Vehicle-mounted aposematic defense strategy selection method, system, medium and device

Abstract

The application provides a vehicle-mounted metaverse defense strategy selection method, system, medium and equipment, and belongs to the technical field of vehicle-mounted network security. The method collects communication behavior data in a vehicle-mounted network; analyzes and processes the collected communication behavior data, extracts attack behavior characteristics according to the time sequence of attack occurrence, and generates an attack characteristic vector; an immune memory library is established, and the mapping relationship between historical attack characteristic vectors and corresponding defense strategies is stored in the immune memory library; when a new attack behavior is detected, the characteristics of the current attack behavior are matched with the historical attack characteristic vectors in the immune memory library in terms of similarity, if the matching is successful, the defense strategy corresponding to the attack behavior is extracted from the immune memory library, and the defense strategy is deployed into a vehicle-mounted metaverse defense system. The above method can improve the defense response speed, reduce the consumption of system computing resources, and make it more difficult for attackers to implement attacks by exploiting system vulnerabilities.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security technology, and in particular to a method, system, medium, and device for selecting vehicle-mounted mimicry defense strategies. Background Technology

[0002] With the development of intelligent connected vehicles, vehicles are increasingly connecting to external networks through various communication interfaces such as in-vehicle Ethernet, cellular communication, WiFi, and Bluetooth, transforming vehicles into complex mobile information systems. At the same time, vehicle networks are facing increasingly severe cybersecurity threats, such as remote intrusion, malicious control, data theft, and denial-of-service attacks.

[0003] To enhance the security capabilities of in-vehicle systems, in-vehicle intrinsic security technologies have been proposed in recent years. These technologies introduce uncertainty and dynamism, making it difficult for attackers to reliably exploit system vulnerabilities. One important technical approach is mimicry defense. Mimicry defense constructs a dynamic, heterogeneous operating environment, enabling the system to continuously change its operating state in the face of attacks, thereby increasing the difficulty of attacks.

[0004] Among existing mimicry defense technologies, a typical vehicle network security defense method is based on a defense strategy selection mechanism that combines attack detection and rule matching. This method typically includes the following steps: real-time monitoring of communication behavior in the vehicle network using an in-vehicle intrusion detection system; when abnormal communication behavior is detected, matching and identifying the attack behavior using a rule base or feature base; selecting the corresponding defense strategy from a pre-set defense strategy library based on the identification results; and deploying the selected defense strategy to the vehicle system, such as activating a mimicry deception node, switching system configurations, or blocking communication connections. In this approach, the defense strategy library is usually manually configured or designed based on experience, and the system directly matches the corresponding defense strategy according to the attack type.

[0005] While the aforementioned existing technologies can achieve vehicle network security protection to a certain extent, they typically employ real-time analysis when facing attacks. Each attack requires re-matching of features and recalculating of strategies, resulting in wasted computing resources and increased defense decision-making time. In vehicle systems with high real-time requirements, this can easily cause response delays, leading to low defense response efficiency. Summary of the Invention

[0006] This invention aims to solve at least one of the technical problems existing in the prior art, and proposes a method, system, medium and device for selecting vehicle-mounted mimicry defense strategies.

[0007] In a first aspect, embodiments of the present invention provide a method for selecting a vehicle-mounted mimicry defense strategy, comprising the following steps:

[0008] S100: Collect communication behavior data in the vehicle network;

[0009] S200. Analyze and process the collected communication behavior data, extract attack behavior features according to the time sequence of the attack, and generate an attack feature vector.

[0010] S300. Establish an immune memory bank, which stores the mapping relationship between historical attack feature vectors and corresponding defense strategies.

[0011] S400. When a new attack behavior is detected, the characteristics of the current attack behavior are matched with the historical attack feature vectors in the immune memory bank. If the match is successful, the defense strategy corresponding to the attack behavior is extracted from the immune memory bank and the defense strategy is deployed to the vehicle-mounted mimicry defense system.

[0012] Furthermore, in step S100, communication behavior data in the vehicle network is collected by the vehicle network security monitoring module. The communication behavior data includes network access data, port access behavior, protocol request information, and ECU communication records.

[0013] Furthermore, in step S400, the similarity matching between the features of the current attack behavior and the historical attack feature vectors in the immune memory bank is performed using semantic similarity matching.

[0014] Furthermore, in step S400, if multiple defense strategies are matched, the defense affinity is calculated using the defense affinity calculation formula, and the defense strategy with the highest defense affinity is selected as the optimal strategy for deployment. The defense affinity calculation formula is as follows:

[0015]

[0016] in, To defend against affinity; The detection rate is the ratio of the number of detected attacks to the number of actual attacks. The interception rate is the ratio of the number of attacks that were lured or blocked to the number of attacks that were detected. For resource expenditure; Weighted by detection rate; Weighted by interception rate; This represents the weight of resource overhead.

[0017] Furthermore, in step S400, the defense strategy includes launching a port spoofing trap, launching a system software spoofing trap, launching a system information spoofing trap, and triggering a mimicry transformation mechanism.

[0018] Furthermore, in step S400, when the features of the current attack behavior cannot be matched with historical attack patterns in the immune memory bank, multiple candidate defense strategies are generated through the mimicry adjudication module, and the optimal defense strategy is selected based on the actual defense effect.

[0019] Furthermore, after the attack ends, the characteristics of the current attack behavior and the optimal defense strategy are stored in the immune memory bank.

[0020] Secondly, embodiments of the present invention provide a vehicle-mounted mimicry defense strategy selection system, including:

[0021] The data acquisition module is used to collect communication behavior data in the vehicle network;

[0022] The generation module is used to analyze and process the collected communication behavior data, extract attack behavior features according to the time sequence of the attack, and generate attack feature vectors.

[0023] The module is used to build an immune memory bank, which stores the mapping relationship between historical attack feature vectors and corresponding defense strategies.

[0024] The matching module is used to perform similarity matching between the features of the current attack behavior and the historical attack feature vectors in the immune memory bank when a new attack behavior is detected. If the match is successful, the defense strategy corresponding to the attack behavior is extracted from the immune memory bank and the defense strategy is deployed to the vehicle-mounted mimicry defense system.

[0025] Thirdly, embodiments of the present invention provide an electronic device, including:

[0026] One or more processors;

[0027] Memory, used to store one or more programs;

[0028] When the one or more programs are executed by the one or more processors, the one or more processors perform the method as described above.

[0029] Fourthly, embodiments of the present invention provide a computer-readable medium storing a computer program, which, when executed by a processor, implements the steps of the method described above.

[0030] The vehicle-mounted mimicry defense strategy selection method, system, medium, and device provided by this invention store historical attack information in an immune memory bank, enabling rapid matching and deployment of defense strategies when similar attacks are detected, reducing strategy calculation time and thus improving defense response speed; by reusing historical strategies, the redundant calculation process is reduced, thereby reducing system computing resource consumption; and by rapidly deploying mimicry defense strategies, it becomes more difficult for attackers to exploit system vulnerabilities to launch attacks. Attached Figure Description

[0031] Figure 1 A flowchart illustrating a method for selecting a vehicle-mounted mimicry defense strategy according to an embodiment of the present invention;

[0032] Figure 2 A structural block diagram of a vehicle-mounted mimicry defense strategy selection system provided in an embodiment of the present invention;

[0033] Figure 3 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0034] To enable those skilled in the art to better understand the technical solutions of the present invention, exemplary embodiments of the present invention are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0035] Where there is no conflict, the various embodiments of the present invention and the features thereof may be combined with each other.

[0036] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0037] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used herein, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded. Terms such as “connected” or “linked” are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect.

[0038] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having the meaning consistent with their meaning in the context of the relevant art and the invention, and will not be interpreted as having an idealized or overly formal meaning unless expressly so defined herein.

[0039] Definitions of abbreviations and key terms:

[0040] ECU (Electronic Control Unit): An electronic control unit is an embedded control device in a vehicle system used to control various functional modules.

[0041] CAN (Controller Area Network): A controller area network used for data communication between in-vehicle devices.

[0042] DoIP (Diagnostics over Internet Protocol): Vehicle diagnostic communication technology based on the IP protocol.

[0043] MQTT (Message Queuing Telemetry Transport): A lightweight message transmission protocol commonly used in vehicle-to-everything (V2X) communication.

[0044] IDS (Intrusion Detection System): An intrusion detection system used to monitor for abnormal or attacking behavior in a network.

[0045] IPS (Intrusion Prevention System): An intrusion prevention system used to block identified attack behaviors.

[0046] Vehicle-mounted mimicry defense: refers to a defense mechanism that improves system security by constructing a dynamic, diverse, and uncertain system operating environment, making it difficult for attackers to identify the real system structure. It includes technical means such as mimicry deception, mimicry transformation, and mimicry adjudication.

[0047] Immune memory: refers to the process of using the memory mechanism in the biological immune system to store historical attack behaviors and their corresponding defense strategies, and then quickly matching and calling the appropriate defense strategies when similar attacks occur in the future.

[0048] Mimicry deception: refers to the technique of constructing fake services, fake system information or fake interfaces to lure attackers into a pre-set trap environment, thereby achieving the monitoring and capture of attack behavior.

[0049] Mimicry: refers to the technique of dynamically changing the system's operating environment or system structure to make it difficult for attackers to continuously exploit system vulnerabilities.

[0050] Mimicry adjudication: refers to the decision-making process of selecting, adjusting, and implementing defense strategies based on the results of attack behavior analysis.

[0051] This invention provides a method for selecting vehicle-mounted mimicry defense strategies, see reference. Figure 1As shown, the method includes the following steps:

[0052] S100: Collect communication behavior data in the vehicle network.

[0053] In one embodiment, communication behavior data in the vehicle network is collected by an in-vehicle network security monitoring module. The communication behavior data includes network access data, port access behavior, protocol request information, and ECU communication records.

[0054] S200: Analyze and process the collected communication behavior data, extract attack behavior features according to the time sequence of the attack, and generate attack feature vectors.

[0055] For example, an attack sequence like "Port Scan 1883_Establish MQTT Connection_Illegal Topic Subscription_High-Frequency Data Request" can be converted into an attack feature vector, denoted as FP, called "MQTT_SCAN_SUBSCRIBE_FLOOD". The advantage of this design is that it allows for effective targeting when selecting defense strategies.

[0056] S300. Establish an immune memory bank, which stores the mapping relationship between historical attack feature vectors and corresponding defense strategies.

[0057] S400. When a new attack behavior is detected, the characteristics of the current attack behavior are matched with the historical attack feature vectors in the immune memory bank. If the match is successful, the defense strategy corresponding to the attack behavior is extracted from the immune memory bank and the defense strategy is deployed to the vehicle-mounted mimicry defense system.

[0058] In one embodiment, semantic similarity matching is used to match the features of the current attack behavior with the historical attack feature vectors in the immune memory. This method achieves better matching results compared to exact matching.

[0059] In one embodiment, if multiple defense strategies are matched, the defense affinity is calculated using the defense affinity calculation formula, and the defense strategy with the highest defense affinity is selected as the optimal strategy for deployment. The defense affinity calculation formula is as follows:

[0060]

[0061] in, To defend against affinity; The detection rate is the ratio of the number of detected attacks to the number of actual attacks. The interception rate is the ratio of the number of attacks that were lured or blocked to the number of attacks that were detected. This includes resource overhead, such as CPU utilization, memory usage, network bandwidth, or ECU load. Weighted by detection rate; Weighted by interception rate; This represents the weight of resource overhead.

[0062] Specifically, , , These are weighting parameters used to adjust the importance of the three indicators. In practice, an adaptive adjustment strategy is adopted, with the general principle being to determine their values ​​based on the system state. If the system attack intensity is high, the weights are increased. and The value of should be increased if the system load is high. The value of [value] should be adjusted based on the frequency of attacks; if the attack frequency is high, then the interception rate should be prioritized and improved. The strategy with the highest Fitness value is ultimately selected as the defense strategy for deployment.

[0063] In one embodiment, the defense strategy includes launching port spoofing traps, launching system software spoofing traps, launching system information spoofing traps, and triggering mimicry transformation mechanisms.

[0064] In one embodiment, when the characteristics of the current attack behavior cannot be matched with historical attack patterns in the immune memory bank, multiple candidate defense strategies are generated through the mimicry adjudication module, and the optimal defense strategy is selected based on the actual defense effect.

[0065] In one embodiment, after the attack ends, the characteristics of the current attack behavior and the optimal defense strategy are stored in the immune memory bank. This embodiment can continuously learn new attack patterns and update the immune memory bank, thereby continuously improving the defense capability so that the system can quickly select a defense strategy when encountering similar attacks in the future.

[0066] This invention stores historical attack information in an immune memory bank, enabling rapid matching and deployment of defense strategies when similar attacks are detected, reducing strategy calculation time and thus improving defense response speed; by reusing historical strategies, it reduces repetitive calculation processes, thereby reducing system computing resource consumption; and by rapidly deploying mimicry defense strategies, it makes it more difficult for attackers to exploit system vulnerabilities to launch attacks.

[0067] This invention also provides a vehicle-mounted mimicry defense strategy selection system, see below. Figure 2 As shown, the system includes:

[0068] The acquisition module 110 is used to acquire communication behavior data in the vehicle network;

[0069] The generation module 120 is used to analyze and process the collected communication behavior data, extract attack behavior features according to the time sequence of the attack, and generate attack feature vectors.

[0070] Module 130 is used to build an immune memory bank, which stores the mapping relationship between historical attack feature vectors and corresponding defense strategies.

[0071] The matching module 140 is used to perform similarity matching between the features of the current attack behavior and the historical attack feature vectors in the immune memory bank when a new attack behavior is detected. If the match is successful, the defense strategy corresponding to the attack behavior is extracted from the immune memory bank and the defense strategy is deployed to the vehicle-mounted mimicry defense system.

[0072] This invention also provides an electronic device, see below. Figure 3 As shown, an embodiment of the present invention provides an electronic device including: one or more processors 101, a memory 102, and one or more I / O interfaces 103. The memory 102 stores one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement any of the vehicle-mounted mimicry defense strategy selection methods described in the above embodiments; the one or more I / O interfaces 103 are connected between the processor and the memory, configured to enable information interaction between the processor and the memory.

[0073] The processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read / write interface) 103 is connected between the processor 101 and the memory 102, and can realize information interaction between the processor 101 and the memory 102, including but not limited to a data bus (Bus).

[0074] In some embodiments, the processor 101, memory 102, and I / O interface 103 are interconnected via bus 104, and thus connected to other components of the computing device.

[0075] In some embodiments, the one or more processors 101 include a field-programmable gate array.

[0076] This invention also provides a computer-readable medium. The computer-readable medium stores a computer program, which, when executed by a processor, implements the steps in any of the vehicle-mounted mimicry defense strategy selection methods described in the above embodiments. The computer-readable storage medium can be volatile or non-volatile.

[0077] Those skilled in the art will understand that all or some of the steps, systems, and apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software can be distributed on a computer-readable storage medium, which may include computer storage media (or non-transitory media) and communication media (or transient media).

[0078] As is known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable program instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technologies, portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, it is known to those skilled in the art that communication media typically contain computer-readable program instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0079] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0080] The computer program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing state information from the computer-readable program instructions. This electronic circuitry can execute the computer-readable program instructions to implement various aspects of the invention.

[0081] The computer program product described herein can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0082] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0083] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0084] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0085] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0086] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A method for selecting a vehicle-mounted mimicry defense strategy, characterized in that, Includes the following steps: S100: Collect communication behavior data in the vehicle network; S200. Analyze and process the collected communication behavior data, extract attack behavior features according to the time sequence of the attack, and generate an attack feature vector. S300. Establish an immune memory bank, which stores the mapping relationship between historical attack feature vectors and corresponding defense strategies. S400. When a new attack behavior is detected, the characteristics of the current attack behavior are matched with the historical attack feature vectors in the immune memory bank. If the match is successful, the defense strategy corresponding to the attack behavior is extracted from the immune memory bank and the defense strategy is deployed to the vehicle-mounted mimicry defense system.

2. The method according to claim 1, characterized in that, In step S100, communication behavior data in the vehicle network is collected by the vehicle network security monitoring module. The communication behavior data includes network access data, port access behavior, protocol request information, and ECU communication records.

3. The method according to claim 1, characterized in that, In step S400, the similarity matching between the features of the current attack behavior and the historical attack feature vectors in the immune memory bank is performed using a semantic similarity matching method.

4. The method according to claim 1, characterized in that, In step S400, if multiple defense strategies are matched, the defense affinity is calculated using the defense affinity calculation formula. The defense strategy with the highest defense affinity is selected as the optimal strategy for deployment. The defense affinity calculation formula is as follows: in, To defend against affinity; The detection rate is the ratio of the number of detected attacks to the number of actual attacks. The interception rate is the ratio of the number of attacks that were lured or blocked to the number of attacks that were detected. For resource expenditure; Weighted by detection rate; Weighted by interception rate; This represents the weight of resource overhead.

5. The method according to claim 1, characterized in that, In step S400, the defense strategy includes launching port spoofing traps, launching system software spoofing traps, launching system information spoofing traps, and triggering mimicry transformation mechanisms.

6. The method according to claim 1, characterized in that, In step S400, when the features of the current attack behavior cannot be matched with historical attack patterns in the immune memory bank, multiple candidate defense strategies are generated through the mimicry adjudication module, and the optimal defense strategy is selected based on the actual defense effect.

7. The method according to claim 6, characterized in that, After the attack ends, the characteristics of the current attack behavior and the optimal defense strategy are stored in the immune memory bank.

8. A vehicle-mounted mimicry defense strategy selection system, characterized in that, include: The data acquisition module is used to collect communication behavior data in the vehicle network; The generation module is used to analyze and process the collected communication behavior data, extract attack behavior features according to the time sequence of the attack, and generate attack feature vectors. The module is used to build an immune memory bank, which stores the mapping relationship between historical attack feature vectors and corresponding defense strategies. The matching module is used to perform similarity matching between the features of the current attack behavior and the historical attack feature vectors in the immune memory bank when a new attack behavior is detected. If the match is successful, the defense strategy corresponding to the attack behavior is extracted from the immune memory bank and the defense strategy is deployed to the vehicle-mounted mimicry defense system.

9. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 7.

10. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 7.

Images