Abnormal behavior detection method, device and electronic equipment for in-vehicle applications

Abstract

The application relates to an abnormal behavior detection method and device for a vehicle-mounted application and electronic equipment, and belongs to the technical field of vehicle-mounted application abnormality detection. The method comprises the following steps: extracting a safety feature vector of a DEX file of the vehicle-mounted application, and constructing a directed behavior graph of the vehicle-mounted application based on the safety feature vector; training a behavior-working condition probability correlation strategy based on sample data, and determining a probability threshold value of legal behavior of the vehicle-mounted application under different working conditions; the sample data comprises vehicle condition data and behavior data of the vehicle-mounted application which are synchronously collected; a high-risk API calling event of the vehicle-mounted application is listened to, vehicle condition data at a current time is acquired when a sensitive operation is triggered, and a behavior deviation degree is determined based on the vehicle condition data at the current time, a behavior baseline and the probability threshold value; and when the behavior deviation degree is greater than or equal to a first threshold value, it is determined that the behavior of the vehicle-mounted application is highly dangerous and abnormal. The abnormal behavior detection method for the vehicle-mounted application provided by the application significantly improves detection accuracy.

Description

Technical Field

[0001] This invention relates to the field of anomaly detection technology for vehicle applications, and more particularly to a method, device, and electronic device for detecting abnormal behavior in vehicle applications. Background Technology

[0002] With the development of the automotive operating system ecosystem, the number of third-party automotive applications is increasing day by day. Existing automotive application anomaly detection mainly relies on software behavior characteristics, such as automotive application detection methods based on DEX static characteristics. DEX (Dalvik Executable) files are executable file formats of the Dalvik virtual machine and ART runtime in Android systems and Android-based automotive systems. They encapsulate all the compiled bytecode of the application and usually exist in the APK installation package in the form of classes.dex.

[0003] Traditional in-vehicle application anomaly detection relies solely on static DEX features, which are detached from real-world vehicle conditions and cannot identify abnormal API calls, resulting in high false positive and false negative rates. Summary of the Invention

[0004] In view of this, it is necessary to provide an abnormal behavior detection method, device and electronic device for vehicle applications, so as to improve the detection accuracy of abnormal behavior.

[0005] To achieve the above objectives, in a first aspect, the present invention provides an abnormal behavior detection method for in-vehicle applications, comprising: The security feature vectors of the DEX files of the vehicle application are extracted, and a directed behavior graph of the vehicle application is constructed based on the security feature vectors; the directed behavior graph is used to determine the behavioral baseline of the vehicle application. The behavior-operating condition probability association strategy is trained based on sample data to determine the probability threshold of legal behavior of vehicle applications under different operating conditions; the sample data includes vehicle condition data and vehicle application behavior data collected synchronously. Monitor high-risk API call events of in-vehicle applications, obtain vehicle condition data at the current moment when a sensitive operation is triggered, and determine the degree of behavior deviation based on the vehicle condition data at the current moment, the behavior baseline, and the probability threshold. When the deviation of the behavior is greater than or equal to the first threshold, the behavior of the vehicle application is determined to be high-risk and abnormal.

[0006] In one possible implementation, after determining that the behavior of the in-vehicle application is highly abnormal when the behavior deviation is greater than or equal to a first threshold, the method further includes: Initiate a behavior backtracking mechanism within a preset time window to determine the complete API call sequence of the in-vehicle application within the preset time window; Based on the complete API call sequence, a preset vehicle attack chain is matched to freeze the high-risk API call permissions of vehicle applications; the preset vehicle attack chain includes privacy theft, CAN data tampering, or unauthorized vehicle control.

[0007] In one possible implementation, training the behavior-condition probability association strategy based on sample data to determine the probability threshold of legitimate behaviors for in-vehicle applications under different conditions includes: Vehicle status data is collected via the CAN bus, and behavioral data of in-vehicle applications are collected simultaneously. The aligned behavior data and vehicle condition data are classified according to working conditions. Based on the behavior data and vehicle condition data under different working conditions, a Gaussian distribution statistical algorithm is used to train the behavior-working condition probability association strategy to determine the probability threshold of legal behavior under different working conditions.

[0008] In one possible implementation, the security feature vector includes: A collection of API calls related to CAN bus reading / writing, vehicle status acquisition, and location acquisition; The complete opcode sequence of all Dalvik methods; Declaration of permissions for high-risk in-vehicle systems.

[0009] In one possible implementation, constructing the directed behavior graph of the in-vehicle application based on the security feature vector includes: The directed behavior graph is constructed using API interfaces and opcodes as behavior nodes and call sequence, module dependency, and call frequency as associated edges.

[0010] One possible implementation also includes: When the deviation is greater than or equal to the second threshold and less than the first threshold, it is determined that the behavior of the in-vehicle application is slightly abnormal. When the deviation is less than the second threshold, the behavior of the in-vehicle application is determined to be normal; The second threshold is less than the first threshold.

[0011] In one possible implementation, the vehicle condition data includes vehicle speed, engine speed, steering wheel angle, brake pedal opening, gear position, ACC status, and charging status.

[0012] In one possible implementation, the behavioral data includes the time of invocation, frequency of invocation, and duration of invocation of the sensitive API.

[0013] Secondly, the present invention also provides an abnormal behavior detection device for vehicle applications, comprising: A construction unit is used to extract the security feature vector of the DEX file of the vehicle application and construct a directed behavior graph of the vehicle application based on the security feature vector; the directed behavior graph is used to determine the behavior baseline of the vehicle application. The training unit is used to train the behavior-operating condition probability association strategy based on sample data to determine the probability threshold of legal behavior of the vehicle application under different operating conditions; the sample data includes vehicle condition data and vehicle application behavior data collected synchronously. The determination unit is used to monitor high-risk API call events of in-vehicle applications. When a sensitive operation is triggered, it obtains the vehicle condition data at the current moment and determines the degree of behavior deviation based on the vehicle condition data at the current moment, the behavior baseline, and the probability threshold. The detection unit is used to determine the high-risk abnormal behavior of the vehicle application when the deviation of the behavior is greater than or equal to a first threshold.

[0014] Thirdly, the present invention also provides an electronic device, including a data acquisition unit, a memory, and a processor, wherein, The data acquisition unit, the memory, and the processor are communicatively connected. The data collector is used to simultaneously collect vehicle condition data and in-vehicle application behavior data; The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps in the abnormal behavior detection method for vehicle applications described in any of the above implementations.

[0015] The beneficial effects of this invention are as follows: The abnormal behavior detection method, device, and electronic device for vehicle applications provided by this invention extract the security feature vector of the DEX file of the vehicle application, construct a directed behavior graph of the vehicle application, generate a behavior baseline based on the directed behavior graph, and train a behavior-operating condition probability association strategy based on synchronously collected vehicle condition data and behavior data to obtain the probability threshold of the legitimate behavior of the vehicle application under different operating conditions. When a sensitive operation is triggered, the vehicle condition data at the current moment is obtained, and the behavior deviation is determined by combining the behavior baseline and the probability threshold. By associating DEX behavior features with vehicle condition data, the behavior of the vehicle application is determined as abnormal by the behavior-operating condition deviation. This can accurately distinguish between normal business and vehicle-specific abnormal attacks, significantly improving the detection accuracy. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A schematic flowchart of an embodiment of the abnormal behavior detection method for vehicle applications provided by the present invention; Figure 2 A schematic diagram of an embodiment of the abnormal behavior detection device for vehicle applications provided by the present invention; Figure 3 A schematic diagram of an embodiment of the electronic device provided by the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0019] In the description of the embodiments of the present invention, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0020] The terms "first," "second," etc., used in the embodiments of this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a technical feature defined with "first" or "second" may explicitly or implicitly include at least one of that feature.

[0021] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0022] This invention provides a method, device, and electronic device for detecting abnormal behavior in vehicle applications, which will be described below.

[0023] Figure 1This is a schematic flowchart of an embodiment of the abnormal behavior detection method for in-vehicle applications provided by the present invention, as shown below. Figure 1 As shown, the abnormal behavior detection methods for in-vehicle applications include: S101. Extract the security feature vector of the DEX file of the vehicle application, and construct a directed behavior graph of the vehicle application based on the security feature vector; the directed behavior graph is used to determine the behavior baseline of the vehicle application. S102. Train the behavior-operating condition probability association strategy based on sample data to determine the probability threshold of legal behavior of vehicle applications under different operating conditions; the sample data includes vehicle condition data and vehicle application behavior data collected synchronously. S103. Monitor high-risk API call events of in-vehicle applications, obtain vehicle condition data at the current moment when a sensitive operation is triggered, and determine the degree of behavior deviation based on the vehicle condition data at the current moment, the behavior baseline and the probability threshold. S104. When the deviation of the behavior is greater than or equal to the first threshold, the behavior of the vehicle application is determined to be high-risk and abnormal.

[0024] In S101, static parsing is performed on the DEX files of in-vehicle applications to extract three types of core security features in batches: a set of high-risk and sensitive API calls for CAN bus read / write, vehicle condition acquisition, and location acquisition; a complete sequence of Dalvik method opcodes; and high-risk in-vehicle permissions such as ACCESS_CAN_BUS and READ_VEHICLE_STATE. Based on these security features, a security feature vector is constructed.

[0025] Using API interfaces and Dalvik opcodes as behavior nodes, and call sequence, module dependency, and call frequency as related edges, a directed behavior graph exclusive to in-vehicle applications is constructed. This graph can fully cover all normal business scenarios of a single application and accurately adapt to the differentiated operating logic of different applications.

[0026] After installation, the new application will automatically enter a 72-hour silent learning cycle covering all working conditions such as parking, idling, low speed, high speed, and charging. During the learning period, only data will be collected to iterate the baseline without triggering any alarms. After the learning is completed, the exclusive behavior baseline will be automatically solidified.

[0027] In S102, vehicle status data and in-vehicle application behavior data are collected synchronously as sample data. Vehicle status data may include vehicle speed, engine speed, steering wheel angle, brake pedal opening, gear position, ACC status, and charging status. Behavioral data may include the timing, frequency, and duration of sensitive API calls.

[0028] By using a unified timestamp calibration mechanism, the synchronization error of the two types of data is strictly controlled within 10ms. A Gaussian distribution statistical algorithm is used to train the behavior-condition probability association strategy method, which quantifies and solidifies the probability threshold of legal behavior in each scenario, and clarifies the scenario-based compliance boundaries such as prohibiting high-frequency CAN sniffing in the parking state and normalizing vehicle condition reading in the driving state.

[0029] In S103, high-risk API call events of all in-vehicle applications are monitored. Once a sensitive operation is triggered, the complete CAN vehicle condition data at the current moment is immediately obtained synchronously. Based on the vehicle condition data at the current moment, the behavior baseline and probability threshold, the deviation is calculated by substituting the probability strategy method.

[0030] In S104, when the behavior deviation is greater than or equal to the first threshold, the behavior of the vehicle application is judged to be highly abnormal and an alarm is triggered immediately.

[0031] In summary, the abnormal behavior detection method for in-vehicle applications provided in this embodiment of the invention extracts the security feature vector of the DEX file of the in-vehicle application, constructs a directed behavior graph of the in-vehicle application, generates a behavior baseline based on the directed behavior graph, and trains a behavior-operating condition probability association strategy based on synchronously collected vehicle condition data and behavior data to obtain probability thresholds for legitimate behaviors of the in-vehicle application under different operating conditions. When a sensitive operation is triggered, the vehicle condition data at the current moment is obtained, and the behavior deviation is determined by combining the behavior baseline and the probability threshold. By associating DEX behavior features with vehicle condition data, the behavior of the in-vehicle application is determined as abnormal based on the behavior-operating condition deviation. This method can accurately distinguish between normal business and in-vehicle-specific abnormal attacks, significantly improving detection accuracy.

[0032] In some embodiments of the present invention, the security feature vector includes: A collection of API calls related to CAN bus reading / writing, vehicle status acquisition, and location acquisition; The complete opcode sequence of all Dalvik methods; Declaration of permissions for high-risk in-vehicle systems.

[0033] In some embodiments of the present invention, constructing a directed behavior graph of the vehicle application based on the security feature vector includes: The directed behavior graph is constructed using API interfaces and opcodes as behavior nodes and call sequence, module dependency, and call frequency as associated edges.

[0034] During the behavior baseline modeling phase, the system conducts comprehensive static deep analysis of the DEX files of in-vehicle third-party applications and system applications, and extracts three types of core security features in batches. These features cover 12 types of high-risk and sensitive in-vehicle API call sets, including CAN bus read / write, vehicle condition collection, and location acquisition, as well as the full Dalvik method opcode sequence and four types of high-risk in-vehicle permissions such as ACCESS_CAN_BUS and READ_VEHICLE_STATE.

[0035] The disordered raw opcodes and calling behavior are quantized and compressed into a 256-dimensional standardized behavioral security feature vector, realizing the structuring, quantification, and comparability of behavioral data.

[0036] This invention abandons the coarse detection mode of industry-standard fixed baselines and adopts a single-application independent modeling mechanism. It uses API interfaces and Dalvik opcodes as behavior nodes and call sequence, module dependency, and call frequency as related edges to construct a dedicated directed behavior graph. This graph fully covers all normal business scenarios of a single application and accurately adapts to the differentiated operating logic of different applications, thus fundamentally solving the problems of large adaptation deviations and many false alarms of the general baseline.

[0037] After a new application is installed, it automatically enters a 72-hour silent learning cycle covering all operating conditions, including parking, idling, low speed, high speed, and charging. During the learning period, only data is collected to iterate the baseline without triggering any alarms. After the learning period, the exclusive behavior baseline is automatically solidified, and a 30-day silent iteration update mechanism is set to adapt to normal application version iterations and function fine-tuning, ensuring that the baseline is accurate and effective in the long term.

[0038] In some embodiments of the present invention, training the behavior-condition probability association strategy based on sample data to determine the probability threshold of legitimate behaviors of in-vehicle applications under different conditions includes: Vehicle status data is collected via the CAN bus, and behavioral data of in-vehicle applications are collected simultaneously. The aligned behavior data and vehicle condition data are classified according to working conditions. Based on the behavior data and vehicle condition data under different working conditions, a Gaussian distribution statistical algorithm is used to train the behavior-working condition probability association strategy to determine the probability threshold of legal behavior under different working conditions.

[0039] In some embodiments of the present invention, the vehicle condition data includes vehicle speed, engine speed, steering wheel angle, brake pedal opening, gear position, ACC status, and charging status.

[0040] In some embodiments of the present invention, the behavioral data includes the call time, call frequency, and call duration of sensitive APIs.

[0041] During the training phase of the CAN signal and behavior association strategy method, a dual-thread high-precision synchronous acquisition mechanism is established to achieve millisecond-level alignment between software behavior data and vehicle physical state data.

[0042] The CAN bus acquisition thread continuously collects seven core vehicle condition data categories at a fixed high frequency of 100Hz: vehicle speed, engine speed, steering wheel angle, brake pedal opening, gear position, ACC status, and charging status. The application behavior acquisition thread monitors system calls in real time, capturing log data such as the call time, call frequency, and call duration of all sensitive APIs at the millisecond level.

[0043] By using a unified timestamp calibration mechanism, the synchronization error between the two types of data is strictly controlled within 10ms, thus preventing the failure of strategy training caused by timing misalignment.

[0044] To adapt to the diverse and complex in-vehicle scenarios, the system constructs 15 refined combinations of driving conditions across five speed ranges, superimposed with braking and driving states, achieving comprehensive coverage across all scenarios. Based on massive amounts of normal sample data during the learning period, a Gaussian distribution statistical algorithm is used to train a behavior-driving condition probability association strategy, quantifying and solidifying the probability thresholds of legal behaviors under each driving condition scenario, and clearly defining scenario-specific compliance boundaries such as prohibiting high-frequency CAN sniffing in parked conditions and normalizing vehicle condition readings in driving conditions.

[0045] At the same time, it automatically filters out invalid interference samples such as instantaneous fluctuations, temporary debugging, and occasional operations with a duration of less than 500ms, eliminates noisy data, and ensures that the fitting accuracy of the strategy method is highly matched with the actual vehicle operation scenario.

[0046] The parameters for the behavior determination strategy are shown in Table 1: Table 1: Parameters of Behavior Judgment Strategy

[0047] The abnormal behavior detection method for vehicle applications provided in this invention constructs a probability correlation between DEX behavior and CAN signal, and can determine abnormalities by behavioral deviation and backtrack the composite attack chain to achieve scenario-based intelligent anomaly detection.

[0048] In some embodiments of the present invention, it further includes: When the deviation is greater than or equal to the second threshold and less than the first threshold, it is determined that the behavior of the in-vehicle application is slightly abnormal. When the deviation is less than the second threshold, the behavior of the in-vehicle application is determined to be normal; The second threshold is less than the first threshold.

[0049] In some embodiments of the present invention, after determining that the behavior of the in-vehicle application is highly abnormal when the behavior deviation is greater than or equal to a first threshold, the method further includes: Initiate a behavior backtracking mechanism within a preset time window to determine the complete API call sequence of the in-vehicle application within the preset time window; Based on the complete API call sequence, a preset vehicle attack chain is matched to freeze the high-risk API call permissions of vehicle applications; the preset vehicle attack chain includes privacy theft, CAN data tampering, or unauthorized vehicle control.

[0050] During the real-time anomaly detection and attack chain tracing phase, the vehicle security monitor runs in low-power mode with its kernel constantly resident 24 / 7, with a static CPU utilization rate of less than 2%, which does not affect the normal operation of the vehicle.

[0051] The system monitors high-risk API call events of all in-vehicle applications at the millisecond level. Once a sensitive operation is triggered, it immediately captures complete CAN vehicle condition data at the current moment, dynamically assembles application behavior-vehicle condition matching samples, and substitutes them into a probabilistic strategy method to calculate the deviation.

[0052] The three-level quantitative judgment standard accurately distinguishes behavioral attributes. Deviation of less than 10% (i.e., the second threshold) is judged as normal business behavior, 10%-30% is a minor anomaly with only local traces, and above 30% (i.e., the first threshold) is judged as a primary high-risk anomaly and triggers an alarm.

[0053] To address the limitation of traditional single-point detection in identifying complex attacks, the system incorporates a 30-second behavior backtracking mechanism. Upon triggering a primary high-risk anomaly, it automatically replays the application's complete call sequence over the past 30 seconds, accurately matching three typical vehicle-mounted attack chains: privacy theft, CAN data tampering, and unauthorized vehicle control. This fully reconstructs the entire process from a single point of failure to a chain attack, upgrading the system from single-behavior detection to attack chain tracing. Once a complete high-risk attack chain is matched, the alarm level is immediately escalated, quickly freezing high-risk API permissions and locking the running process to prevent the attack from continuing to advance and spread.

[0054] During the scenario-adaptive response and cloud-based iteration phases, this solution always adheres to the principle of prioritizing driving safety, and matches response strategies according to real-time vehicle conditions to avoid driving risks caused by a one-size-fits-all approach.

[0055] For scenarios where there are no driving safety hazards, such as parking and charging, the system can quickly terminate malicious application processes and clear abnormal caches within 500ms after detecting an anomaly, thus completely eliminating security risks. For low-speed driving scenarios of 0-30km / h, first temporarily freeze high-risk permissions, continuously monitor for 10 seconds, and then forcibly terminate the process if the anomaly is not eliminated; For high-speed driving scenarios above 30km / h, only alarm logs are retained and CAN communication permissions are restricted. The application process is not actively terminated to avoid sudden program exit causing abnormal vehicle functions and to ensure high-speed driving stability.

[0056] All confirmed abnormal samples are anonymized and encrypted before being uploaded to the cloud. The cloud continuously optimizes its strategies, methods, thresholds, attack chain matching rules, and scenario strategies based on massive samples. It silently updates the vehicle terminal via OTA every quarter without requiring device restart. It also supports manual review of false or missed samples, automatically synchronizes and optimizes local baseline parameters, and continuously iterates to improve detection accuracy, achieving a long-term operating mechanism for the detection system that is self-adaptive, self-optimizing, and self-upgrading.

[0057] The abnormal behavior detection method for vehicle applications provided in this invention establishes the correlation between DEX behavioral characteristics and CAN vehicle status signals, accurately distinguishes between normal business operations and vehicle-specific abnormal attacks, realizes attack chain tracing and scenario-adaptive security response, and significantly improves detection accuracy.

[0058] The abnormal behavior detection method for vehicle applications provided in this invention revolves around the core technical logic of baseline modeling, correlation training, real-time detection, and adaptive response. It constructs an abnormal detection system that deeply links software behavior with vehicle physical state, completely solving the technical defects of traditional vehicle malicious application detection that rely solely on DEX static features, are detached from real vehicle conditions, have high false positive and false negative rates, and cannot identify chain-like hidden attacks.

[0059] To better implement the abnormal behavior detection method for in-vehicle applications in this embodiment of the invention, based on the abnormal behavior detection method for in-vehicle applications, correspondingly, as follows: Figure 2 As shown, this embodiment of the invention also provides an abnormal behavior detection device for vehicle applications. The abnormal behavior detection device 200 for vehicle applications includes: Construction unit 201 is used to extract the security feature vector of the DEX file of the vehicle application and construct the directed behavior graph of the vehicle application based on the security feature vector; the directed behavior graph is used to determine the behavior baseline of the vehicle application. Training unit 202 is used to train the behavior-operating condition probability association strategy based on sample data to determine the probability threshold of legal behavior of vehicle application under different operating conditions; the sample data includes vehicle condition data and vehicle application behavior data collected synchronously. The determination unit 203 is used to monitor high-risk API call events of in-vehicle applications. When a sensitive operation is triggered, it obtains the vehicle condition data at the current moment and determines the degree of behavior deviation based on the vehicle condition data at the current moment, the behavior baseline, and the probability threshold. The detection unit 204 is used to determine the high-risk abnormal behavior of the vehicle application when the behavior deviation is greater than or equal to a first threshold.

[0060] The abnormal behavior detection device 200 for vehicle applications provided in the above embodiments can implement the technical solutions described in the embodiments of the abnormal behavior detection method for vehicle applications. The specific implementation principles of each module or unit can be found in the corresponding content in the embodiments of the abnormal behavior detection method for vehicle applications, and will not be repeated here.

[0061] like Figure 3 As shown, the present invention also provides an electronic device 300. The electronic device 300 includes a processor 301, a memory 302, a display 303, and a data acquisition device 304. Figure 3 Only some components of the electronic device 300 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0062] In some embodiments, processor 301 may be a central processing unit (CPU), microprocessor, or other data processing chip, used to run program code stored in memory 302 or process data, such as the abnormal behavior detection method for vehicle applications in this invention.

[0063] In some embodiments, processor 301 may be a single server or a group of servers. The server group may be centralized or distributed. In some embodiments, processor 301 may be local or remote. In some embodiments, processor 301 may be implemented on a cloud platform. In some embodiments, the cloud platform may include a private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, internal cloud, multi-cloud, or any combination thereof.

[0064] In some embodiments, memory 302 may be an internal storage unit of electronic device 300, such as a hard disk or memory of electronic device 300. In other embodiments, memory 302 may also be an external storage device of electronic device 300, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. equipped on electronic device 300.

[0065] Furthermore, the memory 302 may include both internal storage units of the electronic device 300 and external storage devices. The memory 302 is used to store application software and various types of data installed on the electronic device 300.

[0066] In some embodiments, display 303 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an organic light-emitting diode (OLED) touchscreen, etc. Display 303 is used to display information from electronic device 300 and to display a visual user interface.

[0067] In some embodiments, the data acquisition unit 304 may be a sensor used to simultaneously collect vehicle condition data and behavioral data of in-vehicle applications.

[0068] Components 301-304 of electronic device 300 communicate with each other via a system bus.

[0069] In one embodiment, when processor 301 executes the abnormal behavior detection program for the vehicle application in memory 302, the following steps can be implemented: The security feature vectors of the DEX files of the vehicle application are extracted, and a directed behavior graph of the vehicle application is constructed based on the security feature vectors; the directed behavior graph is used to determine the behavioral baseline of the vehicle application. The behavior-operating condition probability association strategy is trained based on sample data to determine the probability threshold of legal behavior of vehicle applications under different operating conditions; the sample data includes vehicle condition data and vehicle application behavior data collected synchronously. Monitor high-risk API call events of in-vehicle applications, obtain vehicle condition data at the current moment when a sensitive operation is triggered, and determine the degree of behavior deviation based on the vehicle condition data at the current moment, the behavior baseline, and the probability threshold. When the deviation of the behavior is greater than or equal to the first threshold, the behavior of the vehicle application is determined to be high-risk and abnormal.

[0070] It should be understood that when the processor 301 executes the abnormal behavior detection program of the vehicle application in the memory 302, in addition to the functions mentioned above, it can also perform other functions, as can be found in the description of the corresponding method embodiments above.

[0071] Furthermore, the embodiments of the present invention do not specifically limit the type of electronic device 300 mentioned. Electronic device 300 can be a mobile phone, tablet computer, personal digital assistant (PDA), wearable device, laptop computer, or other portable electronic device. Exemplary embodiments of portable electronic devices include, but are not limited to, portable electronic devices running iOS, Android, Microsoft, or other operating systems. The aforementioned portable electronic device can also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, electronic device 300 may not be a portable electronic device, but rather a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0072] Accordingly, embodiments of the present invention also provide a computer-readable storage medium for storing computer-readable programs or instructions. When the programs or instructions are executed by a processor, they can implement the steps or functions of the abnormal behavior detection method for vehicle applications provided in the above-described method embodiments.

[0073] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware (such as a processor, controller, etc.), and the computer program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0074] The above provides a detailed description of the abnormal behavior detection method, device, and electronic equipment for vehicle applications provided by this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, those skilled in the art will recognize that there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A method for detecting abnormal behavior in vehicle applications, characterized in that, include: The security feature vectors of the DEX files of the vehicle application are extracted, and a directed behavior graph of the vehicle application is constructed based on the security feature vectors; the directed behavior graph is used to determine the behavioral baseline of the vehicle application. The behavior-operating condition probability association strategy is trained based on sample data to determine the probability threshold of legal behavior of vehicle applications under different operating conditions; the sample data includes vehicle condition data and vehicle application behavior data collected synchronously. Monitor high-risk API call events of in-vehicle applications, obtain vehicle condition data at the current moment when a sensitive operation is triggered, and determine the degree of behavior deviation based on the vehicle condition data at the current moment, the behavior baseline, and the probability threshold. When the deviation of the behavior is greater than or equal to the first threshold, the behavior of the vehicle application is determined to be high-risk and abnormal.

2. The abnormal behavior detection method for vehicle applications according to claim 1, characterized in that, After determining that the behavior of the in-vehicle application is highly abnormal when the deviation is greater than or equal to the first threshold, the method further includes: Initiate a behavior backtracking mechanism within a preset time window to determine the complete API call sequence of the in-vehicle application within the preset time window; Based on the complete API call sequence, a preset vehicle attack chain is matched to freeze the high-risk API call permissions of vehicle applications; the preset vehicle attack chain includes privacy theft, CAN data tampering, or unauthorized vehicle control.

3. The abnormal behavior detection method for vehicle applications according to claim 1, characterized in that, The training of the behavior-operating condition probability association strategy based on sample data to determine the probability threshold of legal behaviors of in-vehicle applications under different operating conditions includes: Vehicle status data is collected via the CAN bus, and behavioral data of in-vehicle applications are collected simultaneously. The aligned behavior data and vehicle condition data are classified according to working conditions. Based on the behavior data and vehicle condition data under different working conditions, a Gaussian distribution statistical algorithm is used to train the behavior-working condition probability association strategy to determine the probability threshold of legal behavior under different working conditions.

4. The abnormal behavior detection method for vehicle applications according to claim 1, characterized in that, The security feature vector includes: A collection of API calls related to CAN bus reading / writing, vehicle status acquisition, and location acquisition; The complete opcode sequence of all Dalvik methods; Declaration of permissions for high-risk in-vehicle systems.

5. The abnormal behavior detection method for vehicle applications according to claim 4, characterized in that, The construction of the directed behavior graph of the in-vehicle application based on the security feature vector includes: The directed behavior graph is constructed using API interfaces and opcodes as behavior nodes and call sequence, module dependency, and call frequency as associated edges.

6. The abnormal behavior detection method for vehicle applications according to claim 1, characterized in that, Also includes: When the deviation is greater than or equal to the second threshold and less than the first threshold, it is determined that the behavior of the in-vehicle application is slightly abnormal. When the deviation is less than the second threshold, the behavior of the in-vehicle application is determined to be normal; The second threshold is less than the first threshold.

7. The abnormal behavior detection method for vehicle applications according to claim 1, characterized in that, The vehicle status data includes vehicle speed, engine speed, steering wheel angle, brake pedal opening, gear position, ACC status, and charging status.

8. The abnormal behavior detection method for vehicle applications according to claim 1, characterized in that, The behavioral data includes the time, frequency, and duration of calls to sensitive APIs.

9. An abnormal behavior detection device for vehicle applications, characterized in that, include: A construction unit is used to extract the security feature vector of the DEX file of the vehicle application and construct a directed behavior graph of the vehicle application based on the security feature vector; the directed behavior graph is used to determine the behavior baseline of the vehicle application. The training unit is used to train the behavior-operating condition probability association strategy based on sample data to determine the probability threshold of legal behavior of the vehicle application under different operating conditions; the sample data includes vehicle condition data and vehicle application behavior data collected synchronously. The determination unit is used to monitor high-risk API call events of in-vehicle applications. When a sensitive operation is triggered, it obtains the vehicle condition data at the current moment and determines the degree of behavior deviation based on the vehicle condition data at the current moment, the behavior baseline, and the probability threshold. The detection unit is used to determine the high-risk abnormal behavior of the vehicle application when the deviation of the behavior is greater than or equal to a first threshold.

10. An electronic device, characterized in that, Includes a data acquisition unit, memory, and processor, among which, The data acquisition unit, the memory, and the processor are communicatively connected. The data collector is used to simultaneously collect vehicle condition data and in-vehicle application behavior data; The memory is used to store programs; The processor, coupled to the memory, is configured to execute the program stored in the memory to implement the steps in the abnormal behavior detection method for an in-vehicle application as described in any one of claims 1 to 8.

Images