Network threat detection method and apparatus, and computer-readable storage medium

Abstract

The present disclosure relates to the technical field of network security, and relates to a network threat detection method and apparatus, and a computer-readable storage medium. The network threat detection method comprises: on the basis of data flow transmission paths between a plurality of specified components in an apparatus to be subjected to detection, determining an interaction relationship between the plurality of specified components; on the basis of the interaction relationship, estimating the probability that a network threat occurs in each of the plurality of specified components; and on the basis of the probability that a network threat occurs in each specified component, detecting whether a network threat has occurred in said apparatus.

Description

Network threat detection methods, devices and computer-readable storage media

[0001] Cross-references to related applications

[0002] This application is based on and claims priority to CN application No. 202410790682.4, filed on June 19, 2024, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] This disclosure relates to the field of network security technology, and in particular to a network threat detection method, a network threat detection device, a computer-readable storage medium, and a computer program product. Background Technology

[0004] In recent years, the development of construction machinery has shown a trend towards connectivity and intelligence, with vehicles transforming from information silos to interconnected systems with roads, other vehicles, and people. To provide a better user experience, the in-vehicle and its backend support systems process massive amounts of data every moment, including vehicle operation data, location information, and vehicle-side application operation information.

[0005] As the last line of defense against attackers, in-vehicle communication networks require research on communication security to ensure their correctness and integrity. This is a primary issue that engineering machinery needs to address in the era of the Internet of Things and 5G.

[0006] In related technologies, data from construction machinery is monitored to detect cyber threats. Summary of the Invention

[0007] According to some embodiments of this disclosure, a network threat detection method is provided, comprising: determining the interaction relationship between multiple specified components based on the data flow transmission path between multiple specified components in a device to be detected; estimating the probability of each specified component being a network threat based on the interaction relationship; and detecting whether the device to be detected is a network threat based on the probability of each specified component being a network threat.

[0008] In some embodiments, estimating the probability of each of the plurality of designated components being subjected to a network threat based on the interaction relationship includes: identifying the designated components that have an interaction relationship with each designated component as the related designated components of each designated component; and estimating the probability of each designated component being subjected to a network threat under the condition that the related designated components are subjected to a network threat.

[0009] In some embodiments, estimating the probability of each specified component being subjected to a cyber threat under the condition that the relevant specified component is subjected to a cyber threat includes: using Bayes' theorem to construct an estimation model to estimate the probability of each specified component being subjected to a cyber threat under the condition that the relevant specified component is subjected to a cyber threat.

[0010] In some embodiments, estimating the probability of each of the plurality of specified components being subjected to a cyber threat includes: solving an estimation model using Jensen's inequality to determine the probability of each specified component being subjected to a cyber threat given that the relevant specified component is subjected to a cyber threat.

[0011] In some embodiments, the estimation model is periodically updated based on network threat detection results of the device under test.

[0012] In some embodiments, determining the interaction relationship between multiple specified components based on the data flow transmission path between multiple specified components in the device under test includes: splitting the data flow transmission path into multiple sub-paths, each sub-path including multiple nodes corresponding to multiple specified components through which the data flow passes, the topology of each sub-path being a directed acyclic graph, and the multiple specified components corresponding to each sub-path having an interaction relationship.

[0013] In some embodiments, detecting whether a device under test is under network threat based on the probability of each specified component being under network threat includes: calculating a weighted sum of the probabilities of multiple specified components included in the bus of the device under test being under network threat, as a first detection probability of the bus; and determining that the bus is under network threat in response to the first detection probability being greater than a first threshold.

[0014] In some embodiments, detecting whether a device under test is under network threat based on the probability of each specified component being under network threat includes: calculating a weighted sum of first detection probabilities for each of a plurality of buses in the device under test as a second detection probability of the communication network of the device under test; and determining that the device under test is under network threat in response to the second detection probability being greater than a second threshold.

[0015] In some embodiments, detecting whether the device under test is under network threat based on the probability of each specified component being under network threat includes: determining that the specified component is under network threat in response to the probability of the specified component being under network threat being greater than a third threshold.

[0016] In some embodiments, the data stream transmission path is obtained based on key fields in the communication protocol of the device under test.

[0017] In some embodiments, key fields include an identification field and a send / receive field.

[0018] In some embodiments, the plurality of designated components include key components in the communication network of the device under test.

[0019] According to some other embodiments of this disclosure, a network threat detection device is provided, comprising: a determining unit, configured to determine the interaction relationship between multiple designated components based on the data flow transmission path between multiple designated components in the device to be detected; an estimating unit, configured to estimate the probability of each of the multiple designated components being subjected to a network threat based on the interaction relationship; and a detection unit, configured to detect whether the device to be detected is subjected to a network threat based on the probability of each designated component being subjected to a network threat.

[0020] In some embodiments, the estimation unit determines the specified components that have an interaction relationship with each specified component as the related specified components of each specified component, and estimates the probability of each specified component experiencing a network threat under the condition that the related specified component experiences a network threat.

[0021] In some embodiments, the estimation unit uses Bayes' theorem to construct an estimation model to estimate the probability of each specified component being subjected to a network threat under the condition that a network threat occurs to the relevant specified component.

[0022] In some embodiments, the estimation unit uses Jensen's inequality to solve the estimation model to determine the probability of each specified component being subjected to a cyber threat, given that a cyber threat has occurred to the relevant specified component.

[0023] In some embodiments, the estimation model is periodically updated based on network threat detection results of the device under test.

[0024] In some embodiments, the determining unit divides the data stream transmission path into multiple sub-paths. Each sub-path includes multiple nodes corresponding to multiple specified components through which the data stream passes. The topology of each sub-path is a directed acyclic graph, and the multiple specified components corresponding to each sub-path have interactive relationships.

[0025] In some embodiments, the detection unit calculates a weighted sum of the probabilities of network threats occurring to a plurality of designated components included in the bus of the device under test, as a first detection probability of the bus; in response to the first detection probability being greater than a first threshold, it determines that a network threat has occurred on the bus.

[0026] In some embodiments, the detection unit calculates a weighted sum of the first detection probabilities of each of the plurality of buses in the device under test as a second detection probability of the communication network of the device under test, and determines that the device under test is under network threat in response to the second detection probability being greater than a second threshold.

[0027] In some embodiments, the detection unit determines that a specified component is under a network threat in response to a probability greater than a third threshold.

[0028] In some embodiments, the data stream transmission path is obtained based on key fields in the communication protocol of the device under test.

[0029] In some embodiments, key fields include an identification field and a send / receive field.

[0030] In some embodiments, the plurality of designated components include key components in the communication network of the device under test.

[0031] According to further embodiments of this disclosure, a network threat detection apparatus is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute the network threat detection method of any of the above embodiments based on instructions stored in the memory device.

[0032] According to further embodiments of the present disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the network threat detection method of any of the above embodiments.

[0033] According to further embodiments of this disclosure, a computer program product is also provided, including instructions that, when executed by a processor, cause the processor to perform the network threat detection method according to any of the foregoing embodiments. Attached Figure Description

[0034] The accompanying drawings, which form part of this specification, illustrate embodiments of this disclosure and, together with the specification, serve to explain the principles of this disclosure.

[0035] This disclosure will become clearer with reference to the accompanying drawings and the following detailed description, wherein:

[0036] Figure 1 shows a flowchart of some embodiments of the network threat detection method of this disclosure;

[0037] Figure 2a shows a schematic diagram of some embodiments of the network threat detection method of this disclosure;

[0038] Figure 2b shows schematic diagrams of some other embodiments of the network threat detection method of this disclosure;

[0039] Figure 3a shows flowcharts of some other embodiments of the network threat detection method of this disclosure;

[0040] Figure 3b shows a schematic diagram of some embodiments of the network threat detection device of this disclosure;

[0041] Figure 4 shows a block diagram of some embodiments of the network threat detection device of this disclosure;

[0042] Figure 5 shows a block diagram of some other embodiments of network threat detection of this disclosure;

[0043] Figure 6 shows a block diagram of some further embodiments of the network threat detection apparatus of this disclosure. Detailed Implementation

[0044] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present disclosure.

[0045] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0046] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit this disclosure or its application or use.

[0047] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0048] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0049] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0050] The inventors of this disclosure have discovered the following problems in the above-mentioned related technologies: low detection efficiency and poor detection accuracy.

[0051] In view of this, this disclosure proposes a network threat detection technology solution that can improve detection efficiency and accuracy.

[0052] As mentioned earlier, in order to detect network threats, the network security status of the current system can be assessed in real time using network security information collected from the fusion system, thereby enabling communication network security analysis. This provides support for the next steps in decision-making by communication security managers, reducing the risks and losses caused by threats to the system.

[0053] However, some of the inspection methods in related technologies consume a lot of network resources and take a long time to analyze, while others cannot inspect all components in the entire device, resulting in low efficiency and accuracy of network threat detection.

[0054] To address the aforementioned technical problems, the embodiments of this disclosure extract the interaction relationships between various components based on the transmission path of the data stream within the device under test, serving as a reliable basis for network threat detection.

[0055] For example, the technical solution of this disclosure can be implemented through the following embodiments.

[0056] Figure 1 shows a flowchart of some embodiments of the network threat detection method disclosed herein.

[0057] As shown in Figure 1, in step 110, the interaction relationship between multiple specified components is determined based on the data flow transmission path between multiple specified components in the device to be tested.

[0058] In some embodiments, the designated components include critical components in the communication network of the device under test. For example, the device under test may include construction machinery vehicles such as cranes, and the designated components may be critical components affecting the communication network of the device under test.

[0059] For example, key components in the communication network can be selected as designated components. Taking a crane as an example, the crane's communication network can be divided into two parts: the upper-car communication network and the lower-car communication network. Key components affecting the communication network can be selected as designated components. For example, the designated components of the upper-car communication network include {upper-car main display, upper-car main controller, IoT (Internet of Things) terminal, force limiter, upper-car gateway, and switch}, and the lower-car communication network includes {lower-car main display, lower-car main controller, and lower-car gateway}.

[0060] For example, network threat detection probes can be deployed to detect whether various components are subject to network threats.

[0061] In some embodiments, the data stream transmission path is obtained based on key fields in the communication protocol of the device under test. For example, key fields include an identification (ID) field and a send / receive field. Key fields may also include a transmission method field, a transmission cycle field, and so on.

[0062] For example, taking the device to be tested as an engineering machinery vehicle, the communication protocol of the whole vehicle can be standardized first, and then the data stream transmission path can be automatically traversed by extracting key fields such as ID number, send / receive, send method, and send cycle from the communication protocol file.

[0063] In some embodiments, the data stream transmission path is split into multiple sub-paths. Each sub-path includes multiple nodes that correspond to multiple specified components through which the data stream passes. The topology of each sub-path is a directed acyclic graph (DAG), and the multiple specified components corresponding to each sub-path have interactive relationships.

[0064] For example, a data flow transmission path includes multiple nodes, each corresponding to a specific component in the device under test that participates in the data flow transmission. The topology of the data flow transmission path can be a directed graph with self-loops, meaning that a data flow transmission path may include repeating nodes, such as onboard controller - onboard gateway - switch - onboard display - force limiter - onboard display - switch - onboard gateway - onboard controller.

[0065] For example, a data transmission path that is a directed cycle graph can be split into multiple sub-paths that are directed acyclic graphs, i.e., a sub-path does not contain duplicate nodes, such as onboard controller-onboard gateway-switch-onboard display-force limiter.

[0066] In the above embodiments, a data stream transmission path with a complex topology can be split into multiple sub-paths with simpler topologies, and the sub-paths do not contain duplicate nodes. This allows for the accurate identification of relevant designated components that interact with each designated component, providing a reliable basis for estimating the probability of network threats, thereby improving the efficiency and accuracy of detection.

[0067] For example, the topology of the data stream transmission path and sub-paths can be illustrated by the embodiment in Figure 2a.

[0068] Figure 2a shows a schematic diagram of some embodiments of the network threat detection method of this disclosure.

[0069] As shown in Figure 2a, taking the crane's overhead communication network as an example, the designated components include the overhead main display, overhead main controller, IoT terminal, force limiter, overhead gateway, off-board gateway, and switch. The communication data interaction of each designated component follows a pre-configured communication protocol.

[0070] In Figure 2a, the arrows indicate the direction of data flow transmission between specified components, showing that the data interaction of the in-vehicle communication network is a relatively complex directed loop graph. For example, the data flow transmission path may include: vehicle controller - vehicle gateway - switch - vehicle display - force limiter - vehicle display - switch - vehicle gateway - vehicle controller; vehicle controller - vehicle gateway - IoT terminal - vehicle gateway - vehicle controller; vehicle controller - vehicle gateway - exit gateway - vehicle controller, etc.

[0071] For example, to facilitate network threat analysis, a directed cyclic graph can be split into multiple directed acyclic topologies based on the data flow transmission path, forming multiple sub-paths as a security analysis model. The split sub-paths could include: onboard controller - onboard gateway - switch - onboard display - force limiter; force limiter - onboard display - switch - onboard gateway - onboard controller; onboard controller - onboard gateway - IoT terminal; IoT terminal - onboard gateway - onboard controller; onboard controller - onboard gateway - offboard gateway; offboard gateway - onboard gateway - onboard controller, etc.

[0072] In the above embodiments, a data stream transmission path with a complex topology can be split into multiple sub-paths with simpler topologies, and the sub-paths do not contain duplicate nodes. This allows for the accurate identification of relevant designated components that interact with each designated component, providing a reliable basis for estimating the probability of network threats, thereby improving the efficiency and accuracy of detection.

[0073] After determining the interaction relationships between multiple specified components, network threats can be detected using steps such as 120 in Figure 1.

[0074] In step 120, based on the interaction relationship, the probability of each of the multiple specified components being subjected to a network threat is estimated.

[0075] In some embodiments, the types of network threats that may exist in the communication network can be predetermined to construct a security analysis map of the communication network. For example, potential threat factors of the communication network can be identified based on network threat detection probes, key components of the communication network, data flow transmission paths, etc., thereby determining the types of network threats; the security analysis map may include information such as network threat types and related components.

[0076] For example, for each type of network threat, the probability of each specified component being subjected to a network threat can be estimated.

[0077] In some embodiments, the designated components that have an interaction relationship with each designated component are determined as the related designated components of each designated component. For example, multiple designated components include {x} i ,i=1,2,…,N}, specifying component x i The set of specified components can be X, where N is the number of specified components. For example, for the sub-path in Figure 2a: onboard controller - onboard gateway - IoT terminal, for specified component x... i = Onboard controller, X can include onboard gateway and IoT terminal.

[0078] In some embodiments, the probability of each specified component experiencing a cyber threat is estimated given that a cyber threat has occurred to the relevant specified component. For example, an estimation model is constructed using Bayes' theorem to estimate the probability of each specified component experiencing a cyber threat given that a cyber threat has occurred to the relevant specified component.

[0079] For example, the Bayesian algorithm can be used to obtain component x. i The conditional probability p(x) of a certain type of network threat i |X) as the estimation model:

[0080] X represents component x in the aforementioned security analysis model. i A set of specified components that exist for communication and interaction, p(X|x i ) is the likelihood function, and p(X) is the marginal likelihood function of X.

[0081] In this way, the probability of each component being threatened by a network threat can be estimated based on the interaction between the components and the relevant specified components, providing a reliable basis for network threat detection and thus improving the efficiency and accuracy of network threat detection.

[0082] In some embodiments, the Jensen inequality can be used to solve the estimation model to determine the probability of each specified component being subjected to a cyber threat, given that a cyber threat has occurred to the relevant specified component.

[0083] In this way, an analytical solution to the estimation model can be obtained, which can be used to estimate the probability of each component being subjected to network threats, providing a reliable basis for network threat detection and thus improving the efficiency and accuracy of network threat detection.

[0084] For example, the estimation model can be solved using the embodiment shown in Figure 2b.

[0085] Figure 2b shows schematic diagrams of some other embodiments of the network threat detection method disclosed herein.

[0086] As shown in Figure 2b, the distribution q(x) is introduced. i The p(x) approximates the true distribution. i |X), that is, q(x) i )≈p(x i |X), apply Jensen's inequality to transform the marginal likelihood function p(X):

[0087] KL[] is q(x i ) and p(x i The KL divergence (Kullback-Leibler Divergence) of |X) is used to measure q(x). i ) and p(x iThe difference between |X) can also be measured in other ways.

[0088] Combining formulas (2) and (3), we can obtain an approximate distribution of the solution to formula (1):

[0089] q(x i )=argmin KL[q(x i )||p(x i |X)] (4)

[0090] That is, calculate q(x) i ) and p(x i The difference between |X) reaches its minimum value q(x) i ).

[0091] In some embodiments, the estimation model is periodically updated based on network threat detection results of the device under test.

[0092] For example, data acquired in each detection cycle can be uploaded to the cloud in real time to dynamically update the aforementioned security analysis model. The system parameters in the estimation model can be updated based on the determined probability of network threats occurring to each specified component, thereby improving the accuracy of the estimation model in detecting network threats.

[0093] In this way, the network security analysis results are uploaded to the cloud in real time to dynamically update the security analysis model online, which avoids the problems of fixed single model parameters and low estimation accuracy.

[0094] After determining the probability of network threats occurring to each specified component, network threats can be detected using steps such as 130 in Figure 1.

[0095] In step 130, the device under test is detected to be under network threat based on the probability of each specified component being under network threat.

[0096] In the above embodiments, the interaction relationship between various components is extracted based on the transmission path of the data stream within the device under test, serving as a reliable basis for network threat detection, thereby improving detection efficiency and accuracy.

[0097] In some embodiments, a network threat is determined to have occurred to a specified component in response to the probability that the specified component is subject to a network threat being greater than a third threshold. For example, in response to p(x i If |X) is greater than the set third threshold, the component alarm device is activated to notify component x. i There may be a cyber threat.

[0098] In some embodiments, a weighted sum of the probabilities of network threats occurring to a plurality of designated components included in the bus of the device under test is calculated as a first detection probability of the bus; in response to the first detection probability being greater than a first threshold, it is determined that a network threat has occurred to the bus.

[0099] For example, the probability of a network threat on a certain bus can be the weighted sum of the probabilities of network threats occurring to each component on that bus; the weights corresponding to the probabilities of network threats occurring to each component can be determined based on the importance of different components in the communication network, thereby improving the accuracy of network threat detection.

[0100] In the above embodiments, the probability of network threats to each component is estimated based on the Bayesian algorithm, thereby estimating the probability of each component being subjected to each type of network threat at each detection moment. This allows the security analysis results to be presented in the form of a probability distribution, reflecting the likelihood of the component being threatened by the network, facilitating subsequent decision-making and response. For example, if the value of the analysis result is small, no alarm measures may be taken; if the value of the analysis result exceeds a threshold, an alarm device can be activated. This enables real-time security monitoring and alarm functions for the entire communication network of the device under test.

[0101] In some embodiments, a weighted sum of the first detection probabilities of each of the plurality of buses in the device under test is calculated as a second detection probability of the communication network of the device under test; in response to the second detection probability being greater than a second threshold, it is determined that the device under test is under network threat.

[0102] For example, the probability of a communication network being threatened can be the sum of the threat probabilities of each bus in the network; the weight of the probability of each bus being threatened can be determined according to the importance of different buses in the communication network, thereby improving the accuracy of network threat detection.

[0103] In the above embodiments, by analyzing the communication protocols between the components in the device under test, the interaction relationship of the communication data streams of each component is extracted; a communication network security analysis model is established using a directed acyclic topology; and through a component-bus-system hierarchical security analysis process, the source analysis of the security status of each component in the communication network is realized, thereby improving the efficiency and accuracy of network threat detection.

[0104] The following uses an engineering machinery vehicle as an example to illustrate the technical solution of this disclosure.

[0105] For example, analyze the communication network of construction machinery vehicles, select key components in the network to deploy threat detection probes; extract the interaction relationship of communication data streams between components based on the communication protocols of the in-vehicle components; establish a security analysis probability model using directed topology; use Bayesian algorithm to obtain the probability of network threats to each component; and activate an alarm device in response to a probability higher than a threshold.

[0106] For example, data acquired in each detection cycle can be uploaded to the cloud in real time to dynamically update the security analysis model, enabling point-to-surface monitoring, visualization, and threat tracing of the security status of communication components, buses, and systems.

[0107] For example, in the modeling stage of the vehicle-side communication network, considering the complex nonlinear characteristics of the process model, a data-driven modeling method can be adopted. If the data flow of each communication component in the vehicle follows a defined communication protocol, a directed graph can be used to model the communication network, providing a reasonable and accurate reasoning basis for subsequent safety analysis.

[0108] The technical solution of this disclosure will be explained rationally below with reference to Figures 3a and 3b.

[0109] Figure 3a shows flowcharts of some other embodiments of the network threat detection method of this disclosure.

[0110] As shown in Figure 3a, in steps 310-320, key components in the communication network are selected and network threat detection probes are deployed.

[0111] Taking a crane as an example, the crane communication network can be divided into two parts: the upper-car communication network and the lower-car communication network. Selecting the key components that affect the communication network, the specified components of the upper-car communication network include {upper-car main display, upper-car main controller, IoT (Internet of Things) terminal, force limiter, upper-car gateway, and switch}, and the lower-car communication network includes {lower-car main display, lower-car main controller, and lower-car gateway}.

[0112] In steps 330-340, based on the communication protocol, the interaction relationships in the data stream are extracted, and a security analysis model of the communication network is established.

[0113] For example, the communication data exchange between various components on a crane follows a pre-configured communication protocol, and the data exchange within the crane's communication network can be viewed as a relatively complex directed cyclic graph. To facilitate analysis, the directed cyclic graph can be decomposed into multiple directed acyclic topologies based on the data flow transmission path, forming a safety analysis model.

[0114] For example, methods for obtaining data stream paths may include: standardizing the vehicle communication protocol and automatically traversing the transmission path by extracting key fields such as ID number, send / receive, send method, and send cycle from the file.

[0115] In step 350, based on the processing results of steps 310-340, potential threat factors to the communication network are identified, and a network security analysis map of the in-vehicle communication network is constructed.

[0116] In step 360, the probability of each component, each bus, and the device under test transmitting a network threat is calculated.

[0117] For example, using the Bayesian algorithm, the component x can be obtained. i The probability p(x) of a certain network threat that (i = 1, 2, ..., N) is in i |X), where N is the number of specified components, and X is the number of components in the safety analysis model related to component x. i A set of components that communicate and interact; introducing a distribution q(x) i The p(x) approximates the true distribution. i |X), that is, q(x) i )≈p(x i |X); Applying Jensen's inequality to transform the marginal likelihood function p(X), we obtain the approximate distribution q(x). i ).

[0118] For example, data acquired in each detection cycle can be uploaded to the cloud in real time to dynamically update the security analysis model and correct it.

[0119] In step 370, it is determined whether the calculated probability is greater than a threshold to determine whether to activate the alarm device. For example, in response to p(x) i If |X) is greater than the third threshold, the alarm device will be activated.

[0120] For example, the probability of a network threat to a certain bus can be the sum of the threat probabilities of each component on the bus, and the probability of a network threat to a communication network can be the sum of the threat probabilities of each bus in the network. For example, to represent the importance of different components and buses in a communication network, a weighted summation method can be used.

[0121] Figure 3b shows a schematic diagram of some embodiments of the network threat detection apparatus of this disclosure.

[0122] As shown in Figure 3b, a network threat detection device can be established based on the steps in Figure 3a. This device may include a key component selection module, a detection probe data acquisition module, a security analysis model building module, a security analysis calculation module, a data storage and model update module, and a threat alarm module, etc.

[0123] For example, the key component selection module is used to execute step 310; the detection probe data acquisition module is used to execute step 320; the security analysis model building module is used to execute steps 330-340; the security analysis calculation module is used to execute step 360; the data storage and model update module is used to execute step 350; and the threat alarm module is used to execute step 370.

[0124] In the above embodiments, by analyzing the communication network of the construction machinery vehicle, threat detection probes are deployed on key components of the network. Based on the in-vehicle communication protocol, the interaction relationship of the component communication data stream is extracted, and a security analysis probability model is built using a directed acyclic topology. The probability of network threats to each component is obtained using a Bayesian algorithm. When the probability exceeds a threshold, an alarm device is activated. In addition, the data acquired in each detection cycle can be uploaded to the cloud in real time to dynamically update the security analysis model, realizing the security status monitoring, visualization, and traceability analysis of the communication network from components to bus to system.

[0125] Figure 4 shows a block diagram of some embodiments of the network threat detection apparatus of this disclosure.

[0126] As shown in Figure 4, the network threat detection device 4 includes: a determination unit 41, used to determine the interaction relationship between multiple specified components based on the data flow transmission path between multiple specified components in the device to be detected; an estimation unit 42, used to estimate the probability of each specified component among the multiple specified components being subjected to a network threat based on the interaction relationship; and a detection unit 43, used to detect whether the device to be detected is subjected to a network threat based on the probability of each specified component being subjected to a network threat.

[0127] In some embodiments, the estimation unit 42 determines the designated components that have an interaction relationship with each designated component as the relevant designated components of each designated component, and estimates the probability of each designated component experiencing a network threat under the condition that the relevant designated component experiences a network threat.

[0128] In some embodiments, the estimation unit 42 uses Bayes' theorem to construct an estimation model to estimate the probability of each specified component being subjected to a network threat under the condition that a network threat occurs to the relevant specified component.

[0129] In some embodiments, the estimation unit 42 uses the Jensen inequality to solve the estimation model to determine the probability of each specified component being subjected to a network threat under the condition that the relevant specified component is subjected to a network threat.

[0130] In some embodiments, the estimation model is periodically updated based on network threat detection results of the device under test.

[0131] In some embodiments, the determining unit 41 divides the data stream transmission path into multiple sub-paths. Each sub-path includes multiple nodes corresponding to multiple specified components through which the data stream passes. The topology of each sub-path is a directed acyclic graph, and the multiple specified components corresponding to each sub-path have interactive relationships.

[0132] In some embodiments, the detection unit 43 calculates a weighted sum of the probabilities of network threats occurring to a plurality of designated components included in the bus of the device under test, as a first detection probability of the bus; in response to the first detection probability being greater than a first threshold, it determines that a network threat has occurred on the bus.

[0133] In some embodiments, the detection unit 43 calculates a weighted sum of the first detection probabilities of each of the plurality of buses in the device under test as a second detection probability of the communication network of the device under test, and determines that the device under test is under network threat in response to the second detection probability being greater than a second threshold.

[0134] In some embodiments, the detection unit 43 determines that a specified component is under network threat in response to a probability greater than a third threshold.

[0135] In some embodiments, the data stream transmission path is obtained based on key fields in the communication protocol of the device under test.

[0136] In some embodiments, key fields include an identification field and a send / receive field.

[0137] In some embodiments, the plurality of designated components include key components in the communication network of the device under test.

[0138] Figure 5 shows a block diagram of some other embodiments of network threat detection disclosed herein.

[0139] As shown in FIG5, the network threat detection device 5 of this embodiment includes: a memory 51 and a processor 52 coupled to the memory 51. The processor 52 is configured to execute the network threat detection method in any embodiment of this disclosure based on the instructions stored in the memory 51.

[0140] The memory 51 may include, for example, system memory, fixed non-volatile storage media, etc. The system memory stores, for example, the operating system, application programs, boot loader, database, and other programs.

[0141] Figure 6 shows a block diagram of some further embodiments of the network threat detection apparatus of this disclosure.

[0142] As shown in FIG6, the network threat detection device 6 of this embodiment includes: a memory 610 and a processor 620 coupled to the memory 610. The processor 620 is configured to execute the network threat detection method of any of the foregoing embodiments based on instructions stored in the memory 610.

[0143] The memory 610 may include, for example, system memory, fixed non-volatile storage media, etc. The system memory may store, for example, the operating system, application programs, boot loader, and other programs.

[0144] The network threat detection device 6 may also include an input / output interface 630, a network interface 640, and a storage interface 650. These interfaces 630, 640, and 650, as well as the memory 610 and processor 620, can be connected via, for example, a bus 660. The input / output interface 630 provides a connection interface for input / output devices such as monitors, mice, keyboards, touchscreens, microphones, and speakers. The network interface 640 provides a connection interface for various networked devices. The storage interface 650 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0145] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0146] The network threat detection method, network threat detection device, computer-readable storage medium, and computer program product according to this disclosure have been described in detail. To avoid obscuring the concept of this disclosure, some details known in the art have not been described. Those skilled in the art can fully understand how to implement the technical solutions disclosed herein based on the above description.

[0147] The methods and systems of this disclosure may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of this disclosure are not limited to the specific order described above unless otherwise specifically stated. Furthermore, in some embodiments, this disclosure may also be implemented as a program recorded on a recording medium, the program including machine-readable instructions for implementing the methods according to this disclosure. Thus, this disclosure also covers recording media storing programs for performing the methods according to this disclosure.

[0148] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A network threat detection method, comprising: The interaction relationship between the multiple specified components is determined based on the data stream transmission path between multiple specified components in the device under test; Based on the interaction relationship, estimate the probability of each of the plurality of specified components being subjected to a network threat; Based on the probability of each specified component being subjected to a network threat, the device under test is detected to determine whether it is subjected to a network threat.

2. The network threat detection method according to claim 1, wherein, The step of estimating the probability of each of the plurality of specified components being subjected to a network threat based on the interaction relationship includes: The designated component that has the interaction relationship with each of the designated components is determined as the related designated component of each of the designated components; Estimate the probability that each of the specified components will be subjected to a network threat under the condition that the specified component is subjected to a network threat.

3. The network threat detection method according to claim 2, wherein, The estimated probability of each specified component experiencing a network threat, given that a network threat occurs to the relevant specified component, includes: Using Bayes' theorem, an estimation model is constructed to estimate the probability of each specified component experiencing a network threat, given that the specified component in question is also subject to a network threat.

4. The network threat detection method according to claim 3, wherein, The estimation of the probability of each of the plurality of specified components being subjected to a network threat includes: The estimation model is solved using Jensen's inequality to determine the probability of each specified component experiencing a cyber threat, given that a cyber threat has occurred to the relevant specified component.

5. The network threat detection method according to claim 3, wherein, The estimation model is periodically updated based on the network threat detection results of the device under test.

6. The network threat detection method according to any one of claims 1-5, wherein, Determining the interaction relationship between the multiple specified components based on the data stream transmission path between the multiple specified components in the device under test includes: The data stream transmission path is divided into multiple sub-paths. Each sub-path includes multiple nodes corresponding to multiple designated components through which the data stream passes. The topology of each sub-path is a directed acyclic graph, and the multiple designated components corresponding to each sub-path have the aforementioned interaction relationship.

7. The network threat detection method according to any one of claims 1-5, wherein, The step of detecting whether the device under test is under network threat based on the probability of each specified component being under network threat includes: Calculate the weighted sum of the probabilities of network threats occurring to multiple specified components included in the bus of the device under test, and use this sum as the first detection probability of the bus; In response to the first detection probability being greater than a first threshold, it is determined that a network threat has occurred on the bus.

8. The network threat detection method according to claim 7, wherein, The step of detecting whether the device under test is under network threat based on the probability of each specified component being under network threat includes: Calculate the weighted sum of the first detection probabilities of each of the multiple buses in the device under test, and use it as the second detection probability of the communication network of the device under test; In response to the second detection probability being greater than the second threshold, it is determined that the device under test is under network threat.

9. The network threat detection method according to any one of claims 1-5, wherein, The step of detecting whether the device under test is under network threat based on the probability of each specified component being under network threat includes: In response to a probability that the specified component is under a network threat exceeding a third threshold, it is determined that the specified component is under a network threat.

10. The network threat detection method according to any one of claims 1-5, wherein, The data stream transmission path is obtained based on key fields in the communication protocol of the device under test.

11. The network threat detection method according to claim 10, wherein, The key fields include an identification field and a send / receive field.

12. The network threat detection method according to any one of claims 1-5, wherein, The specified components include key components in the communication network of the device under test.

13. A network threat detection device, comprising: The determining unit is used to determine the interaction relationship between the multiple specified components based on the data stream transmission path between multiple specified components in the device under test; An estimation unit is used to estimate the probability of each of the plurality of specified components being subjected to a network threat based on the interaction relationship. The detection unit is used to detect whether the device under test is subject to a network threat based on the probability of each specified component being subject to a network threat.

14. A network threat detection device, comprising: Memory; and A processor coupled to the memory, the processor being configured to execute the network threat detection method of any one of claims 1-12 based on instructions stored in the memory.

15. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network threat detection method according to any one of claims 1-12.

16. A computer program product comprising instructions that, when executed by a processor, cause the processor to perform the network threat detection method according to any one of claims 1-12.

Images