An intrusion detection method and system for a vehicle gateway
By generating a unified CANFD format log through real-time acquisition and reconstruction of Ethernet and CAN bus messages, the inefficiency of cross-network detection by vehicle gateways is solved, and efficient security event response is achieved.
Patent Information
- Application Number
- CN202611184582.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-08-06
- Publication Date
- 2026-11-03
AI Technical Summary
Existing intrusion detection systems for vehicle gateways cannot achieve cross-network collaborative detection between Ethernet and CAN bus, resulting in low efficiency in security incident response.
By collecting Ethernet and CAN bus messages in real time, Ethernet intrusion source logs and bus intrusion source logs are generated and reconstructed into a unified CANFD format log. The logs are then parsed and stored using an on-board T-BOX to achieve cross-network intrusion detection and alarm.
It enables the combined processing of alarm information from Ethernet and CAN bus, improving the efficiency of security event response and avoiding the inefficiency of separate management and reporting.
Smart Images
Figure CN123034981A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of intrusion detection technology for vehicle gateways, specifically relating to an intrusion detection method and system for vehicle gateways. Background Technology
[0002] As the level of intelligent connectivity in automobiles deepens, the vehicle network has formed a hybrid architecture of "Ethernet and CAN bus": Ethernet, with its high bandwidth advantage, has become the core of the vehicle backbone network, responsible for transmitting high data volume information, such as autonomous driving perception data and vehicle network interaction data; the traditional CAN bus, due to its stability and reliability, is still widely used in key areas such as body control and power system, transmitting real-time control commands, such as door opening and closing signals and engine speed signals, which are generally transmitted through the CAN bus.
[0003] While this hybrid architecture improves overall vehicle performance, it introduces cross-network security risks. Attackers can penetrate the Ethernet network through external interfaces and then attack the CAN bus across protocols via the gateway, ultimately gaining unauthorized control of the vehicle, such as tampering with powertrain commands and interfering with vehicle body control. Therefore, intrusion detection is necessary. Existing in-vehicle intrusion detection systems (IDS) have a single detection dimension and are designed for only a single network, such as Ethernet or CAN bus. Furthermore, the alarm log formats of the Ethernet acquisition module and the CAN bus acquisition module are not consistent. For example, Ethernet logs are in JSON format, while CAN logs are in binary format. They generally perform intrusion detection and alarms separately, which cannot achieve cross-network collaborative detection. They need to be managed and reported separately, resulting in low efficiency in security incident response.
[0004] In summary, there is an urgent need for a method that can adapt to the hardware resources of vehicle gateways and achieve integrated collaborative detection of Ethernet and CAN buses. Summary of the Invention
[0005] To address this issue, the present invention provides an intrusion detection method and system for vehicle gateways, thereby solving the problem that existing intrusion detection methods for vehicle gateways cannot perform cross-network collaborative detection, resulting in low security event response efficiency.
[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides an intrusion detection method for vehicle gateways, comprising: The system collects Ethernet packets destined for the vehicle gateway in real time and detects intrusions. If an Ethernet intrusion is detected, an Ethernet intrusion source log is generated. Real-time acquisition of CAN bus messages to the vehicle gateway and detection of intrusions; if a bus intrusion is detected, a bus intrusion source log is generated. The Ethernet intrusion source log and the bus intrusion source log are reconstructed sequentially to obtain CANFD format logs; alarm frames are generated based on the CANFD format logs of the Ethernet intrusion source log and the bus intrusion source log. The alarm frame is parsed by the vehicle-mounted T-BOX to obtain the alarm log and store it.
[0007] Further, the Ethernet intrusion source log and the bus intrusion source log are reconstructed sequentially to obtain CANFD format logs; an alarm frame is generated based on the CANFD format logs of the Ethernet intrusion source log and the bus intrusion source log, including: The Ethernet intrusion source log is reconstructed into a first alarm entry of a first preset byte length; the first alarm entry is a CANFD format log. The bus intrusion source log is reconstructed into a second alarm entry of a second preset byte length; the second alarm entry is a CANFD format log. The alarm frame is obtained by packaging and encapsulating the first alarm entry and the second alarm entry into a frame.
[0008] Furthermore, the Ethernet intrusion source log includes multiple Ethernet log fields and field information corresponding to each Ethernet log field. The step of reconstructing the Ethernet intrusion source log into a first alarm entry of a first preset byte length includes: A first alarm entry with a preset length of the first preset byte; Obtain the transformation strategy for each Ethernet log field in the Ethernet intrusion source log; Each field information is converted according to the corresponding conversion strategy to obtain the corresponding byte data. Each byte data is then assigned to the corresponding byte position of the first alarm entry to complete the reconstruction of the Ethernet intrusion source log.
[0009] Furthermore, the bus intrusion source log includes multiple bus log fields and field information corresponding to each bus log field; the step of reconstructing the bus intrusion source log into a second alarm entry of a second preset byte length includes: A second alarm entry with a preset length of the second preset byte; Obtain the conversion strategy for each bus log field in the bus intrusion source log; Each field information is converted according to the corresponding conversion strategy to obtain the corresponding byte data. Each byte data is then assigned to the corresponding byte position of the second alarm entry to complete the reconstruction of the bus intrusion source log.
[0010] Furthermore, the real-time acquisition of Ethernet packets towards the vehicle gateway and intrusion detection, if an Ethernet intrusion is detected, generates an Ethernet intrusion source log, including: Capture Ethernet packets within a time window in real time using bypass mode; After filtering broadcast frames and error frames from the Ethernet packets, valid packet data is obtained. The valid message data is parsed layer by layer from the data link layer to the transport layer according to the OSI seven-layer model, and then the Ethernet key fields are extracted to generate a stream 5-tuple tag; the Ethernet key fields include source IP, destination IP, source port, destination port, protocol type, TCP packet, UDP packet, and ICMP packet; The stream quintuple tag and the statistical quantity of the corresponding Ethereum key field are stored as key-value pairs as associated data; the stream quintuple tag is the key, and the statistical quantity of the corresponding Ethereum key field is the value. If the value in the associated data matches the characteristics of the first preset detection strategy, then the attack type of the associated data is determined to be the attack type corresponding to the first preset detection strategy. The Ethernet intrusion source log is obtained by merging and storing the attack type corresponding to the first preset detection strategy with the source IP, destination IP, source port, destination port and protocol type in the associated data.
[0011] Furthermore, the real-time acquisition of CAN bus messages to the vehicle gateway and intrusion detection, if a bus intrusion is detected, generates a bus intrusion source log, including: In bypass mode, all transmitted messages on the CAN bus are continuously collected within a time window as CAN bus messages. After parsing the CAN bus message, key bus fields are extracted to obtain key bus data. The key bus fields include CANID, bus channel, data length code, complete data segment content, message period, sequence, DLC data, signal value range, signal value change rate, logical relationship between signals, format and status of network management messages, bus load rate, and replay data. If the bus key data matches the characteristics of the second preset detection strategy, then the attack type, the triggered detection strategy, the triggered detection module corresponding to the second preset detection strategy are merged and stored with the CANID and the bus channel in the bus key data to obtain the Ethernet intrusion source log.
[0012] Furthermore, before obtaining the key bus data by parsing the CAN bus message and extracting the key bus fields, the process also includes: Based on the preset CANID whitelist, regular messages that do not require detection are filtered out from the CAN bus messages.
[0013] Furthermore, it also includes: The Ethernet intrusion source log, bus intrusion source log, and alarm frames are all equipped with a buffer queue to alleviate the computational pressure on the corresponding computing units.
[0014] Furthermore, the parsed alarm logs are obtained and stored, including: The parsed alarm logs are stored in the vehicle's storage space or on a cloud server.
[0015] Secondly, the present invention provides an intrusion detection system for vehicle gateways, comprising: The Ethernet acquisition module is used to collect Ethernet packets facing the vehicle gateway in real time and detect intrusions. If an Ethernet intrusion is detected, an Ethernet intrusion source log is generated. The bus acquisition module is used to acquire CAN bus messages to the vehicle gateway in real time and detect intrusions. If a bus intrusion is detected, a bus intrusion source log is generated. The log management module is used to reconstruct the Ethernet intrusion source log and the bus intrusion source log in sequence to obtain CANFD format logs; and to generate alarm frames based on the CANFD format logs of the Ethernet intrusion source log and the bus intrusion source log. It is also used to parse the alarm frame through the vehicle-mounted T-BOX to obtain alarm logs and store them.
[0016] The present invention, by adopting the above technical solution, has at least the following beneficial effects: This paper presents an intrusion detection method and system for vehicle gateways. Intrusions are detected by real-time acquisition of Ethernet packets, and an Ethernet intrusion source log is generated based on the detected Ethernet intrusions. Intrusions are also detected by real-time acquisition of CAN bus packets, and a bus intrusion source log is generated based on the detected bus intrusions. The Ethernet and bus intrusion source logs are reconstructed to obtain a unified CANFD format log. This unified CANFD format log can be directly processed using a T-BOX to obtain a unified alarm log. This method merges Ethernet and CAN bus alarm information through unified logging, achieving cross-network intrusion detection alarms, effectively avoiding separate management and reporting, and improving security incident response efficiency.
[0017] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description
[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0019] Figure 1This is a flowchart illustrating an intrusion detection method for vehicle gateways according to an exemplary embodiment of the present invention; Figure 2 An exemplary embodiment of the present invention illustrates a schematic block diagram of an intrusion detection system for vehicle gateways.
[0020] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. Detailed Implementation
[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail below. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other implementation methods obtained by those skilled in the art without creative effort are within the scope of protection of this invention.
[0022] As the level of intelligent connectivity in automobiles deepens, the vehicle network has formed a hybrid architecture that combines Ethernet and CAN bus. While improving the overall vehicle performance, this hybrid architecture also introduces cross-network security risks. Existing in-vehicle intrusion detection systems (IDS) have a single detection dimension and cannot complete cross-network collaborative detection, resulting in low efficiency in responding to security incidents.
[0023] This invention provides an intrusion detection method and system for vehicle gateways. It detects intrusions by collecting Ethernet packets in real time, generates an Ethernet intrusion source log based on the detected Ethernet intrusions, and detects intrusions by collecting CAN bus packets in real time, generating a bus intrusion source log based on the detected bus intrusions. The Ethernet and bus intrusion source logs are reconstructed to obtain a unified CANFD format log, facilitating subsequent unified processing, enabling cross-network intrusion detection and alarm, and improving security event response efficiency.
[0024] It should be noted that CAN (Controller Area Network) is a two-wire communication line shared by all electronic control units (ECUs) inside a car, replacing the traditional wiring method of one wire per device. It allows modules such as the engine, transmission, brakes, lights, and air conditioning to exchange signals. It is the most basic vehicle communication bus for both fuel vehicles and new energy vehicles, and was designed by Bosch specifically for the harsh electromagnetic environment of automobiles. CANFD (CAN Flexible Data-rate) is a data frame format that is compatible with the traditional CAN 2.0. A single frame can be up to 64 bytes, supports dual-segment variable rate, and has stronger CRC check. It is widely used in BMS, domain control, and autonomous driving of new energy vehicles. OSI seven-layer model: OSI (Open Systems Interconnection) is a network layering standard developed by the International Organization for Standardization (ISO). IP is the unified carrier of the network layer. TCP packets, UDP packets, and ICMP packets are all encapsulated within IP packets.
[0025] The methods and systems of the present invention will be described below through specific embodiments.
[0026] Please see Figure 1 , Figure 1 This is a flowchart illustrating an intrusion detection method for vehicle gateways according to an exemplary embodiment of the present invention. See also... Figure 1 The method includes: Step S11: Collect Ethernet packets to the vehicle gateway in real time and detect intrusions. If an Ethernet intrusion is detected, generate an Ethernet intrusion source log. Step S12: Collect CAN bus messages to the vehicle gateway in real time and detect intrusions. If a bus intrusion is detected, generate a bus intrusion source log. Step S13: After reconstructing the Ethernet intrusion source log and the bus intrusion source log in sequence, CANFD format logs are obtained; an alarm frame is generated based on the CANFD format logs of the Ethernet intrusion source log and the bus intrusion source log. Step S14: After parsing the alarm frame through the vehicle-mounted T-BOX, obtain the alarm log and store it.
[0027] It should be noted that the technical solution provided in this embodiment can be used as a plug-in in existing vehicle systems or applications in practice. Applicable scenarios include, but are not limited to, intrusion detection for vehicle gateways.
[0028] It is understood that the method provided in this embodiment merges the alarm information of Ethernet and CAN bus through unified logging, realizing cross-network intrusion detection alarms, effectively avoiding separate management and reporting, and improving the efficiency of security event response.
[0029] In practice, step S11, "real-time acquisition of Ethernet packets facing the vehicle gateway and detection of intrusions, and generation of Ethernet intrusion source logs if Ethernet intrusions are detected," includes: capturing Ethernet packets within a time window in bypass mode in real time; filtering broadcast frames and error frames in the Ethernet packets to obtain valid packet data; parsing the valid packet data layer by layer from the data link layer to the transport layer according to the OSI seven-layer model, extracting Ethernet key fields, and generating flow 5-tuple tags; Ethernet key fields include source IP, destination IP, source port, destination port, protocol type, TCP packets, UDP packets, and ICMP packets; storing the flow 5-tuple tags and the corresponding statistical counts of Ethernet key fields as key-value pairs as associated data; using the flow 5-tuple tags as keys and the corresponding statistical counts of Ethernet key fields as values; if the values in the associated data match the characteristics of the first preset detection strategy, determining that the attack type of the associated data is the attack type corresponding to the first preset detection strategy; merging the attack type corresponding to the first preset detection strategy with the source IP, destination IP, source port, destination port, and protocol type in the associated data to obtain the Ethernet intrusion source log.
[0030] It should be noted that the time window can be set according to specific business needs. Ethernet packets are captured in real time in bypass mode through the hardware interface provided by the gateway vendor, with the acquisition rate matching the 100Mbps bandwidth. Hardware caching mechanism ensures no packet loss. The acquisition targets cover TCP, UDP, and ICMP protocol packets, and automatically filters invalid data such as broadcast frames and error frames. The acquired raw packets are stored in the Ethernet packet cache queue, with a queue depth supporting 200 packets and a single packet cache of 128 bytes, meeting the storage requirements of Layer 2-4 headers and payload prefixes.
[0031] Specifically, following the OSI seven-layer model, the data link layer is parsed layer by layer from the transport layer to extract key fields and generate a "flow 5-tuple" (source IP, destination IP, source port, destination port, and protocol type). The specific parsing process is as follows: At the data link layer, the Ethernet frame header is parsed to extract the 6-byte source MAC address and the 6-byte destination MAC address, and invalid frames that are not in accordance with the vehicle Ethernet standard are filtered out; at the network layer, the IP packet header is parsed to extract the 4-byte source IP address, the 4-byte destination IP address, and the 1-byte protocol type (0x06=TCP, 0x11=UDP, 0x01=ICMP); at the transport layer, TCP packets are extracted to extract the 2-byte source port, the 2-byte destination port, and the 1-byte flag (SYN=0x02, ACK=0x10, etc.); UDP packets are extracted to extract the source port and destination port; and ICMP packets are extracted to extract the type and code fields.
[0032] It should be noted that the intrusion detection execution cycle is 10ms. Each time, the statistical count within the window is traversed, and an alarm is triggered immediately if the threshold is exceeded. Using the flow 5-tuple as the core identifier and the destination IP as the statistical key, a sliding time window mechanism is used to count the number of packets that meet specific attack characteristics. The count is compared with the built-in detection strategy library in real time to determine the intrusion. The detection strategy focuses on typical DoS scenarios of automotive Ethernet. The specific detection strategies are shown in Table 1 below: Table 1 It should be noted that if the values in the associated data meet the characteristics of the first preset detection strategy: "1-second window: a single source IP sends more than 500 TCP packets with only SYN set to the same destination IP; 10-second window: ≥20 different source IPs send more than 1000 TCP packets with only SYN set to the same destination IP", then the attack type corresponding to the associated data is "TCP SYN Flood".
[0033] It should be noted that the Ethernet intrusion source log uses a non-redundant, fixed-length, compact binary structure, with each entry having a fixed length of 25 bytes, adapted to the gateway MCU memory resources. The specific data structure definition is as follows: 1. Timestamp field (4 bytes) uint32_t timestamp_ms; represents the timestamp of the alarm trigger. 2. Alarm Identifier Field (4 bytes) uint16_t rule_id; Represents the ID of the triggering detection rule. `uint8_t attack_type;` represents the attack subtype and can be assigned the following values: 0x01 - ICMP Flood, 0x02 - TCP SYN Flood, 0x03 - TCP ACK Flood, 0x04 - TCP SYN-ACK Flood, 0x05 - TCP FIN-ACK Flood, 0x06 - TCP RST-ACK Flood, 0x07 - UDP Flood. uint8_t window_size; Characterization detection time window 3. Network Feature Field (13 bytes) uint32_t src_ip; represents the IP address of the attack source. uint32_t dst_ip; represents the target IP address of the attack. uint16_t src_port; Represents the port of the attack source (valid for TCP / UDP scenarios; fill in 0x0000 for ICMP scenarios). uint16_t dst_port; Represents the target port of the attack (valid for TCP / UDP scenarios; fill in 0x0000 for ICMP scenarios). `uint8_t protocol;` represents the protocol type and can be assigned values such as: 0x01-ICMP, 0x06-TCP, 0x11-UDP. 4. Statistical feature field (4 bytes) uint32_t packet_count; represents the number of abnormal data packets within the time window; Specifically, in the Ethernet intrusion source log example, if the vehicle gateway detects a TCP SYN Flood attack from an external T-Box interface, the values of each field in the generated Ethernet intrusion source log are as follows: timestamp_ms: 0x000F4240 (time) rule_id: 0x0002 (Trigger detection rule) attack_type: 0x02 (corresponds to TCP SYN Flood attack type) window_size: 0x01 (Detection time window is 1 second) src_ip: 0xC0A80164 (Attack source address) dst_ip: 0xC0A80101 (target address for attack) src_port: 0x04D2 (source port) dst_port: 0x1F90 (destination port) protocol: 0x06 (TCP protocol) packet_count: 0x0000026C (decimal 620, 620 SYN packets detected within 1 second, exceeding the threshold of 500).
[0034] It is understood that the technical solution provided in this embodiment, by acquiring data in bypass mode, does not affect CAN bus communication transmission and can also better acquire Ethernet packets for the vehicle gateway.
[0035] In practice, step S12, "real-time acquisition of CAN bus messages to the vehicle gateway and detection of intrusions, and generation of bus intrusion source logs if bus intrusions are detected," includes: continuously acquiring all transmission messages on the CAN bus within a time window in bypass mode as CAN bus messages; parsing the CAN bus messages and extracting key bus fields to obtain key bus data; key bus fields include CANID, bus channel, data length code, complete data segment content, message period, sequence, DLC data, signal value range, signal value change rate, logical relationship between signals, format and status of network management messages, bus load rate, and replay data; if the key bus data matches the characteristics of the second preset detection strategy, the attack type, triggered detection strategy, triggered detection module, and CANID and bus channel in the key bus data are merged and stored to obtain the Ethernet intrusion source log.
[0036] It should be noted that the continuous data collection time window is set according to specific business needs; the CANIDS component is deployed on the vehicle gateway MCU and adopts a four-layer progressive detection model of "message layer - signal layer - protocol layer - traffic layer" for the whole vehicle CAN bus, covering the risks of the entire control layer network.
[0037] It should be noted that, according to the CAN / CANFD protocol specification, the core fields required for detection are extracted by parsing the message: 1. Arbitration field: extract CANID; 2. Control field: extract Data Length Code (DLC); 3. Data field: extract the complete data segment content, including "bus channel, message period, sequence, DLC data, signal value range, signal value change rate, logical relationship between signals, format and status of network management messages, bus load rate and replay data"; 4. Timestamp: record the timestamp of message reception, providing a time reference for timing-based detection such as periodicity and flow.
[0038] Specifically, the intrusion detection adopts a fixed-cycle scheduling mechanism, which is divided into a policy loading unit, a 500ms cycle detection group, and a 1000ms cycle detection group. The engine takes the packets in the cache queue as input, performs layered detection according to a preset cycle, and performs alarm judgment uniformly after all detections are completed.
[0039] It should be noted that intrusion detection includes four types of capabilities: packet detection, signal detection, protocol detection, and traffic detection. The specific detection strategies are shown in Table 2 below. Table 2 It should be noted that if any detection strategy is triggered, it is determined that an intrusion has occurred, and an 18-byte fixed-length bus intrusion source log is immediately generated and stored in the alarm information queue. For example, if the key bus data meets the characteristics of the second preset detection strategy: "the actual DLC is inconsistent with the design DLC (e.g., design DLC = 8 bytes, actual = 6 bytes)," then the attack type is a DLC legitimacy attack.
[0040] The bus intrusion source log data structure adopts a non-redundant, fixed-length, compact binary structure, with each log entry having a fixed length of 18 bytes, as defined below: 1. Timestamp field (4 bytes) uint32_t timestamp_us; represents the timestamp of the alarm trigger. 2. Alarm Identifier Field (4 bytes) uint16_t rule_id; Represents the ID of the triggering detection rule. uint8_t module_type; Represents the detection module type: 0x00 - Message detection, 0x01 - Signal detection, 0x02 - Protocol detection, 0x03 - Traffic detection `uint8_t sub_type;` represents the detection subtype, which corresponds one-to-one with the subtype encoding of each module. 3. Message Identifier Field (5 bytes) uint32_t can_id; Represents the ID of an abnormal CAN message. uint8_t bus_channel; represents the bus channel to which the exception belongs. 4. Abnormal characteristic field (5 bytes) `uint32_t abnormal_value;` represents the multiplexing anomaly characteristic: message detection stores the actual DLC / cycle value, signal detection stores the signal start bit and value, and protocol detection stores the session state. uint8_t dlc; Represents the actual data length of the exception message. Specifically, taking the bus intrusion source log as an example (CAN bus replay attack scenario), a vehicle gateway detected a message replay attack on the power CAN bus. The values of each field in the corresponding generated source log are as follows: timestamp_us: 0x000F4240 (timestamp) rule_id: 0x0015 (Trigger detection rule) module_type: 0x03 (Traffic Detection Module) sub_type: 0x03 (Detects subtype as packet replay attack) can_id: 0x00000123 (Exception message ID) bus_channel: 0x01 (CAN channel of the bus it belongs to) abnormal_value: 0x00000007 (decimal 7, the same message appears 7 times within 1 second, exceeding the threshold of 5 times) dlc: 0x08 (The exception message data length code is 8, corresponding to 8 bytes of data).
[0041] In practice, step S13, "after reconstructing the Ethernet intrusion source log and the bus intrusion source log in sequence, both are obtained as CANFD format logs; an alarm frame is generated based on the CANFD format logs of the Ethernet intrusion source log and the bus intrusion source log," includes: reconstructing the Ethernet intrusion source log into a first alarm entry of a first preset byte length; the first alarm entry is a CANFD format log; reconstructing the bus intrusion source log into a second alarm entry of a second preset byte length; the second alarm entry is a CANFD format log; and packaging and frame encapsulating the first alarm entry and the second alarm entry to obtain an alarm frame.
[0042] It should be noted that the first preset byte length can be set according to specific needs, with a default of 16, to adapt to the CANFD data field packaging requirements; the second preset byte length can be set according to specific business needs, with a default of 8, and is fully compatible with the vehicle's native CANIDS format.
[0043] Specifically, the Ethernet intrusion source log includes multiple Ethernet log fields and field information corresponding to each Ethernet log field. The Ethernet intrusion source log is reconstructed into a first alarm entry of a first preset byte length, including: setting a first alarm entry of a first preset byte length; obtaining the conversion strategy of each Ethernet log field in the Ethernet intrusion source log; converting each field information according to the corresponding conversion strategy to obtain the corresponding byte data; and allocating each byte data to the corresponding byte position of the first alarm entry to complete the reconstruction of the Ethernet intrusion source log.
[0044] It should be noted that the Ethernet intrusion source log reconstruction adopts a compression mapping method. The Ethernet log field conversion strategy is shown in Table 3 below. For portless scenarios, the source port and destination port fields are filled with 0x0000. Table 3 Specifically, the bus intrusion source log includes multiple bus log fields and field information corresponding to each bus log field; the bus intrusion source log is reconstructed into a second alarm entry of a second preset byte length, including: a second alarm entry of a second preset byte length; obtaining the conversion strategy of each bus log field in the bus intrusion source log; converting each field information according to the corresponding conversion strategy to obtain the corresponding byte data, and allocating each byte data to the corresponding byte position of the second alarm entry to complete the reconstruction of the bus intrusion source log.
[0045] It should be noted that the bus intrusion source log is reconstructed using a compression mapping method. The conversion strategy for bus log fields is shown in Table 4 below. Table 4 It is understood that the technical solution provided in this embodiment, by unifying the data format through a conversion strategy, can effectively simplify subsequent processing steps and improve efficiency.
[0046] In practice, step S14, "after parsing the alarm frame through the vehicle-mounted T-BOX, obtain the alarm log and store it", includes: storing the parsed alarm log in the vehicle-mounted storage space or cloud server.
[0047] It is understood that the technical solution provided in this embodiment stores alarm logs in the vehicle space or cloud server for subsequent intrusion detection analysis. The alarm logs contain intrusion alarms from both Ethernet and CAN bus, thus achieving cross-network intrusion detection alarms.
[0048] In practice, this also includes: Ethernet intrusion source logs, bus intrusion source logs, and alarm frames are all equipped with buffer queues to alleviate the computational pressure on the corresponding computing units.
[0049] Please see Figure 2 , Figure 2 This is a schematic block diagram illustrating an intrusion detection system for vehicle gateways, as shown in an exemplary embodiment of the present invention. See also... Figure 2 The intrusion detection system 100 for vehicle gateways includes: Ethernet acquisition module 101 is used to collect Ethernet packets facing the vehicle gateway in real time and detect intrusions. If an Ethernet intrusion is detected, an Ethernet intrusion source log is generated. The bus acquisition module 102 is used to acquire CAN bus messages to the vehicle gateway in real time and detect intrusions. If a bus intrusion is detected, a bus intrusion source log is generated. The log management module 103 is used to reconstruct the Ethernet intrusion source log and the bus intrusion source log in sequence to obtain CANFD format logs; generate alarm frames based on the CANFD format logs of the Ethernet intrusion source log and the bus intrusion source log; and also to parse the alarm frames through the vehicle T-BOX to obtain alarm logs and store them.
[0050] It should be noted that the system provided in this embodiment is applicable to scenarios including but not limited to: intrusion detection of vehicle gateways.
[0051] It is understood that the system provided in this embodiment merges the alarm information of Ethernet and CAN bus through unified logging, realizing cross-network intrusion detection alarms, effectively avoiding separate management and reporting, and improving the efficiency of security event response.
[0052] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.
[0053] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0054] It should also be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.
[0055] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.
[0056] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0057] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.
Claims
1. An intrusion detection method for vehicle gateways, characterized in that, The method includes: The system collects Ethernet packets destined for the vehicle gateway in real time and detects intrusions. If an Ethernet intrusion is detected, an Ethernet intrusion source log is generated. Real-time acquisition of CAN bus messages to the vehicle gateway and detection of intrusions; if a bus intrusion is detected, a bus intrusion source log is generated. The Ethernet intrusion source log and the bus intrusion source log are reconstructed sequentially to obtain CANFD format logs; alarm frames are generated based on the CANFD format logs of the Ethernet intrusion source log and the bus intrusion source log. The alarm frame is parsed by the vehicle-mounted T-BOX to obtain the alarm log and store it.
2. The intrusion detection method for vehicle gateways according to claim 1, characterized in that, The Ethernet intrusion source log and the bus intrusion source log are reconstructed sequentially to obtain CANFD format logs; An alarm frame is generated based on the CANFD format logs of the Ethernet intrusion source log and the bus intrusion source log, including: The Ethernet intrusion source log is reconstructed into a first alarm entry of a first preset byte length; the first alarm entry is a CANFD format log. The bus intrusion source log is reconstructed into a second alarm entry of a second preset byte length; the second alarm entry is a CANFD format log. The alarm frame is obtained by packaging and encapsulating the first alarm entry and the second alarm entry into a frame.
3. The intrusion detection method for vehicle gateways according to claim 2, characterized in that, The Ethernet intrusion source log includes multiple Ethernet log fields and field information corresponding to each Ethernet log field. The step of reconstructing the Ethernet intrusion source log into a first alarm entry of a first preset byte length includes: A first alarm entry with a preset length of the first preset byte; Obtain the transformation strategy for each Ethernet log field in the Ethernet intrusion source log; Each field information is converted according to the corresponding conversion strategy to obtain the corresponding byte data. Each byte data is then assigned to the corresponding byte position of the first alarm entry to complete the reconstruction of the Ethernet intrusion source log.
4. The intrusion detection method for vehicle gateways according to claim 2, characterized in that, The bus intrusion source log includes multiple bus log fields and field information corresponding to each bus log field; The step of reconstructing the bus intrusion source log into a second alarm entry of a second preset byte length includes: A second alarm entry with a preset length of the second preset byte; Obtain the conversion strategy for each bus log field in the bus intrusion source log; Each field information is converted according to the corresponding conversion strategy to obtain the corresponding byte data. Each byte data is then assigned to the corresponding byte position of the second alarm entry to complete the reconstruction of the bus intrusion source log.
5. The intrusion detection method for vehicle gateways according to claim 1, characterized in that, The system collects Ethernet packets facing the vehicle gateway in real time and detects intrusions. If an Ethernet intrusion is detected, an Ethernet intrusion source log is generated, including: Capture Ethernet packets within a time window in real time using bypass mode; After filtering broadcast frames and error frames from the Ethernet packets, valid packet data is obtained. The valid message data is parsed layer by layer from the data link layer to the transport layer according to the OSI seven-layer model, and then the Ethernet key fields are extracted to generate a stream 5-tuple tag; the Ethernet key fields include source IP, destination IP, source port, destination port, protocol type, TCP packet, UDP packet, and ICMP packet; The stream quintuple tag and the statistical quantity of the corresponding Ethereum key field are stored as key-value pairs as associated data; the stream quintuple tag is the key, and the statistical quantity of the corresponding Ethereum key field is the value. If the value in the associated data matches the characteristics of the first preset detection strategy, then the attack type of the associated data is determined to be the attack type corresponding to the first preset detection strategy. The Ethernet intrusion source log is obtained by merging and storing the attack type corresponding to the first preset detection strategy with the source IP, destination IP, source port, destination port and protocol type in the associated data.
6. The intrusion detection method for vehicle gateways according to claim 1, characterized in that, The system collects CAN bus messages to the vehicle gateway in real time and detects intrusions. If a bus intrusion is detected, a bus intrusion source log is generated, including: In bypass mode, all transmitted messages on the CAN bus are continuously collected within a time window as CAN bus messages. After parsing the CAN bus message, key bus fields are extracted to obtain key bus data. The key bus fields include CANID, bus channel, data length code, complete data segment content, message period, sequence, DLC data, signal value range, signal value change rate, logical relationship between signals, format and status of network management messages, bus load rate, and replay data. If the bus key data matches the characteristics of the second preset detection strategy, then the attack type, the triggered detection strategy, the triggered detection module corresponding to the second preset detection strategy are merged and stored with the CANID and the bus channel in the bus key data to obtain the Ethernet intrusion source log.
7. The intrusion detection method for vehicle gateways according to claim 6, characterized in that, Before obtaining the key bus data by parsing the CAN bus message and extracting the key bus fields, the process also includes: Based on the preset CANID whitelist, regular messages that do not require detection are filtered out from the CAN bus messages.
8. The intrusion detection method for vehicle gateways according to claim 1, characterized in that, Also includes: The Ethernet intrusion source log, bus intrusion source log, and alarm frames are all equipped with a buffer queue to alleviate the computational pressure on the corresponding computing units.
9. The intrusion detection method for vehicle gateways according to claim 1, characterized in that, The parsed alarm logs are obtained and stored, including: The parsed alarm logs are stored in the vehicle's storage space or on a cloud server.
10. An intrusion detection system for vehicle gateways, characterized in that, include: The Ethernet acquisition module is used to collect Ethernet packets facing the vehicle gateway in real time and detect intrusions. If an Ethernet intrusion is detected, an Ethernet intrusion source log is generated. The bus acquisition module is used to acquire CAN bus messages to the vehicle gateway in real time and detect intrusions. If a bus intrusion is detected, a bus intrusion source log is generated. The log management module is used to reconstruct the Ethernet intrusion source log and the bus intrusion source log in sequence to obtain CANFD format logs. An alarm frame is generated based on the CANFD format logs of the Ethernet intrusion source log and the bus intrusion source log; It is also used to parse the alarm frame through the vehicle-mounted T-BOX to obtain alarm logs and store them.