each node and centralized aggregation and reporting, lacking an effective collaborative detection and correlation analysis mechanism between nodes. This makes it difficult to accurately identify complex attack behaviors that cross buses and nodes, resulting in detection blind spots.

[0009] Second, existing distributed IDS does not fully consider the differences in computing and storage resources of different ECU nodes in the vehicle network. The detection algorithms and strategies adopt a unified deployment method, which easily leads to high detection latency and large resource consumption on low-end ECUs with limited resources. On the other hand, it fails to give full play to the performance advantages of nodes such as domain controllers with sufficient computing power, resulting in poor resource adaptability.

[0010] Third, the existing solutions are insufficient in their ability to classify and handle security incidents. They mostly only collect and report incidents, lack a refined classification and assessment mechanism based on the severity and scope of the incident, and are also difficult to trigger distributed collaborative response and handling based on the incident level. The timeliness and pertinence of the incident response need to be improved.

[0011] Fourth, the detection strategies of existing distributed IDS are mostly statically pre-configured, lacking flexible dynamic configuration and unified orchestration capabilities. When facing vehicle network environments with different vehicle models and different electronic and electrical architectures, the workload of strategy adaptation and operation and maintenance adjustment is large, and the scalability and adaptability need to be further improved.

[0012] Using keywords such as "vehicle-mounted; network; security; testing", a search was conducted on existing publicly available technical documents, yielding the following results:

[0013] 1. Chinese Patent Document: "A Device and Method for Improving the Network Security of an In-Vehicle Instrument Panel System", Patent (Application) No.: 202410936539.1; The technical solution described therein is:

[0014] "A device that can improve the network security of an in-vehicle instrument panel system includes an in-vehicle instrument panel system, a computer, a programmer, a server, and an automotive diagnostic device. The input terminals of the in-vehicle instrument panel system are connected to the output terminals of the computer, the programmer, the server, and the automotive diagnostic device, respectively. The secure boot setting verifies the target program in the in-vehicle instrument panel system through an encryption algorithm. In the access permission setting, the in-vehicle instrument panel system burns a software package with secure encryption function to restrict external access. In the secure flashing setting, the in-vehicle instrument panel system checks the integrity of the upgrade software. If it is confirmed to be complete, the upgrade software is flashed; if it is incomplete, the upgrade program is not flashed. In the secure diagnostic setting, the in-vehicle instrument panel system authenticates the automotive diagnostic device. Diagnostic communication can only be performed when the authentication is successful."

[0015] The technical effects described are:

[0016] "Improve network security."

[0017] 2. Chinese patent document: "A Multimodal Fusion Anomaly Detection Method and System for Intelligent Connected Vehicles", Patent (Application) No.: 202610477098.2; the technical solution described therein is:

[0018] "The multimodal fusion anomaly detection method for intelligent connected vehicles includes: collecting raw data from the vehicle network and cleaning and standardizing it to obtain standardized network data and vehicle status data; then performing cross-domain perception processing on the network data to extract cross-domain perception features, and performing state recognition on the vehicle status data to extract vehicle status features; subsequently fusing the two types of features to obtain multimodal fusion features, and sequentially carrying out network layer, service layer, and state layer detection; finally, based on the detection results, determining the root cause information of the anomaly by relying on the multimodal fusion features when judging anomalies."

[0019] The technical effects described are:

[0020] "It has achieved cross-domain perception of vehicle networks and accurate identification of vehicle status. Through multi-modal feature fusion and multi-level detection, it has improved the coverage and accuracy of anomaly detection, and can accurately locate the root cause of anomalies. It is suitable for full-condition vehicle network security detection of intelligent connected vehicles."

[0021] However, the technical solutions described in the aforementioned technical documents, as well as the relevant technical solutions currently in public application, have not been able to solve the problems and defects in the existing technology, such as "difficulty in achieving accurate identification and the existence of detection blind spots", "poor resource adaptability", "insufficient ability to grade and process security incidents", and "low scalability and adaptability". Summary of the Invention

[0022] This invention provides a distributed vehicle network security incident detection system, the purpose of which is to improve the accuracy and comprehensiveness of security incident detection in complex attack scenarios.

[0023] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0024] The distributed vehicle network security event detection system of the present invention is applied to the vehicle electronic and electrical architecture, which includes ECU, vehicle central gateway or core domain controller; the detection system includes a distributed security detection probe module, a cross-node collaborative detection engine module, an event classification and response decision module, a policy unified orchestration and dynamic configuration module, and a security event storage and reporting module.

[0025] The distributed safety detection probe module is deployed in each ECU node of the vehicle network (including domain controllers such as power domain, chassis domain, body domain, intelligent driving domain and each sub-node ECU). Each distributed safety detection probe module includes a message acquisition unit, a local detection unit and an event reporting unit. Each probe is connected to the vehicle network through the bus interface of its ECU and interacts with the collaborative detection engine module through the vehicle bus.

[0026] The cross-node collaborative detection engine module is deployed on the vehicle central gateway or core domain controller; the cross-node collaborative detection engine module includes an event receiving unit, a correlation analysis unit, a collaborative detection unit, and a result output unit; the cross-node collaborative detection engine module is connected to each distributed security detection probe module through the vehicle bus and receives the raw security event data reported by each probe.

[0027] The event classification and response decision module is deployed on a gateway or domain controller; the event classification and response decision module includes an event classification evaluation unit, a response strategy matching unit, and an instruction issuing unit; the event classification and response decision module is connected to the cross-node collaborative detection engine module and receives detection result data.

[0028] The unified policy orchestration and dynamic configuration module is deployed in the vehicle's central computing unit or gateway; the unified policy orchestration and dynamic configuration module includes a policy management unit, a resource awareness unit, a policy distribution unit, and a configuration update unit; the unified policy orchestration and dynamic configuration module is connected to each distributed security detection probe, collaborative detection engine, and event hierarchical response module through the vehicle network to realize unified management and dynamic distribution of detection policies.

[0029] The security event storage and reporting module is deployed in the vehicle's infotainment system or T-BOX and includes a local storage unit, a data formatting unit, and a cloud reporting unit. The security event storage and reporting module is connected to the cross-node collaborative detection engine module and the event classification and response decision module to receive security event data. At the same time, it is connected to the cloud security management platform through the vehicle wireless communication unit to realize the cloud reporting of event data.

[0030] To achieve the same inventive objective as the aforementioned technical solutions, this invention also provides a detection method for the distributed vehicle network security incident detection system described above. This detection method involves the following stages:

[0031] 1) Differentiated detection deployment phase;

[0032] 2) Distributed data acquisition and local detection stage;

[0033] 3) Cross-node collaborative detection phase;

[0034] 4) Event classification and distributed response phase;

[0035] 5) Event storage and reporting stage;

[0036] 6) Strategy dynamic update phase.

[0037] Specifically:

[0038] In the differentiated detection deployment phase, the policy unified orchestration and dynamic configuration module first collects the computing resources (CPU computing power, memory capacity, and storage space) of each ECU node in the vehicle network through the resource awareness unit. Based on the different resource capabilities of each node, it matches the detection algorithm and policy configuration with corresponding granularity. For domain controller nodes with sufficient computing power, a deep detection algorithm including a machine learning model is configured; for low-end ECU nodes with limited resources, a lightweight detection algorithm based on rules and features is configured. After the configuration is completed, the policy distribution unit distributes the differentiated detection policies to each distributed security detection probe.

[0039] During the distributed data acquisition and local detection phase, the message acquisition unit of each distributed security detection probe collects bus message data, system operation status data, and interface access log data of the ECU node in real time. The local detection unit performs local analysis on the collected data according to the issued detection strategy and adopts a detection algorithm that matches the resource capabilities of the node, identifies local abnormal behavior and generates preliminary security events, and reports the event data to the cross-node collaborative detection engine module through the event reporting unit.

[0040] In the cross-node collaborative detection phase, the event receiving unit of the cross-node collaborative detection engine module collects security event data reported by each probe; the correlation analysis unit performs time correlation, spatial correlation, and logical correlation analysis on security events from different nodes and different buses based on preset attack scenario rules and multi-dimensional correlation algorithms; the collaborative detection unit combines multi-node event data for comprehensive judgment, identifies complex attack behaviors across buses and nodes, generates the final security event detection results, and outputs them to the event classification and response decision module.

[0041] In the event classification and distributed response phase, the event classification and response decision module's event classification assessment unit classifies events into different levels (such as alert level, warning level, severe level, and emergency level) based on dimensions such as attack type, scope of impact, and severity. The response strategy matching unit matches the corresponding response and handling strategy according to the event level. The instruction issuing unit distributes the response instructions to the security execution units of relevant nodes to trigger corresponding protection and handling measures. The protection and handling measures include message filtering, access restriction, communication blocking, and alarm notification.

[0042] During the event storage and reporting phase, the local storage unit of the security event storage and reporting module persistently stores the detected security events and response records locally; the data formatting unit formats the event data according to the standard format; and the cloud reporting unit reports the security event data to the cloud security management platform through the vehicle wireless communication unit, supporting further analysis and threat intelligence sharing in the cloud.

[0043] During the dynamic policy update phase, the policy unified orchestration and dynamic configuration module can update and adjust the detection policy through the policy management unit based on threat intelligence, vehicle configuration changes, or operation and maintenance needs issued from the cloud, and dynamically issue the updated policy to relevant modules through the policy issuance unit, thereby realizing online iteration and adaptive adjustment of detection capabilities.

[0044] Compared with the prior art, the above-mentioned technical solution of the present invention achieves the following beneficial technical effects: it can significantly improve the accuracy and comprehensiveness of security event detection in complex attack scenarios; it can achieve precise matching between detection capabilities and node resources, improve the overall resource utilization efficiency of the detection system, and achieve a balance between detection effect and operating efficiency; it can enhance the timeliness, pertinence, and effectiveness of security event response; it can significantly reduce the workload of policy adaptation and maintenance, and improve the adaptability and scalability of the detection system; it can construct a complete distributed security event detection closed loop, providing comprehensive and multi-level monitoring support for vehicle network security, and helping to meet the technical requirements of relevant regulations and standards for vehicle network security event detection. Attached Figure Description

[0045] Figure 1 This is a system architecture diagram of the present invention; Detailed Implementation

[0046] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings, so as to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention.

[0047] like Figure 1 The technical solution of this invention is a distributed in-vehicle network security event detection system, applied to an in-vehicle electronic and electrical architecture, which includes an ECU, an in-vehicle central gateway, or a core domain controller. The application scenarios of this invention include the application of the aforementioned distributed in-vehicle network security event detection system in multi-protocol heterogeneous in-vehicle network environments such as CAN, CAN FD, and in-vehicle Ethernet, as well as its application in vehicles with different electronic and electrical architectures such as domain-centralized and centrally computed systems.

[0048] To address the problems and shortcomings of existing technologies and achieve the goal of improving the accuracy and comprehensiveness of security event detection in complex attack scenarios, this invention adopts a system composition and component connection relationship; the system of this invention mainly consists of the following functional components:

[0049] like Figure 1As shown, the distributed vehicle network security event detection system of the present invention includes a distributed security detection probe module, a cross-node collaborative detection engine module, an event classification and response decision module, a policy unified orchestration and dynamic configuration module, and a security event storage and reporting module.

[0050] Overview of the technical solution of this invention: The distributed vehicle network security event detection system of this invention adopts a technical architecture of "distributed collection - collaborative detection - hierarchical response - unified orchestration". By deploying security probes with differentiated detection capabilities at each node of the vehicle network, and combining a cross-node collaborative detection engine, an event hierarchical response decision module and a unified strategy orchestration module, it achieves accurate, efficient and adaptive detection and response to vehicle network security events.

[0051] The key technical point of this invention lies in proposing a distributed vehicle network security event detection technology solution that combines "resource-aware differentiated deployment + cross-node collaborative detection + hierarchical distributed response + unified policy orchestration". Its core innovation is the system architecture, which is a distributed vehicle network security event detection system architecture composed of a distributed security detection probe module, a cross-node collaborative detection engine module, an event classification and response decision module, a unified policy orchestration and dynamic configuration module, and a security event storage and reporting module, as well as the connection relationships and data interaction methods between the modules.

[0052] The specific details of the above-mentioned technical architecture of the present invention are as follows:

[0053] 1. The distributed safety detection probe module is deployed in each ECU node of the vehicle network (including domain controllers and sub-node ECUs such as power domain, chassis domain, body domain, and intelligent driving domain). Each distributed safety detection probe module includes a message acquisition unit, a local detection unit, and an event reporting unit. Each probe is connected to the vehicle network (CAN / CAN FD / LIN / Ethernet, etc.) through the bus interface of its ECU and interacts with the collaborative detection engine module through the vehicle bus.

[0054] The key to its technical solution is the differentiated detection deployment technology based on resource awareness: by sensing the computing resource capabilities of each ECU node in the vehicle network, it matches detection algorithms and strategies of corresponding granularity to different nodes, thereby achieving precise adaptation between detection capabilities and node resources and solving the problem of low resource utilization efficiency in the traditional distributed IDS unified deployment mode.

[0055] 2. The cross-node collaborative detection engine module is deployed on the vehicle central gateway or core domain controller; the cross-node collaborative detection engine module includes an event receiving unit, a correlation analysis unit, a collaborative detection unit, and a result output unit; the cross-node collaborative detection engine module is connected to each distributed security detection probe module through the vehicle bus to receive the raw data of security events reported by each probe; at the same time, it is connected to the event classification and response decision module and the policy unified orchestration module through the vehicle Ethernet.

[0056] To address the shortcomings of existing technologies, such as the lack of collaborative detection between nodes and the difficulty in identifying complex cross-node attacks, this invention sets up a cross-node collaborative detection engine module and uses a multi-dimensional correlation analysis algorithm to perform temporal, spatial, and logical correlations on security events from different nodes and buses. This improves upon the previous single-point independent detection to multi-point collaborative detection, effectively identifying complex cross-bus and cross-node attack behaviors, eliminating detection blind spots, and improving detection accuracy in complex attack scenarios.

[0057] The key to its technical solution is multi-dimensional cross-node collaborative detection technology: through multi-dimensional correlation analysis algorithms such as time correlation, spatial correlation, and logical correlation, security events from different nodes and different buses are collaboratively analyzed to achieve accurate identification of complex cross-bus and cross-node attacks, breaking through the limitations of single-point independent detection.

[0058] 3. The event classification and response decision module is deployed on the gateway or domain controller; the event classification and response decision module includes an event classification evaluation unit, a response policy matching unit, and an instruction issuing unit; the event classification and response decision module is connected to the cross-node collaborative detection engine module to receive detection result data; at the same time, it is connected to various security execution units (such as firewalls, access control modules, bus filtering modules, etc.) in the vehicle network to issue response and handling instructions.

[0059] To address the shortcomings of existing technologies in terms of insufficient event classification and processing capabilities and weak response targeting, this invention establishes an event classification and response decision module. Based on multiple dimensions such as attack type, scope of impact, and severity, it performs refined classification of security events and matches corresponding distributed response and handling strategies. This enables classified assessment and differentiated response of security events, improves the timeliness and targeting of event response, and avoids the problems of insufficient or excessive response.

[0060] The key to its technical solution is multi-dimensional event classification and distributed response technology: security events are classified in a refined manner based on multiple dimensions such as attack type, scope of impact, and severity, and differentiated distributed response and handling strategies are triggered according to the event level to achieve graded assessment and precise response of security events.

[0061] 4. The unified policy orchestration and dynamic configuration module is deployed in the vehicle central computing unit or gateway; the unified policy orchestration and dynamic configuration module includes a policy management unit, a resource awareness unit, a policy distribution unit, and a configuration update unit; the unified policy orchestration and dynamic configuration module is connected to external configuration tools through the vehicle diagnostic interface or vehicle Ethernet, and is also connected to various distributed security detection probes, collaborative detection engines, and event hierarchical response modules through the vehicle network to realize unified management and dynamic distribution of detection policies.

[0062] To address the shortcomings of existing technologies, such as static pre-setting of detection strategies, poor adaptability, and insufficient operational flexibility, this invention utilizes a resource awareness unit within a unified strategy orchestration and dynamic configuration module to acquire resource capability information for each ECU node. This enables centralized management and dynamic distribution of detection strategies, supporting online updates of detection strategies based on threat intelligence, vehicle configuration changes, or operational needs. Differentiated detection algorithms and strategies are matched to different nodes, achieving precise adaptation between detection capabilities and node resources. This ensures real-time detection and low resource consumption for resource-constrained nodes while fully leveraging the performance advantages of high-computing-power nodes. This significantly improves the system's adaptability to different vehicle models and electronic / electrical architectures, reduces the workload of strategy maintenance, and overall enhances the resource utilization and operational efficiency of the distributed detection system, while also improving its scalability and adaptability.

[0063] The key to the unified orchestration and dynamic configuration technology of detection strategies is to support online updates and adaptive adjustments of detection strategies through a centralized strategy management and dynamic distribution mechanism, thereby improving the system's adaptability to different vehicle models and architectures and its operational flexibility.

[0064] 5. The security event storage and reporting module is deployed on the gateway or T-BOX and includes a local storage unit, a data formatting unit, and a cloud reporting unit. The security event storage and reporting module is connected to the cross-node collaborative detection engine module and the event classification and response decision module to receive security event data. At the same time, it is connected to the cloud security management platform through the vehicle wireless communication unit to realize the cloud reporting of event data.

[0065] Among the above-mentioned functional modules of the present invention, the core functional units such as the resource awareness unit in the strategy unified orchestration and dynamic configuration module, the multi-dimensional correlation analysis unit in the cross-node collaborative detection engine module, and the hierarchical evaluation unit in the event hierarchical and response decision module are the core of the technical innovation of the present invention.

[0066] To achieve the same inventive objective as the aforementioned technical solutions, this invention also provides a detection method for the distributed vehicle network security incident detection system described above. This detection method involves the following stages:

[0067] 1. Differentiated detection deployment phase;

[0068] 2. Distributed data acquisition and local detection stage;

[0069] 3. Cross-node collaborative detection phase;

[0070] 4. Event classification and distributed response phase;

[0071] 5. Event storage and reporting stage;

[0072] 6. Strategy dynamic update phase.

[0073] The specific details of each of the above stages are as follows:

[0074] 1. In the differentiated detection deployment phase, the strategy unified orchestration and dynamic configuration module first collects the computing resource information of each ECU node in the vehicle network through the resource perception unit, and matches the corresponding granularity detection algorithm and strategy configuration according to the different resource capabilities of each node.

[0075] The computing resources mentioned include information on CPU computing power, memory capacity, and storage space;

[0076] For domain controller nodes with sufficient computing power, configure a deep detection algorithm that includes a machine learning model;

[0077] For resource-constrained low-end ECU nodes, configure a lightweight detection algorithm based on rules and features;

[0078] After configuration, the policy distribution unit will distribute the differentiated detection policies to each distributed security detection probe.

[0079] 2. During the distributed data acquisition and local detection phase, the message acquisition unit of each distributed security detection probe collects the bus message data, system operation status data and interface access log data of the ECU node in real time.

[0080] According to the issued detection strategy, the local detection unit uses a detection algorithm that matches the resource capabilities of the node to perform local analysis on the collected data, identify local abnormal behaviors and generate preliminary security events, and then reports the event data to the cross-node collaborative detection engine module through the event reporting unit.

[0081] 3. During the cross-node collaborative detection phase, the event receiving unit of the cross-node collaborative detection engine module collects security event data reported by each probe.

[0082] The correlation analysis unit performs temporal, spatial, and logical correlation analysis on security events from different nodes and buses based on preset attack scenario rules and multi-dimensional correlation algorithms.

[0083] The collaborative detection unit combines multi-node event data for comprehensive analysis, identifies complex attack behaviors across buses and nodes, generates the final security event detection results, and outputs them to the event classification and response decision module.

[0084] 4. In the event classification and distributed response phase, the event classification and response decision module's event classification assessment unit classifies events into different levels based on dimensions such as attack type, scope of impact, and severity; these different levels include, for example, alert level, warning level, severe level, and emergency level.

[0085] The response strategy matching unit matches the corresponding response handling strategy based on the event level;

[0086] The instruction issuing unit will distribute the response instruction to the security execution unit of the relevant nodes in a distributed manner, triggering corresponding protection and handling measures;

[0087] The aforementioned protective measures include message filtering, access restrictions, communication blocking, and alarm notifications.

[0088] 5. During the event storage and reporting phase, the local storage unit of the security event storage and reporting module performs local persistent storage of the detected security events and response records;

[0089] The data formatting unit formats the event data according to a standard format;

[0090] The cloud reporting unit reports security incident data to the cloud security management platform through the vehicle-mounted wireless communication unit, supporting further analysis and threat intelligence sharing in the cloud.

[0091] 6. During the dynamic policy update phase, the policy unified orchestration and dynamic configuration module can update and adjust the detection policy through the policy management unit based on threat intelligence, vehicle configuration changes, or operation and maintenance needs issued from the cloud, and dynamically issue the updated policy to relevant modules through the policy issuance unit, thereby realizing online iteration and adaptive adjustment of detection capabilities.

[0092] The method of this invention is based on core technologies such as a resource-aware differentiated detection strategy deployment method, a multi-dimensional cross-node security event collaborative detection method, a multi-dimensional event classification and distributed response and handling method, and a unified orchestration and dynamic configuration method for detection strategies.

[0093] Compared with the prior art, the above-mentioned technical solution of the present invention has the following beneficial effects:

[0094] 1. Improved detection accuracy in complex attack scenarios: This invention uses a cross-node collaborative detection engine to perform multi-dimensional correlation analysis and collaborative judgment on security events from different nodes and different buses. It breaks through the limitations of independent detection of each node in existing solutions, and can effectively identify complex attack behaviors across buses and nodes. It eliminates the detection blind spots of single-point detection and significantly improves the comprehensiveness and accuracy of vehicle network security event detection.

[0095] 2. Achieves precise matching of detection capabilities and node resources: This invention, through resource awareness and differentiated strategy configuration mechanism, matches detection algorithms and strategies of corresponding granularity according to the computing resource capabilities of each ECU node in the vehicle network. This ensures both the real-time detection and low resource consumption of resource-constrained nodes, and fully leverages the performance advantages of high-computing-power nodes, thereby improving the overall resource utilization efficiency of the distributed detection system and achieving a balance between detection effect and operating efficiency.

[0096] 3. Enhanced timeliness and relevance of security incident response: This invention, through a multi-dimensional incident classification and assessment mechanism and a distributed response and handling mechanism, can perform fine-grained classification based on the attack type, scope of impact, and severity of security incidents, and trigger differentiated response and handling strategies. This avoids the problems of insufficient or excessive response in existing solutions, and improves the timeliness, relevance, and effectiveness of security incident response.

[0097] 4. Improved system adaptability and scalability: This invention achieves centralized management and online dynamic updates of detection strategies through a unified strategy orchestration and dynamic configuration module. It can quickly adapt to vehicle network environments with different vehicle models and different electronic and electrical architectures, and supports flexible adjustment of detection strategies according to changes in threat intelligence and operation and maintenance needs. This greatly reduces the workload of strategy adaptation and operation and maintenance, and enhances the scalability and adaptability of the system.

[0098] 5. A complete distributed security event detection closed loop has been constructed: This invention integrates distributed collection, collaborative detection, hierarchical response, unified orchestration, storage and reporting, forming a complete technical closed loop for vehicle network security event detection. It can provide comprehensive and multi-level monitoring support for vehicle network security and help meet the relevant requirements of regulations and standards such as UNR155 and ISO / SAE21434 for vehicle network security event detection.

[0099] The present invention has been described above by way of example with reference to the accompanying drawings. Obviously, the specific implementation of the present invention is not limited to the above-described manner. Any non-substantial improvements made using the inventive concept and technical solution of the present invention, or the direct application of the inventive concept and technical solution of the present invention to other occasions without modification, are all within the protection scope of the present invention.

Claims

1. A distributed vehicle network security event detection system, applied to a vehicle electronic and electrical architecture, wherein the vehicle electronic and electrical architecture includes an ECU, a vehicle central gateway or a core domain controller, characterized in that: The detection system includes a distributed security detection probe module, a cross-node collaborative detection engine module, an event classification and response decision module, a unified policy orchestration and dynamic configuration module, and a security event storage and reporting module.

2. The distributed vehicle network security incident detection system according to claim 1, characterized in that: The distributed safety detection probe module is deployed in each ECU node of the vehicle network; each distributed safety detection probe module includes a message acquisition unit, a local detection unit, and an event reporting unit; each probe is connected to the vehicle network through the bus interface of its ECU and interacts with the collaborative detection engine module through the vehicle bus.

3. The distributed vehicle network security incident detection system according to claim 1, characterized in that: The cross-node collaborative detection engine module is deployed on the vehicle central gateway or core domain controller; the cross-node collaborative detection engine module includes an event receiving unit, a correlation analysis unit, a collaborative detection unit, and a result output unit; the cross-node collaborative detection engine module is connected to each distributed security detection probe module through the vehicle bus and receives the raw security event data reported by each probe.

4. The distributed vehicle network security incident detection system according to claim 1, characterized in that: The event classification and response decision module is deployed on a gateway or domain controller; the event classification and response decision module includes an event classification evaluation unit, a response strategy matching unit, and an instruction issuing unit; the event classification and response decision module is connected to the cross-node collaborative detection engine module and receives detection result data.

5. The distributed vehicle network security incident detection system according to claim 1, characterized in that: The unified policy orchestration and dynamic configuration module is deployed in the vehicle's central computing unit or gateway; the unified policy orchestration and dynamic configuration module includes a policy management unit, a resource awareness unit, a policy distribution unit, and a configuration update unit; the unified policy orchestration and dynamic configuration module is connected to each distributed security detection probe, collaborative detection engine, and event hierarchical response module through the vehicle network to realize unified management and dynamic distribution of detection policies.

6. The distributed vehicle network security incident detection system according to claim 1, characterized in that: The security event storage and reporting module is deployed in the vehicle's infotainment system or T-BOX and includes a local storage unit, a data formatting unit, and a cloud reporting unit. The security event storage and reporting module is connected to the cross-node collaborative detection engine module and the event classification and response decision module to receive security event data. At the same time, it is connected to the cloud security management platform through the vehicle wireless communication unit to realize the cloud reporting of event data.

7. The detection method of the distributed vehicle network security incident detection system according to any one of claims 1 to 6, characterized in that: The detection method described herein goes through the following stages: 1) Differentiated detection deployment phase; 2) Distributed data acquisition and local detection stage; 3) Cross-node collaborative detection phase; 4) Event classification and distributed response phase; 5) Event storage and reporting stage; 6) Strategy dynamic update phase.

8. The detection method of the distributed vehicle network security incident detection system according to claim 7, characterized in that: In the cross-node collaborative detection phase, the event receiving unit of the cross-node collaborative detection engine module collects security event data reported by each probe; the correlation analysis unit performs time correlation, spatial correlation, and logical correlation analysis on security events from different nodes and different buses based on preset attack scenario rules and multi-dimensional correlation algorithms; the collaborative detection unit combines multi-node event data for comprehensive judgment, identifies complex attack behaviors across buses and nodes, generates the final security event detection results, and outputs them to the event classification and response decision module.

9. The detection method of the distributed vehicle network security incident detection system according to claim 7, characterized in that: During the event storage and reporting phase, the local storage unit of the security event storage and reporting module persistently stores the detected security events and response records locally; the data formatting unit formats the event data according to a standard format. The cloud reporting unit reports security incident data to the cloud security management platform through the vehicle-mounted wireless communication unit, supporting further analysis and threat intelligence sharing in the cloud.

10. The detection method of the distributed vehicle network security incident detection system according to claim 7, characterized in that: During the dynamic policy update phase, the policy unified orchestration and dynamic configuration module can update and adjust the detection policy through the policy management unit based on threat intelligence, vehicle configuration changes, or operation and maintenance needs issued from the cloud, and dynamically issue the updated policy to relevant modules through the policy issuance unit, thereby realizing online iteration and adaptive adjustment of detection capabilities.

Images