Method and device for operating a software-controlled vehicle system with protection against malware

Abstract

The invention relates to a computer-implemented method for operating a vehicle system (2) with a browser application and a user interface (4), comprising the following steps: - Calling (S1) a web page from a configuration information; - Extracting (S2) and storing (S3) executable code in a database; - Analyzing (S4) the stored code in one or more analysis modules to determine a harmfulness measure for each code, - Depending on the one or more harmfulness measures, determine (S9) an overall harmfulness measure that indicates a probability that the code is harmful; - Consider (S10) the website according to the overall harmfulness measure for the operation of the vehicle system (2).

Description

Technical field

[0001] The invention relates to vehicle systems for use with a user interface on which a website from the internet can be accessed. The invention further relates to the protection of such vehicle systems against malware that can be executed in the vehicle system via code contained in websites. Technical background

[0002] Vehicle systems typically include a user interface that allows for extensive vehicle operation. This interface is usually equipped with a touchscreen, which provides internet access, for example, to visit websites. Such websites may contain executable code, such as JavaScript. JavaScript is a fundamental technology for modern web applications and generally offers numerous attack vectors against the browser software within the vehicle system. Since vehicle systems are particularly safety-critical, it is essential to prevent access to such websites containing malware. Disclosure of the invention

[0003] According to the invention, a method for operating a vehicle system with a browser application and a user interface according to claim 1 and a corresponding vehicle system according to the dependent claim are provided.

[0004] Further details are specified in the dependent claims.

[0005] According to a first aspect, a computer-implemented method for operating a vehicle system is provided, with a browser application for retrieving website content from the Internet and a user interface, comprising the following steps: - Accessing a web page retrieved from configuration information using the browser application; - Extracting and storing the website's executable code in a database; - Analyzing the stored code in one or more analysis modules to determine a harmfulness measure for each piece of code, - Depending on one or more harmfulness measures, determine an overall harmfulness measure that indicates the probability that the code is harmful; - Considering the website according to the overall level of harm to the operation of the vehicle system.

[0006] In particular, depending on the overall level of harm, access to the website may be blocked.

[0007] To detect malware-infected websites, so-called honeypot functions are implemented. These passively monitor incoming network traffic to determine if it contains malware, or wait for an attacker to attempt to access the website. Thus, passive honeypot functions can detect attacks on websites when the attacker is active.

[0008] However, if an attacker creates a website containing malware and waits for a single user to access it, the attacker is passive. A passive attacker does not generate any outgoing network traffic or interact with the target system. Such attacks cannot be detected by passive honeypot functions, but only by active honeypot functions.

[0009] Vehicle assistance systems typically feature a user interface with a screen that can run numerous applications. These applications can be installed by the user, particularly from sources accessible via the internet. Furthermore, applications may offer a browser interface or similar access methods, allowing users to access and display web pages on the vehicle assistance system's screen.

[0010] As mentioned earlier, websites often contain executable code, such as JavaScript, which is executed by the vehicle's assistance system when the website is accessed via a browser. The execution of this code often depends on the type of browser used and other parameters, which may include the vehicle type, metadata about the vehicle's characteristics, and similar information. Furthermore, depending on the browser type, vehicle type, metadata about the vehicle's characteristics, and other factors, additional code may be retrieved and executed from the website's address. Therefore, the executable code provided by the website is variable and not automatically predetermined by the website's address.A website is therefore not readily identifiable as containing malicious code, since this only executes under certain conditions, in particular only when used in a specific type of motor vehicle.

[0011] The challenge lies in identifying websites containing malicious code, creating a centralized list of such websites, and then filtering this list, for example using a firewall, to block access. A centrally compiled list of malicious websites cannot check every possible combination of browser type, website parameters, and metadata, and therefore cannot determine whether a specific website contains malicious code for a particular vehicle and browser application.

[0012] Therefore, an active honeypot system is planned for implementation in the vehicle assistance system. This system regularly queries a predefined list, for example in a configuration file, to ensure that the received website does not contain malicious code specific to the vehicle's browser configuration and call parameters. To achieve this, a crawler is used to access the listed websites and extract the executable code, such as JavaScript code, which is then stored in a database.

[0013] In addition to JavaScript code, the code may include HTML code and / or CSS code.

[0014] The database is regularly read by a dispatcher unit and checked using one or more analysis modules.

[0015] In particular, the executable code can be analyzed using one or more analysis modules, which include one or more of the following modules: - a comparison analysis module trained to scan the executable code with a code search module to detect known malicious code; - a machine learning-based analysis module that is trained to detect malicious code according to the training of the machine learning analysis module; - a static code analysis module trained to detect malicious code using an Abstract Syntax Tree (AST); - a sandbox environment to run the executable code and monitor the effects of running the executable code in question.

[0016] The comparison analysis module can thus examine the executable code received after accessing the relevant website for components that are known to be contained in the malicious code.

[0017] An analysis module based on machine learning methods can be applied, which is trained to detect malicious code fragments in the JavaScript code.

[0018] Furthermore, a static code analysis module may be provided that performs a static code analysis to find malicious code in the executable code, e.g., using information obtained from AST, DFG, and PGG, and then performs a graph search on this information.

[0019] Furthermore, a sandbox environment can be implemented in which the code is actually executed and the effects of running this code in a safe environment are monitored. If this results in behavior that potentially impairs the vehicle's operational behavior or that transmits unwanted information externally, the code can be identified as malicious code.

[0020] The results from the various analysis modules are evaluated using a ranking module. This ranking module calculates a harmfulness score for the specific executable code or code fragment it contains, indicating the probability that the code is indeed harmful.

[0021] In particular, a threshold comparison of the harmfulness measure can be used to determine whether the website in question, which contains the executable code or code fragment, should be blocked or allowed to execute.

[0022] The information about whether the executable code on the website in question is malicious or not is then written back to the configuration information. This makes it possible to provide an active honeypot in the vehicle assistance system to determine whether a website, accessed by a vehicle-specific browser application with vehicle-specific call parameters, contains executable code that is harmful to the vehicle's operation or communicates unwanted information externally.

[0023] Furthermore, it may be provided that the configuration information is updated in a database with information received from a variety of vehicle systems and / or from a road-side infrastructure and / or from a vehicle manufacturer's backend of the vehicle system. Brief description of the drawings

[0024] The embodiments are explained in more detail below with reference to the accompanying drawings. These show: Fig. 1 a schematic representation of a vehicle system that can be used to access websites; Fig. 2. A schematic representation of the structure for checking websites using an active honeypot; and Fig. 3. A flowchart illustrating a procedure for determining whether a website is harmful to the individual vehicle system. Description of embodiments

[0025] Fig. Figure 1 schematically shows a vehicle 1 with a vehicle system 2, in particular a vehicle assistance system, with which vehicle applications can be executed. The vehicle system 2 comprises a computing unit 3 with a microprocessor, a memory, and a user interface 4, which can, for example, be designed as a touchscreen. The user interface 4 enables the viewing of information and the accessing and operation of applications to execute functions and interact with them.

[0026] In principle, this allows users to install vehicle-specific applications, which can be obtained from the internet, for example. Among other things, browser applications can be downloaded and installed, making it possible to access websites via the user interface.

[0027] A structure of the implemented active honeypot system 10 is shown in Fig. Figure 2 shows the active honeypot system 10, which includes a crawler 11 that searches the internet 12 based on web pages stored in a configuration file 13, using requests from the browser application. The browser application typically identifies itself with the type and nature of its software, for example, with a string for Safari 7.0.3, which reads as follows: AppleWebKit / 537.75.14 (KHTML, like Gecko) Version / 7.0.3 Safari / 7046A194A

[0028] Furthermore, vehicle-specific parameters can be specified when accessing the website, such as the vehicle type, engine, equipment, and the like.

[0029] A procedure is carried out as described in the flowchart of the Fig. Figure 3 illustrates this.

[0030] In step S1, the web pages from the configuration information are accessed, and in particular, links contained in the web pages are also accessed.

[0031] In step S2, the executable code, in particular the JavaScript code, is extracted and in step S3 it is temporarily stored in a database 14.

[0032] A dispatcher unit 15 is provided to read the code from the database 14 in step S4 and to examine it in one or more analysis modules 16a, 16b, 16c, 16d.

[0033] The executable code can be analyzed in step S5 in a comparison analysis module 16a with a code search module to detect known malicious code.

[0034] Furthermore, in step S6, a machine learning-based analysis module 16b can be used to detect malicious code that can be identified as malicious according to the training of the machine learning analysis module.

[0035] The machine learning-based analysis module 16b can be implemented using a K-nearest neighbor algorithm that uses the cosine distance after the code has been modified to a suitable format, e.g., a using-the-bag-of-words approach or using a deep neural network.

[0036] Furthermore, in step S7, a static code analysis module 16c can be used to detect malicious code.

[0037] The Static Code Analysis module 16c can generate an Abstract Syntax Tree (AST) that can be searched similarly to a Cobra static code analyzer. For long code snippets, regular expression matching with a trigram index can also be used.

[0038] The Static Code Analysis module 16c can be used with Sound Static Code Analysis, as in AST, or simpler methods, such as those that may be implemented in the tools CppCheck or FlowFinder.

[0039] Using a sandbox environment, the code in step S8 can be executed, and the effects of its execution can be monitored to determine whether damage to vehicle system 2 or the user is likely. For example, malicious code might attempt to extract personal data from the vehicle and send it to the attacker's backend, or disable vehicle functions. Another example would be ransomware code that encrypts the memory of one or more electronic control units (ECUs) and demands a ransom from the vehicle manufacturer.

[0040] The code can be stored in the database as JavaScript code or as JavaScript code plus HTML plus CSS if this is required for execution in the sandbox environment.

[0041] Each of the analysis modules 16a, 16b, 16c, and 16d can provide a severity level indicating the degree of harm posed by the executable code or code fragment in question. In the simplest case, these are straightforward harmful / harmless indications. More nuanced levels are also possible. For example, if the analysis determines that the malicious code "only" reads from the vehicle data to extract it, the severity level is lower than for a malicious code that writes to the memory of one or more control units. The severity level can generally be expressed as a numerical value; for example, the higher the value, the more critical the malicious code.

[0042] Using a ranking module 17, an overall harmfulness score can be determined in step S9, indicating the probability that the code is harmful. A threshold comparison can then be used to determine, depending on the harmfulness score, whether the executable code is potentially harmful.

[0043] Using a response module 18, the website can be treated according to its overall severity level in step S10. Furthermore, in step S11, the website in question, along with the potentially harmful executable code, can be saved in configuration file 13.

[0044] The websites listed in the configuration file are then taken into account by a firewall in the vehicle system 2 when websites are accessed.

Claims

[1] Computer-implemented method for operating a vehicle system (2) with a browser application and a user interface (4), comprising the following steps: - Calling (S1) a web page from a configuration information; - Extracting (S2) and storing (S3) executable code in a database; - Analyzing (S4) the stored code in one or more analysis modules (16a, 16b, 16c, 16d) to determine a harmfulness measure for each code, - Depending on the one or more harmfulness measures, determine (S9) an overall harmfulness measure that indicates a probability that the code is harmful; - Consider (S10) the website according to the overall harmfulness measure for the operation of the vehicle system (2). [2] Method according to claim 1, wherein access to the website is blocked depending on the overall degree of harmfulness. [3] Method according to claim 1 or 2, wherein the executable code comprises JavaScript code and in particular HTML code and / or CSS code. [4] Method according to any one of claims 1 to 3, wherein the executable code is analyzed using one or more analysis modules (S4) comprising one or more of the following modules: - an analysis module (16a) trained to search the executable code with a code search module (S5) to detect known malicious code; - a machine learning-based analysis module (16b) that is trained to detect malicious code according to the training of the machine learning analysis module (S6); - a static code analysis module (16c) trained to detect malicious code using an Abstract Syntax Tree (AST) (S7); - a sandbox environment (16d) to run the executable code and to monitor the effects of running the executable code in question (S8). [5] Method according to any one of claims 1 to 4, wherein the configuration information in a database (14) is updated with information received from a plurality of vehicle systems and / or from a road-side infrastructure and / or from a backend of a vehicle manufacturer of the vehicle system (2) (S11). [6] Device, in particular vehicle assistance system, for carrying out one of the methods according to any one of claims 1 to 5. [7] Computer program product comprising instructions which, when the program is executed by at least one data processing device, cause it to perform the steps of the method according to any one of claims 1 to 5. [8] Machine-readable storage medium comprising instructions which, when executed by at least one data processing device, cause it to perform the steps of the method according to any one of claims 1 to 5.

Images