WO2020135755A1

WO2020135755A1 - Vehicle attack detection method and apparatus

Info

Publication number: WO2020135755A1
Application number: PCT/CN2019/129315
Authority: WO
Inventors: 刘健皓; 曹明革
Original assignee: 北京奇虎科技有限公司
Priority date: 2018-12-29
Filing date: 2019-12-27
Publication date: 2020-07-02
Also published as: CN111447166A; CN111447166B

Abstract

Disclosed are a vehicle attack detection method and apparatus. The method comprises: determining a network attack event occurring to a vehicle; determining a physical attack event occurring to the vehicle; and if the network attack event and the physical attack event occur to the vehicle in the same time period, determining that the vehicle is attacked in this time period.

Description

Vehicle attack detection method and device

Cross-reference for related applications

This application requires the priority of the Chinese patent application filed on December 29, 2018, with the application number 201811639337.1 and titled "Vehicle Attack Detection Method and Device", the entire contents of which are incorporated by reference in this application.

Technical field

The present disclosure relates to the technical field of vehicle safety, and in particular to a method and device for vehicle attack detection.

Background technique

With the continuous development of technology and society, the emergence of various types of intelligent and automated vehicles has greatly facilitated people's work and life, but it has also spawned many security threats against vehicles. For example, a programmable or remotely controllable intelligent unit in a vehicle provides a new intrusion channel for illegal intruders, thereby posing a great threat to people’s property and life safety.

In order to ensure the safety of the vehicle and realize the safety protection of the vehicle, it is first necessary to detect the attack on the vehicle through the corresponding detection method. At present, the detection of attacks against vehicles is limited to detecting whether there is an attack behavior against a vehicle in cyberspace. If there is an attack behavior against a vehicle in cyberspace, it is determined that the vehicle is under attack. However, the detection rate of vehicle attacks detected by this detection method is high, and the detection accuracy is low, which is not conducive to the safety protection of vehicles.

Summary of the invention

In view of the above problems, the present disclosure is proposed in order to provide a vehicle attack detection method and device that overcome the above problems or at least partially solve the above problems.

According to an aspect of the present disclosure, a vehicle attack detection method is provided, including:

Identify cyber-attacks targeting vehicles; and,

Identify the physical attacks that occurred against the vehicle;

If a network attack event and a physical attack event occur to the vehicle within the same time period, it is determined that the vehicle was attacked within the time period.

According to another aspect of the present disclosure, a vehicle attack detection device is provided, including:

The network attack detection unit is adapted to determine the network attack event that occurred against the vehicle;

The physical attack detection unit is adapted to determine the physical attack event that occurs against the vehicle;

The determining unit is adapted to determine that the vehicle is attacked within the time period if a network attack event and a physical attack event occur to the vehicle within the same time period.

According to yet another aspect of the present disclosure, a computing device is provided, including: a processor, a memory, a communication interface, and a communication bus, and the processor, memory, and communication interface complete communication with each other through the communication bus;

The memory is used to store at least one executable instruction. The executable instruction causes the processor to perform the operation corresponding to the vehicle attack detection method.

According to yet another aspect of the present disclosure, there is provided a non-volatile computer-readable storage medium having at least one executable instruction stored in the non-volatile computer-readable storage medium, the executable instruction causing the processor to execute as described above Operation corresponding to vehicle attack detection method.

According to still another aspect of the present disclosure, there is also provided a computer program product including a calculation program stored on the above-mentioned non-volatile computer-readable storage medium.

According to the vehicle attack detection method and device provided by the present disclosure, determine the network attack event that occurs to the vehicle; and, determine the physical attack event that occurs to the vehicle; if the network attack event occurs to the vehicle within the same time period and In the event of a physical attack, it is determined that the vehicle was attacked within this time period. This solution detects attacks on vehicles in multiple dimensions according to the attack events received by the vehicle in cyberspace and physical space, which can greatly reduce the false alarm rate, improve the accuracy of attack detection, and provide the basis for achieving vehicle safety protection; and, This solution is simple and easy to implement, and easy to implement and apply on a large scale.

The above description is only an overview of the technical solutions of the present disclosure. In order to better understand the technical means of the present disclosure, it can be implemented in accordance with the contents of the specification, and in order to make the above and other purposes, features and advantages of the present disclosure more obvious and understandable In the following, specific embodiments of the present disclosure are specifically mentioned.

Brief description of the drawings

By reading the detailed description of the preferred embodiments below, various other advantages and benefits will become clear to those of ordinary skill in the art. The drawings are only for the purpose of showing the preferred embodiments, and are not considered to limit the present disclosure. Furthermore, throughout the drawings, the same reference symbols are used to denote the same components. In the drawings:

FIG. 1 shows a schematic flowchart of a vehicle attack detection method according to an embodiment of the present disclosure;

FIG. 2 shows a schematic flowchart of a vehicle attack detection method according to another embodiment of the present disclosure;

FIG. 3 shows a schematic flowchart of a vehicle attack detection method according to yet another embodiment of the present disclosure;

4 shows a schematic structural diagram of a vehicle attack detection device according to an embodiment of the present disclosure;

FIG. 5 shows a schematic structural diagram of a computing device according to an embodiment of the present disclosure.

Preferred embodiments of the present disclosure

Hereinafter, exemplary embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

The vehicle attack detection method and device provided by the present disclosure can be specifically used for vehicle attack detection based on a CAN (Controller Area Network) bus structure.

FIG. 1 shows a schematic flowchart of a vehicle attack detection method according to an embodiment of the present disclosure. As shown in Figure 1, the method includes:

In step S110, it is determined that a network attack event occurred for the vehicle.

Among them, this step can be performed by the networked unit in the vehicle (such as on-board routing equipment, on-board entertainment unit, etc.); or, this step can also be performed by the cloud server, and the cloud server sends the determination result to the vehicle. The networking unit receives the determination result.

In the actual implementation process, it is possible to determine the network attack event that the vehicle has suffered in cyberspace. In this embodiment, the specific method for determining the network attack event received by the vehicle is not limited. For example, a whitelist, sandbox, behavior detection, and/or feature detection technology may be used to determine the network attack event that occurs to the vehicle. For example, it can be determined whether the network command issued to the vehicle is in the preset command white list by means of the command white list. If not, it is determined that a network attack event has occurred against the vehicle.

In step S120, it is determined that the physical attack event occurred for the vehicle.

Different from the prior art, in addition to determining the network attack event that occurs to the vehicle, this embodiment further determines the physical attack event that occurs to the vehicle. Among them, when determining the physical attack event against the vehicle, it is specifically determined according to the analog signal in the vehicle bus. For example, the legality of the source of the analog signal in the vehicle bus can be used to determine whether a physical attack event against the vehicle occurs . This embodiment does not limit the specific implementation manner of determining the physical attack event that occurs for the vehicle.

Wherein, this step may be performed by a physical attack detection unit provided in the vehicle, and the physical attack detection detection unit may be mounted on the vehicle CAN bus. Optionally, in order to reduce the false negative rate of attack detection, a physical attack detection unit can be installed in each CAN bus, or the physical attack detection unit can be installed in a gateway connected by each CAN bus, and set by The physical attack detection unit in the gateway monitors the physical attack events that occur on each CAN bus. This setting method can greatly reduce costs.

In this embodiment, the specific execution order of step S110 and step S120 is not limited, and the two may be executed sequentially or in parallel.

In step S130, if a network attack event and a physical attack event occur to the vehicle within the same time period, it is determined that the vehicle is attacked within the time period.

This embodiment uses two dimensions of network space and physical space to detect attacks on vehicles, which can greatly reduce the false alarm rate of attack detection and improve the accuracy of attack detection.

Specifically, in this embodiment, when it is determined that a network attack event and a physical attack event have occurred in the vehicle, the attack time corresponding to the network attack event and the physical attack event are recorded respectively. When it is determined that a network attack has occurred against the vehicle within the same time period Event and physical attack event, it is determined that the vehicle was attacked within this time period.

In this implementation, the length of the same time period is not limited. Those skilled in the art can set the corresponding time period length according to the accuracy requirements of attack detection; and/or, determine the length of the time period based on the big data analysis of historical attack events; and/or, according to the determined network attack event and The type of the attack event of the physical attack event determines the corresponding time period length, that is, this embodiment may pre-configure corresponding time period lengths for different attack event types.

It can be seen that in this embodiment, the vehicle is attacked from the two dimensions of network space and physical space. When the network attack event and the physical attack event occur to the vehicle within the same time period, determine The vehicle is attacked within this time period, which can greatly reduce the attack false alarm rate and improve the accuracy of vehicle attack detection, thereby providing a basis for the realization of vehicle safety protection; moreover, this solution is simple and easy to implement and apply on a large scale.

FIG. 2 shows a schematic flowchart of a vehicle attack detection method according to another embodiment of the present disclosure. As shown in Figure 2, the method includes:

Step S210, it is determined whether a network attack event has occurred against the vehicle; if so, it is determined that the network attack event corresponds to a time period.

In this embodiment, the specific method for determining the occurrence of a network attack event by a vehicle is not limited. For example, one or more combinations of the following embodiments may be used to determine whether a network attack event occurs for a vehicle:

In one embodiment, a corresponding command whitelist can be configured in the networking unit of the vehicle. When the networking unit in the vehicle receives a network command, it is determined whether the received network command is in the command whitelist. If not, then It is determined that a network attack event has occurred in the vehicle; alternatively, a corresponding command blacklist can be configured in the vehicle's networking unit. When the networking unit in the vehicle receives a network command, it is determined whether the received network command is in the command blacklist, If yes, it is determined that a cyberattack occurred in the vehicle. Optionally, the instruction whitelist and/or instruction blacklist may be dynamically updated according to the data in the cloud server. The cloud server can determine the corresponding command white list or command black list according to the analysis of the vehicle data in the IoV system, and deliver it to the vehicle, so that the vehicle can perform according to the command white list and/or command black list issued by the cloud server Decrement or incremental update. Optionally, in order to further improve the vehicle's attack detection accuracy and reduce the storage pressure of the vehicle networking unit, the cloud server may further finely divide the instruction whitelist and/or instruction blacklist into different types of vehicles or different The individual vehicles are configured with corresponding command whitelists and/or command blacklists, so as to realize the customization of the command whitelists or command blacklists for the vehicles and improve the attack detection effect of the vehicles.

In another embodiment, a sandbox detection technique may be used to determine the network attack event that occurred against the vehicle. In a specific implementation process, the network instruction may be placed in a sandbox environment, and whether a network attack event has occurred in the vehicle may be determined according to the execution result of the network instruction in the sandbox. Optionally, this embodiment may be specifically used in combination with an instruction whitelist and/or an instruction blacklist, that is, when the network instruction is not on the instruction whitelist, the network instruction is further placed in a sandbox environment to determine whether the vehicle occurs Cyber attacks.

Here, those skilled in the art should understand that the method of determining whether a network attack event has occurred for a vehicle not only includes the above two methods or a combination of the two methods, for example, it can also be based on behavior detection technology and/or characteristics The detection technology determines the network attack event that is directed against the vehicle. A person skilled in the art may select a corresponding detection method according to the actual situation, and this embodiment is not limited herein.

If it is determined through a corresponding detection method that a cyber attack event has occurred with respect to the vehicle, the time period corresponding to the cyber attack event is further determined. When determining the time period corresponding to the cyber attack event, you can first determine the time point corresponding to the network attack event and the preset time period length, and further determine the network attack according to the time point corresponding to the network attack event and the preset time period length The time period corresponding to the event. Among them, in the process of determining the time period corresponding to the network attack event according to the time point corresponding to the network attack event and the preset time period length, the time point corresponding to the network attack event can be used as the starting point of the time period, and the network attack event The sum of the corresponding time point and the preset time period length is taken as the end point of the time period; or, the difference between the time point corresponding to the cyber attack event and the half of the preset time period length is taken as the starting point of the time period, Take the sum of the time point corresponding to the cyber attack event and half the length of the preset time period as the end point of the time period, for example, if the time point corresponding to the cyber attack event is a and the preset time period length is b, then The time period corresponding to the network attack event can be (a, a+b), or (ab/2, a+b/2).

In step S220, it is determined whether a physical attack event against the vehicle has occurred within the time period; if so, it is determined that the vehicle has been attacked within the time period.

It is determined whether a physical attack event against the vehicle has occurred within the time period determined in step S210. Among them, when it is determined that the physical attack event targeting the vehicle can be carried out by the physical attack detection and detection unit mounted on the vehicle bus, the data message in the vehicle bus can be monitored, and according to the monitoring result, it can be determined whether a target attack has occurred within the time period. Physical attacks on vehicles.

In an alternative embodiment, the data message in the vehicle bus can be monitored to determine whether the data message comes from a legal electronic control unit (ECU, Electronic Control Unit); if not, it is determined that the vehicle has occurred Physical attack event. Among them, when judging whether the data message comes from a legitimate electronic control unit, it is necessary to first determine the electronic control unit that sends the data message. Different electronic control units in the vehicle send out the same data message corresponding to different analog signal voiceprints ( The analog signal voiceprint specifically refers to the characteristic data of the analog signal, for example, the data obtained after the corresponding mathematical conversion of the analog signal can be used as the analog signal voiceprint, such as the differential signal voltage of the analog signal, etc. Among them, machine learning can be used And other methods to pre-determine at least one analog signal voiceprint sent by at least one electronic control unit). Therefore, the data message can be analyzed to obtain the analog signal voiceprint corresponding to the data message, and the electronic control unit that sends the data message can be determined according to the analog signal voiceprint. Further, the electronic control unit in the vehicle can only send certain types or types of data messages. For example, the steering control message in the vehicle can only be sent by the steering control unit. Therefore, after determining the electronic control unit sending out the data message, determine whether the electronic control unit sending out the data message is in the white list of the electronic control unit corresponding to the data message; if not, it is determined that a physical attack has occurred against the vehicle event.

In yet another embodiment, the data message in the vehicle bus can be monitored, the data message can be parsed, and the analog signal voiceprint corresponding to the data message can be obtained; and whether the analog signal voiceprint corresponding to the data message can be determined The voiceprint of the standard analog signal corresponding to the data packet matches; if not, it is determined that a physical attack event has occurred against the vehicle. In the specific implementation process, for the same data message, different electronic control units send out the same data message to analyze different analog signals, and different analog signals correspond to different analog signal voiceprints, indicating different The analog signal corresponding to the same data message sent by the electronic control unit has different voiceprints. Therefore, for the data message, it can be determined in advance that the legal electronic control unit sends the analog signal of the data message, and then the analog signal voiceprint of the data message sent by the legal electronic control unit is used as the data message. Corresponding standard analog signal voiceprint, thus, in determining the physical attack event directed to the vehicle, it can be determined whether the analog signal voiceprint corresponding to the data message matches the standard analog signal voiceprint corresponding to the data message ; If not, it is determined that a physical attack has occurred against the vehicle.

If a physical attack event against the vehicle occurs within a certain period of time, it is determined that the vehicle is under attack within the certain period of time.

Optionally, after it is determined that the vehicle is under attack, a corresponding warning message may be further issued, so that the attack behavior can be quickly blocked.

It can be seen that this embodiment detects the attack of the vehicle from two dimensions of network space and physical space. When it is determined that a network attack event has occurred for the vehicle, it is determined that the time period corresponds to the network attack event, and then when Within a certain period of time, when a physical attack event targeting the vehicle occurs, it is determined that the vehicle is under attack, which can greatly reduce the rate of attack false alarms and improve the accuracy of vehicle attack detection, thereby providing a basis for achieving vehicle safety protection; and, this The embodiment is determined by determining whether the data message in the vehicle bus originates from a legitimate electronic control unit, and/or determining whether the analog signal voiceprint corresponding to the data message matches the standard analog signal voiceprint corresponding to the data message. For the physical attack events that occur in vehicles, the detection efficiency and accuracy of physical attack events can be greatly improved.

FIG. 3 shows a schematic flowchart of a vehicle attack detection method according to yet another embodiment of the present disclosure. As shown in Figure 3, the method includes:

Step S310: Determine whether a physical attack event occurs for the vehicle; if so, determine a time period corresponding to the physical attack event.

In step S320, it is determined whether a network attack event targeting the vehicle has occurred within the time period; if so, it is determined that the vehicle has been attacked within the time period.

For the specific implementation manners of step S310 and step S320, reference may be made to the corresponding description in step S210 and step S220, and this embodiment will not repeat them here.

It can be seen that this embodiment detects attacks on vehicles from two dimensions of network space and physical space. When it is determined that a physical attack event has occurred for the vehicle, the time period corresponding to the physical attack event is determined, and then the During a certain period of time, when a network attack event targeting a vehicle occurs, it is determined that the vehicle is under attack, which can greatly reduce the attack false alarm rate and improve the accuracy of vehicle attack detection, thereby providing a basis for achieving vehicle safety protection; and, this The embodiment is determined by determining whether the data message in the vehicle bus originates from a legitimate electronic control unit, and/or determining whether the analog signal voiceprint corresponding to the data message matches the standard analog signal voiceprint corresponding to the data message. For the physical attack events that occur in vehicles, the detection efficiency and accuracy of physical attack events can be greatly improved.

FIG. 4 shows a schematic structural diagram of a vehicle attack detection device according to an embodiment of the present disclosure. As shown in FIG. 4, the device includes: a network attack detection unit 41, a physical attack detection unit 42 and a determination unit 43.

The network attack detection unit 41 is adapted to determine a network attack event that occurs against the vehicle. Optionally, the network attack detection unit 41 may be a networked unit in the vehicle.

The physical attack detection unit 42 is adapted to determine a physical attack event that occurs with respect to the vehicle. Among them, the physical attack detection unit 42 may be mounted on the vehicle bus. Optionally, the physical attack detection unit 42 may be provided in a gateway connected by all vehicle buses, and the physical attack detection unit 42 provided in the gateway monitors the physical attack events occurring on each vehicle bus, which may be larger The cost is reduced to a certain extent; alternatively, a physical attack detection unit 42 may be installed in each vehicle bus, thereby avoiding the disadvantage that the physical attack event in the entire vehicle cannot be monitored when the gateway is invaded.

The determining unit 43 is adapted to determine that the vehicle is attacked within the time period if a network attack event and a physical attack event occur to the vehicle within the same time period. The module can be executed by a special processing unit mounted on the vehicle bus, or can be integrated into the network attack detection unit 41 or the physical attack detection unit 42.

Optionally, the physical attack detection unit 42 is further adapted to: monitor data packets in the vehicle bus to determine whether the data packets come from a legitimate electronic control unit; if not, determine that a physical attack event has occurred against the vehicle.

Optionally, the physical attack detection unit 42 is further adapted to: determine the electronic control unit that sends the data message, and determine whether the electronic control unit that sends the data message is in the white list of the electronic control unit corresponding to the data message; if not, It is determined that a physical attack event occurred against the vehicle.

Optionally, the physical attack detection unit 42 is further adapted to: analyze the data message to obtain an analog signal voiceprint corresponding to the data message; and determine the electronic control unit that sends the data message according to the analog signal voiceprint.

Optionally, the physical attack detection unit 42 is further adapted to: monitor data packets in the vehicle bus, parse the data packets, and obtain analog signal voiceprints corresponding to the data packets; determine analog signals corresponding to the data packets Whether the voiceprint matches the standard analog signal voiceprint corresponding to the data message; if not, it is determined that a physical attack event has occurred against the vehicle.

Optionally, the analog signals corresponding to the same data message sent by different electronic control units have different voiceprints.

Optionally, the network attack detection unit 41 is further adapted to: use a whitelist, sandbox, behavior detection, and/or feature detection technology to determine a network attack event that occurs with respect to the vehicle.

Optionally, the network attack detection unit 41 is further adapted to: determine whether a network attack event has occurred for the vehicle; if so, determine a time period corresponding to the network attack event;

The physical attack detection unit 42 is further adapted to: determine whether a physical attack event targeting the vehicle has occurred within a certain period of time;

The determining unit 43 is further adapted to: if a physical attack event targeting the vehicle occurs within the determined time period, determine that the vehicle is attacked within the determined time period.

Optionally, the physical attack detection unit 42 is further adapted to: determine whether a physical attack event occurs for the vehicle; if so, determine a time period corresponding to the physical attack event;

The network attack detection unit 41 is further adapted to: determine whether a network attack event targeting the vehicle has occurred within a certain period of time;

The determining unit 43 is further adapted to: if a network attack event targeting the vehicle occurs within the determined time period, determine that the vehicle is attacked within the determined time period.

For the specific implementation process of each unit in the device, reference may be made to the description of the corresponding steps in the method embodiments in FIG. 1, FIG. 2, and/or FIG. 3, and this embodiment will not be described here.

According to an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided. The non-volatile computer-readable storage medium stores at least one executable instruction, and the computer-executable instruction can execute any of the foregoing method embodiments. Vehicle attack detection method in

FIG. 5 shows a schematic structural diagram of a computing device according to an embodiment of the present disclosure. Specific embodiments of the present disclosure do not limit the specific implementation of the computing device.

As shown in FIG. 5, the computing device may include: a processor 502, a communication interface 504, a memory 506, and a communication bus 508.

among them:

The processor 502, the communication interface 504, and the memory 506 communicate with each other through the communication bus 508.

The communication interface 504 is used to communicate with network elements of other devices such as clients or other servers.

The processor 502 is used to execute the program 510, and specifically can execute the relevant steps in the foregoing vehicle attack detection method embodiment.

Specifically, the program 510 may include a program code, and the program code includes a computer operation instruction.

The processor 502 may be a central processing unit CPU, or a specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present disclosure. The one or more processors included in the computing device may be processors of the same type, such as one or more CPUs, or may be processors of different types, such as one or more CPUs and one or more ASICs.

The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), for example, at least one magnetic disk memory.

The program 510 may specifically be used to cause the processor 502 to perform the following operations:

Identify cyber-attacks targeting vehicles; and,

Identify the physical attacks that occurred against the vehicle;

In an optional implementation manner, the program 510 may specifically be used to cause the processor 502 to perform the following operations:

Monitor the data messages in the vehicle bus to determine whether the data messages come from a legal electronic control unit;

If not, it is determined that a physical attack event has occurred against the vehicle.

Determine the electronic control unit sending out the data message, and determine whether the electronic control unit sending out the data message is in the white list of the electronic control unit corresponding to the data message;

Analyze the data message to obtain the voiceprint of the analog signal corresponding to the data message;

The electronic control unit that sends out the data message is determined according to the analog signal voiceprint.

Monitor the data message in the vehicle bus, analyze the data message, and obtain the analog signal voiceprint corresponding to the data message;

Determine whether the analog signal voiceprint corresponding to the data message matches the standard analog signal voiceprint corresponding to the data message;

In an optional embodiment, the analog signals corresponding to different electronic control units sending the same data message have different voiceprints.

Use whitelists, sandboxes, behavioral detection, and/or feature detection techniques to identify cyber-attack events that occur against vehicles.

Determine whether a cyber-attack occurred against the vehicle;

If yes, determine the time period corresponding to the cyber attack event;

Determine whether a physical attack event targeting the vehicle has occurred within a certain period of time;

Determine whether a physical attack has occurred against the vehicle;

If yes, determine the time period corresponding to the physical attack event;

Determine whether a network attack event targeting the vehicle has occurred within a certain period of time;

If a network attack event targeting the vehicle occurs within a certain period of time, it is determined that the vehicle is under attack within the certain period of time.

The algorithms and displays provided here are not inherently related to any particular computer, virtual system or other devices. Various general-purpose systems can also be used with the teaching based on this. From the above description, the structure required to construct such systems is obvious. Furthermore, this disclosure is not directed to any particular programming language. It should be understood that various programming languages may be used to implement the contents of the present disclosure described herein, and the description of specific languages above is for disclosing the best embodiments of the present disclosure.

The specification provided here explains a lot of specific details. However, it can be understood that the embodiments of the present disclosure can be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this description.

Similarly, it should be understood that in order to streamline the disclosure and help understand one or more of the various disclosed aspects, in the above description of exemplary embodiments of the disclosure, various features of the disclosure are sometimes grouped together into a single embodiment, Figure, or its description. However, the disclosed method should not be interpreted as reflecting the intention that the claimed disclosure requires more features than those explicitly recited in each claim. Rather, as reflected in the following claims, the disclosed aspects lie in less than all features of a single disclosed embodiment. Therefore, the claims that follow the specific implementation are hereby expressly incorporated into the specific implementation, where each claim itself serves as a separate embodiment of the present disclosure.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and set in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition, they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and/or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstract and drawings) and any methods so disclosed or All processes or units of equipment are combined. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose.

In addition, those skilled in the art can understand that although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present disclosure And form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.

Various component embodiments of the present disclosure may be implemented in hardware, or implemented in software modules running on one or more processors, or implemented in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the vehicle attack detection device according to the embodiments of the present disclosure. The present disclosure may also be implemented as a device or device program (eg, computer program and computer program product) for performing part or all of the method described herein. Such a program implementing the present disclosure may be stored on a computer-readable medium, or may have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the present disclosure, and those skilled in the art may design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs between parentheses should not be constructed as limitations on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "one" before an element does not exclude the presence of multiple such elements. The present disclosure can be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In the unit claims enumerating several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

Claims

A vehicle attack detection method, including:

Identify cyber-attacks targeting vehicles; and,

Identify the physical attacks that occurred against the vehicle;

If the network attack event and the physical attack event occur to the vehicle within the same time period, it is determined that the vehicle is attacked within the time period.
The method of claim 1, wherein the determining that the physical attack event occurred for the vehicle further comprises:

Monitoring data messages in the vehicle bus to determine whether the data messages come from a legitimate electronic control unit;

If not, it is determined that a physical attack event has occurred against the vehicle.
The method according to claim 2, wherein the determining whether the data message comes from a legitimate electronic control unit; if not, determining that a physical attack event has occurred against the vehicle further includes:

Determine the electronic control unit that sends the data message, and determine whether the electronic control unit that sends the data message is in the white list of electronic control units corresponding to the data message;

If not, it is determined that a physical attack event has occurred against the vehicle.
The method according to claim 3, wherein the electronic control unit that determines to issue the data message further comprises:

Parse the data message to obtain an analog signal voiceprint corresponding to the data message;

The electronic control unit that sends out the data message is determined according to the analog signal voiceprint.
The method according to any one of claims 1 to 4, wherein the determining that the physical attack event occurred to the vehicle further comprises:

Monitoring data packets in the vehicle bus, parsing the data packets, and obtaining analog signal voiceprints corresponding to the data packets;

Judging whether the voiceprint of the analog signal corresponding to the data message matches the voiceprint of the standard analog signal corresponding to the data message;

If not, it is determined that a physical attack event has occurred against the vehicle.
The method according to claim 4 or 5, wherein the analog signals corresponding to the same data message sent by different electronic control units have different voiceprints.
The method according to any one of claims 1 to 6, wherein the determining that the network attack event occurred to the vehicle further includes:

Use whitelists, sandboxes, behavioral detection, and/or feature detection techniques to identify cyber-attack events that occur against vehicles.
The method according to any one of claims 1-7, wherein the determination is directed to a network attack event that occurred on the vehicle; and, the determination is directed to a physical attack event that occurred on the vehicle; if within the same time period, If a network attack event or a physical attack event occurs in the vehicle, determining that the vehicle is attacked within the time period further includes:

Determine whether a cyber-attack occurred against the vehicle;

If yes, determine the time period corresponding to the cyber attack event;

Determine whether a physical attack event targeting the vehicle has occurred within a certain period of time;

If a physical attack event targeting the vehicle occurs within the determined time period, it is determined that the vehicle was attacked within the determined time period.
The method according to any one of claims 1-7, wherein the determination is directed to a network attack event that occurred on the vehicle; and, the determination is directed to a physical attack event that occurred on the vehicle; if within the same time period, If a network attack event or a physical attack event occurs in the vehicle, determining that the vehicle is attacked within the time period further includes:

Determine whether a physical attack has occurred against the vehicle;

If yes, determine the time period corresponding to the physical attack event;

Determine whether a network attack event targeting the vehicle has occurred within a certain period of time;

If a network attack event targeting the vehicle occurs within the determined time period, it is determined that the vehicle was attacked within the determined time period.
A vehicle attack detection device, including:

The network attack detection unit is adapted to determine the network attack event that occurred against the vehicle;

The physical attack detection unit is adapted to determine the physical attack event that occurs against the vehicle;

The determining unit is adapted to determine that the vehicle is attacked within the time period if a network attack event and a physical attack event occur to the vehicle within the same time period.
The apparatus according to claim 10, wherein the physical attack detection unit is further adapted to:

Monitoring data messages in the vehicle bus to determine whether the data messages come from a legitimate electronic control unit;

If not, it is determined that a physical attack event has occurred against the vehicle.
The apparatus according to claim 11, wherein the physical attack detection unit is further adapted to:

Determine the electronic control unit that sends the data message, and determine whether the electronic control unit that sends the data message is in the white list of electronic control units corresponding to the data message;

If not, it is determined that a physical attack event has occurred against the vehicle.
The apparatus according to claim 12, wherein the physical attack detection unit is further adapted to:

Parse the data message to obtain an analog signal voiceprint corresponding to the data message;

The electronic control unit that sends out the data message is determined according to the analog signal voiceprint.
The apparatus according to any one of claims 10-13, wherein the physical attack detection unit is further adapted to:

Monitoring data packets in the vehicle bus, parsing the data packets, and obtaining analog signal voiceprints corresponding to the data packets;

Judging whether the voiceprint of the analog signal corresponding to the data message matches the voiceprint of the standard analog signal corresponding to the data message;

If not, it is determined that a physical attack event has occurred against the vehicle.
The apparatus according to claim 13 or 14, wherein the analog signals corresponding to the same data message issued by different electronic control units have different voiceprints.
The apparatus according to any one of claims 10-15, wherein the network attack detection unit is further adapted to:

Use whitelists, sandboxes, behavioral detection, and/or feature detection techniques to identify cyber-attack events that occur against vehicles.
The device according to any one of claims 10-16, wherein the network attack detection unit is further adapted to: determine whether a network attack event has occurred against the vehicle; if so, determine the time corresponding to the network attack event segment;

The physical attack detection unit is further adapted to: determine whether a physical attack event targeting the vehicle has occurred within a determined time period;

The determining unit is further adapted to: if a physical attack event targeting the vehicle occurs within a determined time period, determine that the vehicle was attacked within the determined time period.
The device according to any one of claims 10-16, wherein

The physical attack detection unit is further adapted to: determine whether a physical attack event occurs for the vehicle; if so, determine a time period corresponding to the physical attack event;

The network attack detection unit is further adapted to: determine whether a network attack event targeting the vehicle has occurred within a determined time period;

The determining unit is further adapted to: if a network attack event targeting the vehicle occurs within a determined time period, determine that the vehicle was attacked within the determined time period.
A computing device includes: a processor, a memory, a communication interface, and a communication bus, and the processor, the memory, and the communication interface complete communication with each other through the communication bus;

The memory is used to store at least one executable instruction that causes the processor to perform the operation corresponding to the vehicle attack detection method according to any one of claims 1-9.
A non-volatile computer-readable storage medium, at least one executable instruction is stored in the non-volatile computer storage medium, and the executable instruction causes the processor to execute any one of claims 1-9 Corresponding to the vehicle attack detection method described above.
A computer program product, the computer program product includes a computer program stored on a non-volatile computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by the processor, the processor is executed The operation corresponding to the vehicle attack detection method according to any one of claims 1-9.