Intrusion detection method and device for in-vehicle network, storage medium and electronic device

Abstract

The application provides an intrusion detection method and device of an in-vehicle network, a storage medium and an electronic device, and the method comprises the following steps: obtaining message information on a communication line of the in-vehicle network; generating real-time behavior information of a target electronic control unit (ECU) to be detected by using the message information; calling a normal behavior portrait of an ECU set on the in-vehicle network, wherein the normal behavior portrait comprises a communication object set, a control function range and a normal communication behavior mode of the ECU on the in-vehicle network in a normal working state; and detecting whether the target ECU is injected with an attack according to the real-time behavior information and the normal behavior portrait. Through the embodiment of the application, the technical problem that a vehicle cannot detect an injection attack on an in-vehicle network in the related art is solved, an injection attack on an ECU in the in-vehicle network range and further affecting other ECUs can be detected, and the safety of the in-vehicle network is improved.

Description

Technical Field

[0001] This invention relates to the field of security technology, and more specifically, to an intrusion detection method and apparatus, storage medium, and electronic device for vehicle networks. Background Technology

[0002] In related technologies, with the development of computer communication technology, automobiles have shown trends towards electrification, intelligence, and connectivity. While these new features bring new experiences, they also present new security challenges. Frequent incidents of hackers intruding into vehicles via in-vehicle networks have drawn attention to in-vehicle network intrusion detection. For example, attackers can access the CAN (Controller Area Network) bus remotely or through physical contact, listen to ECU (Electronic Control Unit) messages, and then carefully inject messages to negate or disguise other ECU messages, thereby achieving monitoring or control of the vehicle. The resulting harm can disrupt normal traffic operations and even endanger the lives and property of drivers and passengers. Therefore, the identification and intrusion detection functions for ECUs accessing the CAN bus are particularly important.

[0003] The relevant technology involves detecting message information received on the CAN bus and issuing alarms when abnormalities occur in the messages from the CAN bus and ECU. Currently, existing detection technologies can only detect DDoS (Distributed Denial of Service) attacks based on the CAN bus, but cannot detect advanced attacks such as attackers spoofing ECUs.

[0004] No efficient and accurate solution has yet been found to address the aforementioned issues in the relevant technologies. Summary of the Invention

[0005] This invention provides an intrusion detection method and apparatus, storage medium, and electronic device for vehicle networks to solve technical problems in related technologies.

[0006] According to an embodiment of the present invention, an intrusion detection method for a vehicle network is provided, comprising: acquiring message information on the communication line of the vehicle network; generating real-time behavior information of a target electronic control unit (ECU) to be detected using the message information; calling a normal behavior profile of the ECU set on the vehicle network, wherein the normal behavior profile includes the communication object set, control function range, and normal communication behavior pattern of the ECU on the vehicle network in normal working state; and detecting whether the target ECU has been injected with an attack based on the real-time behavior information and the normal behavior profile.

[0007] Optionally, generating real-time behavior information of the target ECU to be detected using the message information includes: parsing the real-time data features of the target ECU from the message information, wherein the real-time data features are used to characterize the communication object of the target ECU; and determining the real-time data features as the first real-time behavior information of the ECU.

[0008] Optionally, generating real-time behavior information of the target ECU to be detected using the message information includes: parsing real-time operation instructions of the target ECU from the message information, wherein the real-time operation instructions are used to characterize the control function of the target ECU; and determining the real-time operation instructions as the second real-time behavior information of the ECU.

[0009] Optionally, generating real-time behavior information of the target ECU to be detected using the message information includes: parsing the real-time communication behavior pattern of the target ECU from the message information, wherein the real-time communication behavior pattern includes statistical features and behavior patterns, the statistical features include the time interval and number of messages sent by the target ECU, and the behavior patterns are used to characterize the sending pattern of the message data; and determining the real-time communication behavior pattern as the third real-time behavior information of the ECU.

[0010] Optionally, detecting whether the target ECU has been injected with an attack based on the real-time behavior information and the normal behavior profile includes: comparing the real-time behavior information with the normal behavior profile of the ECU set, and determining whether the comparison result meets the preset intrusion conditions; if the comparison result meets the preset intrusion conditions, determining that the target ECU has been injected with an attack.

[0011] Optionally, determining whether the comparison result meets the preset intrusion conditions includes: if the comparison result is that the real-time communication behavior pattern of the real-time behavior information differs from the normal communication behavior pattern of the normal behavior profile, calculating the difference value between the real-time communication behavior pattern and the normal communication behavior pattern; determining whether the difference value is within a preset threshold range; and if the difference value is within the preset threshold range, determining that the comparison result meets the preset intrusion conditions.

[0012] Optionally, determining whether the comparison result meets the preset intrusion conditions includes: if the comparison result shows that the real-time data characteristics of the real-time behavior information are different from the communication object set of the normal behavior profile, or if the comparison result shows that the real-time operation instructions of the real-time behavior information are different from the control function range of the normal behavior profile, then the comparison result is determined to meet the preset intrusion conditions.

[0013] Optionally, determining whether the comparison result meets the preset intrusion conditions includes: determining whether the ECU set contains the target ECU; if the ECU set does not contain the target ECU, determining that the comparison result meets the preset intrusion conditions.

[0014] Optionally, obtaining message information on the communication line of the vehicle network includes: obtaining monitoring messages listened to by the monitoring ECU on the communication line of the vehicle network, wherein the monitoring ECU is connected to the communication line of the vehicle network; sending a probe message to the target ECU on the communication line of the vehicle network, and receiving a feedback message returned by the target ECU in response to the probe message; and generating message information using the monitoring message and / or the feedback message.

[0015] According to another embodiment of the present invention, an intrusion detection device for a vehicle network is provided, comprising: a first acquisition module for acquiring message information on the communication line of the vehicle network; a generation module for generating real-time behavior information of a target electronic control unit (ECU) to be detected using the message information; a second acquisition module for calling a normal behavior profile of the ECU set on the vehicle network, wherein the normal behavior profile includes the communication object set, control function range, and normal communication behavior mode of the ECU on the vehicle network in normal working state; and a detection module for detecting whether the target ECU has been injected with an attack based on the real-time behavior information and the normal behavior profile.

[0016] Optionally, the generation module includes: a first parsing unit, configured to parse the real-time data features of the target ECU from the message information, wherein the real-time data features are used to characterize the communication object of the target ECU; and a first determining unit, configured to determine the real-time data features as the first real-time behavior information of the ECU.

[0017] Optionally, the generation module includes: a second parsing unit, configured to parse the real-time operation instructions of the target ECU from the message information, wherein the real-time operation instructions are used to characterize the control function of the target ECU; and a second determining unit, configured to determine the real-time operation instructions as the second real-time behavior information of the ECU.

[0018] Optionally, the generation module includes: a third parsing unit, configured to parse the real-time communication behavior pattern of the target ECU from the message information, wherein the real-time communication behavior pattern includes statistical features and behavior patterns, the statistical features include the time interval and number of messages sent by the target ECU, and the behavior patterns are used to characterize the sending pattern of the message data; and a third determining unit, configured to determine the real-time communication behavior pattern as the third real-time behavior information of the ECU.

[0019] Optionally, the detection module includes: a judgment unit, used to compare the real-time behavior information with the normal behavior profile of the ECU set, and judge whether the comparison result meets the preset intrusion conditions; and a determination unit, used to determine that the target ECU has been injected with an attack if the comparison result meets the preset intrusion conditions.

[0020] Optionally, the judgment unit includes: a calculation subunit, used to calculate the difference value between the real-time communication behavior pattern and the normal communication behavior pattern if the comparison result is that the real-time communication behavior pattern of the real-time behavior information is different from the normal communication behavior pattern of the normal behavior profile; a first judgment subunit, used to determine whether the difference value is within a preset threshold range; and a first determination subunit, used to determine that the comparison result meets the preset intrusion conditions if the difference value is within the preset threshold range.

[0021] Optionally, the judgment unit includes: a second determining subunit, used to determine that the comparison result meets the preset intrusion conditions if the real-time data features of the real-time behavior information are different from the communication object set of the normal behavior profile, or if the real-time operation instructions of the real-time behavior information are different from the control function range of the normal behavior profile.

[0022] Optionally, the judgment unit includes: a second judgment subunit, used to judge whether the ECU set contains the target ECU; and a third determination subunit, used to determine that if the ECU set does not contain the target ECU, the comparison result meets the preset intrusion conditions.

[0023] Optionally, the first acquisition module includes: an acquisition unit, configured to acquire monitoring messages listened to by the monitoring ECU on the communication line of the vehicle network, wherein the monitoring ECU is connected to the communication line of the vehicle network; a detection unit, configured to send a detection message to a target ECU on the communication line of the vehicle network and receive a feedback message returned by the target ECU in response to the detection message; and a generation unit, configured to generate message information using the monitoring message and / or the feedback message.

[0024] According to another aspect of the embodiments of this application, a storage medium is also provided, the storage medium including a stored program that executes the above steps when the program is run.

[0025] According to another aspect of the embodiments of this application, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; wherein: the memory is used to store computer programs; and the processor is used to execute the steps in the above method by running the programs stored in the memory.

[0026] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the steps in the above-described method.

[0027] The beneficial effects of this invention are:

[0028] 1. It can detect injection attacks that simulate ECUs within the vehicle network range and thus affect other ECUs, thereby improving the security of the vehicle network;

[0029] 2. It can actively or passively monitor the status of the ECU, thereby detecting network intrusions and enabling multi-faceted monitoring of message information on the vehicle network;

[0030] 3. It is not affected by the network protocols of the vehicle network and is applicable to network protocols with similar functions. Attached Figure Description

[0031] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0032] Figure 1 This is a hardware structure block diagram of a car according to an embodiment of the present invention;

[0033] Figure 2 This is a flowchart of an intrusion detection method for a vehicle network according to an embodiment of the present invention;

[0034] Figure 3 This is a schematic diagram of the deployment of the vehicle network intrusion detection system in an embodiment of the present invention;

[0035] Figure 4 This is a framework diagram of the vehicle network intrusion detection method in an embodiment of the present invention;

[0036] Figure 5 This is a schematic diagram of the structure of an intrusion detection system for a vehicle network according to an embodiment of the present invention;

[0037] Figure 6 This is a structural block diagram of an intrusion detection device for a vehicle network according to an embodiment of the present invention. Detailed Implementation

[0038] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, and not all of them. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of the present application can be combined with each other.

[0039] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, product, or apparatus that comprises a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0040] Example 1

[0041] The method embodiment provided in Embodiment 1 of this application can be executed in an automobile, server, processor, autonomous driving / assisted driving / intelligent driving controller, or similar processing device. Taking its operation in an automobile as an example, Figure 1 This is a hardware structure block diagram of a car according to an embodiment of the present invention. Figure 1 As shown, a car may include one or more ( Figure 1 Only one is shown in the image. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. Optionally, the vehicle may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned automobile. For example, the automobile may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0042] The memory 104 can be used to store automotive programs, such as application software programs and modules, like the automotive program corresponding to an intrusion detection method for an in-vehicle network in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the automotive program stored in the memory 104, thereby implementing the aforementioned method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the vehicle via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0043] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by a vehicle's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0044] This embodiment provides an intrusion detection method for vehicular networks. Figure 2 This is a flowchart of an intrusion detection method for a vehicle network according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0045] Step S202: Obtain message information on the communication line of the vehicle network;

[0046] Optionally, the communication line can be a CAN bus, fiber optic cable, power line carrier cable, or other vehicle communication line. The ECU is a communication node on the vehicle network's communication line, and the message information can correspond to the message data sent and / or received by one or more ECUs.

[0047] Step S204: Use the message information to generate real-time behavior information of the target electronic control unit (ECU) to be detected;

[0048] Step S206: Call the normal behavior profile of the ECU set on the vehicle network, wherein the normal behavior profile includes the communication object set, control function range, and normal communication behavior mode of the ECU on the vehicle network when it is in normal working state.

[0049] Optionally, the communication object set includes multiple IDs, each ID corresponding to the identifier of a communication object. The communication objects include the sending object of the target ECU and the receiving object of the target ECU. The control function range includes multiple control functions, such as opening the door, opening the window, turning on the headlights, turning on the in-vehicle camera, etc. The normal communication behavior mode includes the frequency, interval, and mode (such as random sending, periodic sending, and combined sending) of the target ECU sending message data.

[0050] Step S208: Detect whether the target ECU has been injected with an attack based on the real-time behavior information and the normal behavior profile.

[0051] Through the above steps, message information on the communication lines of the vehicle network is obtained; real-time behavior information of the target electronic control unit (ECU) to be detected is generated using the message information; a normal behavior profile of the ECU set on the vehicle network is invoked, wherein the normal behavior profile includes the communication object set, control function range, and normal communication behavior mode of the ECU on the vehicle network when it is in normal working state; based on the real-time behavior information and the normal behavior profile, it is detected whether the target ECU has been injected with an attack. This solves the technical problem in related technologies that vehicles cannot detect injection attacks on the vehicle network, and can detect injection attacks that simulate ECUs within the vehicle network range and thus affect other ECUs, thereby improving the security of the vehicle network.

[0052] In one embodiment of this example, generating real-time behavior information of the target ECU to be detected using the message information includes: parsing the real-time data features of the target ECU from the message information, wherein the real-time data features are used to characterize the communication object of the target ECU; and determining the real-time data features as the first real-time behavior information of the ECU.

[0053] The real-time data characteristics in the profile of the real-time behavior of the target ECU on the CAN bus refer to the data characteristics of the CAN messages sent and received by the ECU within a certain period of time. It can be a set of IDs of messages sent by the ECU within a certain period of time, or a set of IDs of messages received by the ECU. These message IDs represent the communication objects of the ECUs involved. The data characteristics are not limited to the IDs of CAN messages, but can also be other identifying characteristics.

[0054] In one embodiment of this example, generating real-time behavior information of the target ECU to be detected using the message information includes: parsing the real-time operation instructions of the target ECU from the message information, wherein the real-time operation instructions are used to characterize the control function of the target ECU; and determining the real-time operation instructions as the second real-time behavior information of the ECU.

[0055] The real-time operation command in the behavior profile of the target ECU on the CAN bus refers to the operation function implied in the ECU message data over a period of time. For example, the ECU responsible for emergency braking on the CAN bus will send a signal to brake the vehicle in an emergency, and the real-time operation command is the emergency braking command.

[0056] In one embodiment of this example, generating real-time behavior information of the target ECU to be detected using the message information includes: parsing the real-time communication behavior pattern of the target ECU from the message information, wherein the real-time communication behavior pattern includes statistical features and behavior patterns, the statistical features include the time interval and number of messages sent by the target ECU, and the behavior patterns are used to characterize the sending pattern of the message data; and determining the real-time communication behavior pattern as the third real-time behavior information of the ECU.

[0057] The communication behavior pattern in the behavioral profile of an ECU on a CAN bus refers to the statistical characteristics and behavioral patterns of the ECU's message data over a period of time. By acquiring all message data of the target ECU within the detection period, such as observing the message data sent by the ECU, characteristics such as the time interval between message transmissions, periodic behavior, the average number of messages sent per unit time, and the regularity of the target ECU's message transmission can be calculated.

[0058] In this embodiment, detecting whether the target ECU has been injected with an attack based on the real-time behavior information and the normal behavior profile includes: comparing the real-time behavior information and the normal behavior profile of the ECU set, and determining whether the comparison result meets the preset intrusion conditions; if the comparison result meets the preset intrusion conditions, it is determined that the target ECU has been injected with an attack.

[0059] In this embodiment, comparing the real-time behavior information with the normal behavior profile of the ECU set includes: comparing whether the target ECU is included in the ECU set; comparing whether there is a difference between the real-time communication behavior pattern of the real-time behavior information and the normal communication behavior pattern of the normal behavior profile; comparing whether there is a difference between the real-time data features of the real-time behavior information and the communication object set of the normal behavior profile; and comparing whether there is a difference between the real-time operation instructions of the real-time behavior information and the control function range of the normal behavior profile.

[0060] Optionally, in calling the normal behavior profile of the ECU set on the vehicle network, the method further includes: collecting CAN bus data in a non-attack state over a period of time, and calculating the behavior profile for each ECU. The behavior profile includes ECU data characteristics, functional purpose, and communication behavior pattern. ECU data characteristics include the set of IDs of CAN data sent and received by the ECU, representing the object relationship of ECU communication; functional purpose includes parsing the control function range corresponding to the ECU from the content of the CAN data; communication behavior pattern includes characteristics such as the time interval of ECU message transmission, periodic behavior, and the average number of messages transmitted per unit time.

[0061] The behavioral profile of each ECU is expressed as follows:

[0062]

[0063] m represents the total number of different CAN message IDs received, n represents the total number of different CAN message IDs sent, and k represents the total number of functions of the ECU. The ECU's communication behavior profile... This represents the time interval between messages sent by the ECU. It can describe the average of each time interval over a period of time. A specific example is that within a time period T (the duration of the injection attack detection period), there will be N messages, where T≥1s and N≥2, and there will be a time interval t between adjacent messages. i i = 1, 2, 3, ..., N-1, average Periodicity represents the periodic behavior of the ECU. For ease of formal expression, a specific example is that there are N messages within a time interval T, where T≥1s and N≥3. This represents the time interval between the i-th message and the (i+1)-th message. This represents the average number of messages sent per unit time. For ease of formal expression, a specific example is that there are N messages in time T, where T≥1s and N≥1. In addition, it can also include the ECU's message transmission rules, such as only receiving and not sending, only sending and not receiving, as well as the ECU's transmission mode for each type of message data, such as periodically sending message 1, synchronously sending message 2, and randomly sending message 3, etc.

[0064] In one example, determining whether the comparison result meets the preset intrusion conditions includes: if the comparison result is that the real-time communication behavior pattern of the real-time behavior information differs from the normal communication behavior pattern of the normal behavior profile, calculating the difference value between the real-time communication behavior pattern and the normal communication behavior pattern; determining whether the difference value is within a preset threshold range; and if the difference value is within the preset threshold range, determining that the comparison result meets the preset intrusion conditions.

[0065] In one example, determining whether the comparison result meets the preset intrusion conditions includes: if the comparison result is that the real-time data characteristics of the real-time behavior information are different from the communication object set of the normal behavior profile, or if the comparison result is that the real-time operation instructions of the real-time behavior information are different from the control function range of the normal behavior profile, then the comparison result is determined to meet the preset intrusion conditions.

[0066] If the set of communication objects in the normal behavior profile does not include any of the communication objects in the real-time data features, then the comparison results are considered to be different. If the control function scope of the normal behavior profile does not include any of the operation instructions in the real-time operation instructions, then the comparison results are considered to be different.

[0067] In one example, determining whether the comparison result meets the preset intrusion conditions includes: determining whether the ECU set contains the target ECU; if the ECU set does not contain the target ECU, determining that the comparison result meets the preset intrusion conditions.

[0068] After calculating the normal behavior profile of each ECU, the normal behavior profile is stored. The target CAN bus data to be detected, after calculating real-time behavior information, is compared and analyzed with the previous normal behavior profile of the ECU. If an unidentified situation occurs, an alarm is triggered directly. Alarms are also triggered when there are differences in data characteristics or functional uses. When there are differences in communication behavior patterns, possibly due to signal noise disturbances or packet loss, various strategies can be adopted to reduce the false alarm rate and determine whether it is an attack event. Specifically, this can be the number of times abnormal events occur, or a reasonable range (x-3σ, x+3σ) can be taken for three statistical characteristics, i.e., a preset threshold range, where x represents the mean and σ represents the variance. Specifically, x can be the average of multiple measurements of one of the above-mentioned time intervals, periodic behaviors, and average number of messages sent per unit time, and σ can be the variance of multiple measurements of one of the above-mentioned time intervals, periodic behaviors, and average number of messages sent per unit time. If the value exceeds the reasonable range, it is considered an attack event and an alarm is triggered; otherwise, it is considered normal.

[0069] In this embodiment, obtaining message information on the communication line of the vehicle network includes: obtaining monitoring messages listened to by the monitoring ECU on the communication line of the vehicle network, wherein the monitoring ECU is connected to the communication line of the vehicle network; sending a probe message to the target ECU on the communication line of the vehicle network, and receiving a feedback message returned by the target ECU in response to the probe message; and generating message information using the monitoring message and / or the feedback message.

[0070] The solution in this embodiment can directly connect the intrusion detection ECU to the CAN bus. ECU-1 to ECU-K are ECUs on the CAN bus. In addition to passively monitoring the real-time behavior information of ECUs on the CAN bus, the monitoring ECU can be attached to the CAN bus and can also actively send specific probe messages to the target ECU to obtain the feedback message from the ECU under test, so as to obtain the real-time behavior information of the ECU and then determine whether the ECU is abnormal. Figure 3 This is a schematic diagram of the deployment of the vehicle network intrusion detection system in an embodiment of the present invention. ECU1 to ECUK are normally deployed on the communication line of the vehicle network and are connected in parallel to monitor ECUs, which can listen to other ECUs and obtain detection messages.

[0071] Figure 4 This is a framework diagram of the in-vehicle network intrusion detection method in this invention embodiment. It provides an in-vehicle CAN network intrusion detection method and system, studies the CAN bus intrusion detection problem, and proposes a detection method based on ECU behavior analysis on the CAN bus to identify message injection attacks. By analyzing ECU behavior, the behavioral characteristics of the ECU during communication are obtained, thus acquiring the data characteristics, functional uses, and communication behavior patterns corresponding to different ECUs, thereby constructing a behavioral profile of the ECUs on the CAN bus. By monitoring the message information of the CAN bus, ECU behavior information is automatically generated and compared with the corresponding generated ECU behavior profile. If there is no difference within a certain range, it indicates that the CAN bus has not been attacked; otherwise, it indicates that the CAN bus has been attacked. The technical solution adopted in this invention can detect attackers who first simulate ECU behavior to send similar messages to the messages sent by the simulated ECU, in order to impersonate the ECU and then launch advanced attacks that affect other ECUs.

[0072] Figure 5This is a schematic diagram of the structure of an intrusion detection system for an in-vehicle network according to an embodiment of the present invention. It provides an in-vehicle CAN bus ECU intrusion detection method and system. The system includes: a data receiving module, which obtains all messages on the CAN bus within a certain period of time under non-attack conditions; and a calculation module, which processes and analyzes all messages within a specific time period to calculate a behavioral profile of each ECU, specifically including data characteristics, functional uses, and communication behavior patterns. Data characteristics include a set of IDs of messages sent by the ECU and a set of IDs of messages received by the ECU; functional uses refer to the operational functions implicit in the ECU message data; and communication behavior patterns refer to characteristics such as the time interval between ECU message transmissions, periodic behavior, and the average number of messages transmitted per unit time. The storage module calculates the behavioral profiles of all ECUs under non-attack conditions and stores the behavioral profile of each ECU. The detection module compares the newly received ECU behavioral profile with the existing ECU behavioral profiles in the storage module. If there are differences or the ECU is not identified, an anomaly is identified and an anomaly event is generated. The alarm module receives the anomaly event, analyzes and processes it. If the anomaly event is caused by differences in the behavioral profile, and the difference lies in the characteristics of the communication behavior pattern formed by the behavioral profile, a threshold is set. If the threshold is exceeded, an alarm is triggered, alerting the user that a potential attack may be occurring. If the anomaly event is caused by an unidentified ECU, an alarm is triggered, alerting the user that a potential attack may be occurring. If the anomaly event is caused by differences in the behavioral profile, and the difference lies in the data characteristics or functional purpose of the behavioral profile, an alarm is triggered, alerting the user that a potential attack may be occurring.

[0073] The vehicle network intrusion detection method and system provided in this embodiment determine whether the vehicle has been intruded by comparing the calculated behavioral profile of the ECU with the existing behavioral profile under non-attack conditions. This method can detect advanced attacks such as ECUs controlled by hackers and ECUs disguised to infringe on other ECUs.

[0074] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0075] Example 2

[0076] This embodiment also provides an intrusion detection device for a vehicle network, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0077] Figure 6 This is a structural block diagram of an intrusion detection device for a vehicle network according to an embodiment of the present invention, such as... Figure 6 As shown, the device includes:

[0078] The first acquisition module 60 is used to acquire message information on the communication line of the vehicle network;

[0079] The generation module 62 is used to generate real-time behavior information of the target electronic control unit (ECU) to be detected using the message information;

[0080] The second acquisition module 64 is used to call the normal behavior profile of the ECU set on the vehicle network, wherein the normal behavior profile includes the communication object set, control function range, and normal communication behavior mode of the ECU on the vehicle network when it is in normal working state.

[0081] The detection module 66 is used to detect whether the target ECU has been injected with an attack based on the real-time behavior information and the normal behavior profile.

[0082] Optionally, the generation module includes: a first parsing unit, configured to parse the real-time data features of the target ECU from the message information, wherein the real-time data features are used to characterize the communication object of the target ECU; and a first determining unit, configured to determine the real-time data features as the first real-time behavior information of the ECU.

[0083] Optionally, the generation module includes: a second parsing unit, configured to parse the real-time operation instructions of the target ECU from the message information, wherein the real-time operation instructions are used to characterize the control function of the target ECU; and a second determining unit, configured to determine the real-time operation instructions as the second real-time behavior information of the ECU.

[0084] Optionally, the generation module includes: a third parsing unit, configured to parse the real-time communication behavior pattern of the target ECU from the message information, wherein the real-time communication behavior pattern includes statistical features and behavior patterns, the statistical features include the time interval and number of messages sent by the target ECU, and the behavior patterns are used to characterize the sending pattern of the message data; and a third determining unit, configured to determine the real-time communication behavior pattern as the third real-time behavior information of the ECU.

[0085] Optionally, the detection module includes: a judgment unit, used to compare the real-time behavior information with the normal behavior profile of the ECU set, and judge whether the comparison result meets the preset intrusion conditions; and a determination unit, used to determine that the target ECU has been injected with an attack if the comparison result meets the preset intrusion conditions.

[0086] Optionally, the judgment unit includes: a calculation subunit, used to calculate the difference value between the real-time communication behavior pattern and the normal communication behavior pattern if the comparison result is that the real-time communication behavior pattern of the real-time behavior information is different from the normal communication behavior pattern of the normal behavior profile; a first judgment subunit, used to determine whether the difference value is within a preset threshold range; and a first determination subunit, used to determine that the comparison result meets the preset intrusion conditions if the difference value is within the preset threshold range.

[0087] Optionally, the judgment unit includes: a second determining subunit, used to determine that the comparison result meets the preset intrusion conditions if the real-time data features of the real-time behavior information are different from the communication object set of the normal behavior profile, or if the real-time operation instructions of the real-time behavior information are different from the control function range of the normal behavior profile.

[0088] Optionally, the judgment unit includes: a second judgment subunit, used to judge whether the ECU set contains the target ECU; and a third determination subunit, used to determine that if the ECU set does not contain the target ECU, the comparison result meets the preset intrusion conditions.

[0089] Optionally, the first acquisition module includes: an acquisition unit, configured to acquire monitoring messages listened to by the monitoring ECU on the communication line of the vehicle network, wherein the monitoring ECU is connected to the communication line of the vehicle network; a detection unit, configured to send a detection message to a target ECU on the communication line of the vehicle network and receive a feedback message returned by the target ECU in response to the detection message; and a generation unit, configured to generate message information using the monitoring message and / or the feedback message.

[0090] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0091] Example 3

[0092] Embodiments of the present invention also provide a storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when running.

[0093] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0094] S1, obtain message information on the communication line of the vehicle network;

[0095] S2, using the message information to generate real-time behavior information of the target electronic control unit (ECU) to be detected;

[0096] S3, invoke the normal behavior profile of the ECU set on the vehicle network, wherein the normal behavior profile includes the communication object set, control function range, and normal communication behavior mode of the ECU on the vehicle network when it is in normal working state;

[0097] S4, based on the real-time behavior information and the normal behavior profile, detect whether the target ECU has been injected with an attack.

[0098] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0099] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0100] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0101] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0102] S1, obtain message information on the communication line of the vehicle network;

[0103] S2, using the message information to generate real-time behavior information of the target electronic control unit (ECU) to be detected;

[0104] S3, invoke the normal behavior profile of the ECU set on the vehicle network, wherein the normal behavior profile includes the communication object set, control function range, and normal communication behavior mode of the ECU on the vehicle network when it is in normal working state;

[0105] S4, based on the real-time behavior information and the normal behavior profile, detect whether the target ECU has been injected with an attack.

[0106] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0107] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0108] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0109] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that additional or alternative steps may be used.

[0110] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. An intrusion detection method for a vehicle network, characterized in that, include: Obtain message information from the communication lines of the vehicle network; The real-time behavior information of the target electronic control unit (ECU) to be detected is generated using the message information; The normal behavior profile of the ECU set on the vehicle network is invoked, wherein the normal behavior profile includes the set of communication objects, control function range, and normal communication behavior mode of the ECU on the vehicle network when it is in normal working state; The system detects whether the target ECU has been injected with an attack based on the real-time behavior information and the normal behavior profile.

2. The method according to claim 1, characterized in that, The generation of real-time behavioral information of the target ECU to be detected using the aforementioned message information includes: The real-time data characteristics of the target ECU are parsed from the message information, wherein the real-time data characteristics are used to characterize the communication object of the target ECU; The real-time data features are determined as the first real-time behavior information of the ECU.

3. The method according to claim 1, characterized in that, The generation of real-time behavioral information of the target ECU to be detected using the aforementioned message information includes: The real-time operation instructions of the target ECU are parsed from the message information, wherein the real-time operation instructions are used to characterize the control function of the target ECU; The real-time operation command is determined as the second real-time behavior information of the ECU.

4. The method according to claim 1, characterized in that, The generation of real-time behavioral information of the target ECU to be detected using the aforementioned message information includes: The real-time communication behavior pattern of the target ECU is parsed from the message information. The real-time communication behavior pattern includes statistical features and behavior patterns. The statistical features include the time interval and number of messages sent by the target ECU. The behavior patterns are used to characterize the message data sending pattern. The real-time communication behavior pattern is determined as the third real-time behavior information of the ECU.

5. The method according to claim 1, characterized in that, Detecting whether the target ECU has been injected with an attack based on the real-time behavior information and the normal behavior profile includes: Compare the real-time behavior information with the normal behavior profile of the ECU set to determine whether the comparison result meets the preset intrusion conditions; If the comparison results meet the preset intrusion conditions, it is determined that the target ECU has been injected with an attack.

6. The method according to claim 5, characterized in that, Determining whether the comparison results meet the preset intrusion conditions includes: If the comparison result shows that the real-time communication behavior pattern of the real-time behavior information differs from the normal communication behavior pattern of the normal behavior profile, the difference value between the real-time communication behavior pattern and the normal communication behavior pattern is calculated. Determine whether the difference value is within a preset threshold range; If the difference value is within the preset threshold range, the comparison result is determined to meet the preset intrusion conditions.

7. The method according to claim 5, characterized in that, Determining whether the comparison results meet the preset intrusion conditions includes: If the comparison result shows that the real-time data characteristics of the real-time behavior information differ from the communication object set of the normal behavior profile, or if the comparison result shows that the real-time operation instructions of the real-time behavior information differ from the control function range of the normal behavior profile, the comparison result is determined to meet the preset intrusion conditions.

8. The method according to claim 5, characterized in that, Determining whether the comparison results meet the preset intrusion conditions includes: Determine whether the ECU set contains the target ECU; If the set of ECUs does not contain the target ECU, the comparison result is determined to meet the preset intrusion conditions.

9. The method according to claim 1, characterized in that, Obtaining message information from the communication lines of the vehicular network includes: Acquire monitoring messages listened to by the monitoring ECU on the communication line of the vehicle network, wherein the monitoring ECU is connected to the communication line of the vehicle network; Send a probe message to the target ECU on the communication line of the vehicle network, and receive a feedback message returned by the target ECU in response to the probe message; The monitoring message and / or feedback message are used to generate message information.

10. An intrusion detection device for a vehicle-mounted network, characterized in that, include: The first acquisition module is used to acquire message information on the communication lines of the vehicle network; The generation module is used to generate real-time behavior information of the target electronic control unit (ECU) to be detected using the message information; The second acquisition module is used to call the normal behavior profile of the ECU set on the vehicle network, wherein the normal behavior profile includes the communication object set, control function range, and normal communication behavior mode of the ECU on the vehicle network when it is in normal working state. The detection module is used to detect whether the target ECU has been injected with an attack based on the real-time behavior information and the normal behavior profile.

11. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 9 when it is run.

12. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 1 to 9.

Images