CN106650505A - Vehicle attack detection method and device - Google Patents
Vehicle attack detection method and device Download PDFInfo
- Publication number
- CN106650505A CN106650505A CN201611239362.1A CN201611239362A CN106650505A CN 106650505 A CN106650505 A CN 106650505A CN 201611239362 A CN201611239362 A CN 201611239362A CN 106650505 A CN106650505 A CN 106650505A
- Authority
- CN
- China
- Prior art keywords
- vehicle body
- parameter values
- status parameter
- state
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/82—Protecting input, output or interconnection devices
- G06F21/85—Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices
Abstract
The embodiment of the invention provides a vehicle attack detection method and device. The method specifically comprises the steps of collecting car body bus data; determining information entropy corresponding to the car body bus data; if the information entropy exceeds a preset range, determining that a car body bus is attacked, and sending a warning message. According to the vehicle attack detection method and device, whether the car body bus is attacked or not can be detected, when it is determined that the car body bus is attacked, the warning message can be sent, so that a user takes measures to stop deep development of the attack as soon as possible, and the traffic safety and information safety of the user are accordingly improved.
Description
Technical field
The present invention relates to communication technical field, more particularly to a kind of vehicle attack detection method and device.
Background technology
With the continuous development of network technology, vehicle can pass through 3G (3rd-Generation, 3G (Third Generation) Moblie skill
Art)/4G (the 4th Generation mobile communication technology, forth generation mobile communication skill
Art), the mode such as Wi-Fi (WIreless-Fidelity, Wireless Fidelity) access internet, foradownloaded video, music from internet
Etc. resource, or, remotely control can also be realized to vehicle by internet, it is that user brings great convenience.
While internet offers convenience for user, information of vehicles safety problem also becomes particularly important, more and more
Car Area Network adopt internet standard, breaking through " fire wall " of vehicle interior also just becomes easy, mutual for accessing
The vehicle of networking, hacker just can launch a offensive via external network to the vehicle in traveling.Cause mobile unit and vehicle-mounted lead
Boat instrument system exception, or in-vehicle information and driver personal privacy information etc. are revealed, it is that user drives and user profile
Bring great potential safety hazard.
However, at present Ge great vehicles manufacturer lacks active detecting and defence capability to online vehicles attack.
Therefore, a kind of security mechanism that active detecting can be carried out to the attack of hacker is needed badly, to improve the traffic safety of user
And information security.
The content of the invention
In view of the above problems, it is proposed that the present invention so as to provide one kind overcome the problems referred to above or at least in part solve on
State a kind of vehicle attack detection method and device of problem.
According to one aspect of the present invention, there is provided a kind of vehicle attack detection method, including：
Collection vehicle body bus data；
Determine the corresponding comentropy of the Vehicle Body Bus data；
If described information entropy exceeds presetting range, it is determined that the Vehicle Body Bus are under attack, send warning information.
Alternatively, it is described the step of determine the Vehicle Body Bus data corresponding comentropy, including：
The data volume and the vehicle body for obtaining vehicle body status parameter values in the Vehicle Body Bus data in preset time period is total
The total amount of data of line number evidence；
According to the data volume and the total amount of data of the Vehicle Body Bus data of the vehicle body status parameter values, the car is determined
The corresponding comentropy of body bus data.
Alternatively, methods described also includes：
Judge the vehicle body status parameter values in the Vehicle Body Bus data whether in abnormality；
If the vehicle body status parameter values are in abnormality, it is determined that the Vehicle Body Bus are under attack, send alarm
Information.
Alternatively, whether the vehicle body status parameter values judged in the Vehicle Body Bus data are in the step of abnormality
Suddenly, including：
The vehicle body status parameter values are compared with normal parameter values, if the vehicle body status parameter values with it is described just
Often the difference of parameter value exceeds predetermined threshold value, it is determined that the vehicle body status parameter values are in abnormality.
Alternatively, whether the vehicle body status parameter values judged in the Vehicle Body Bus data are in the step of abnormality
Suddenly, including：
Judge whether the vehicle body status parameter values with incidence relation correspond with corresponding normal range (NR)；
If having at least one parameter value not meet corresponding normal range (NR) in the vehicle body status parameter values with incidence relation,
Then determine that the vehicle body status parameter values are in abnormality.
Alternatively, whether the vehicle body status parameter values judged in the Vehicle Body Bus data are in the step of abnormality
Suddenly, including：
By the vehicle body status parameter values input state detection model；The state-detection model is according to the vehicle body collected
Obtained by status parameter values sample is trained；
If the output result of the state-detection model is abnormality, it is determined that the vehicle body status parameter values are in different
Normal state.
Alternatively, methods described also includes：
Collect the driving behavior data of user；
The state-detection model is adjusted according to the driving behavior data of the user, is driven with obtaining meeting user
Sail the state-detection model of custom.
Alternatively, the state-detection model is arranged in Cloud Server, described by vehicle body status parameter values input
The step of state-detection model, including：
The vehicle body status parameter values are uploaded to into the Cloud Server, vehicle body status parameter values input is described
State-detection model in Cloud Server carries out abnormal state detection.
Alternatively, the vehicle body status parameter values at least include following parameter：Speed, rotating speed, speed, gear, oil mass, water advanced in years
Temperature.
According to a further aspect in the invention, there is provided a kind of vehicle attack detecting device, including：
Data acquisition module, for gathering vehicle body bus data；
Comentropy determining module, for determining the corresponding comentropy of the Vehicle Body Bus data；
First attacks determining module, if exceeding presetting range for described information entropy, it is determined that the Vehicle Body Bus are subject to
Attack, send warning information.
Alternatively, described information entropy determining module, including：
Data volume acquisition submodule, for obtaining in preset time period vehicle body status parameter values in the Vehicle Body Bus data
Data volume and the Vehicle Body Bus data total amount of data；
Comentropy determination sub-module, for according to the data volume of the vehicle body status parameter values and the Vehicle Body Bus data
Total amount of data, determine the corresponding comentropy of the Vehicle Body Bus data.
Alternatively, described device also includes：
Abnormality judge module, for judging the Vehicle Body Bus data in vehicle body status parameter values whether in different
Normal state；
Second attacks determining module, if being in abnormality for the vehicle body status parameter values, it is determined that the vehicle body
Bus is under attack, sends warning information.
Alternatively, the abnormality judge module, including：
First judging submodule, for the vehicle body status parameter values to be compared with normal parameter values, if the car
Body status parameter values exceed predetermined threshold value with the difference of the normal parameter values, it is determined that the vehicle body status parameter values are in different
Normal state.
Alternatively, the abnormality judge module, including：
Second judging submodule, for judging it is corresponding whether the vehicle body status parameter values with incidence relation correspond with
Normal range (NR)；
Abnormal determination sub-module, if for having at least one parameter value not in the vehicle body status parameter values with incidence relation
Meet corresponding normal range (NR), it is determined that the vehicle body status parameter values are in abnormality.
Alternatively, the abnormality judge module, including：
Mode input submodule, for by the vehicle body status parameter values input state detection model；The state-detection
Model be according to collect vehicle body status parameter values sample be trained obtained by；
As a result output sub-module, if the output result for the state-detection model is abnormality, it is determined that described
Vehicle body status parameter values are in abnormality.
Alternatively, described device also includes：
Behavior collection module, for collecting the driving behavior data of user；
Model adjusting module, for being adjusted to the state-detection model according to the driving behavior data of the user
It is whole, to obtain meeting the state-detection model of user's driving habit.
Alternatively, the state-detection model is arranged in Cloud Server, the mode input submodule, including：
Uploading unit, for the vehicle body status parameter values to be uploaded to into the Cloud Server, by the vehicle body state
The state-detection model that parameter value is input in the Cloud Server carries out abnormal state detection.
Alternatively, the vehicle body status parameter values at least include following parameter：Speed, rotating speed, speed, gear, oil mass, water advanced in years
Temperature.
A kind of vehicle attack detection method for providing according to embodiments of the present invention and device, by detecting Vehicle Body Bus data
Comentropy it is whether under attack to judge Vehicle Body Bus.Because the comentropy of Vehicle Body Bus data can reflect Vehicle Body Bus number
According to stable state, if the comentropy exceeds presetting range, illustrate that Vehicle Body Bus data are in not quietly state, Ye Jiche
The abnormal data for occurring for attacking is possible in body bus data, hence, it can be determined that the Vehicle Body Bus are under attack, and
Send warning information so that user take measures as early as possible prevent attack deep development, and then improve user traffic safety with
And information security.
Described above is only the general introduction of technical solution of the present invention, in order to better understand the technological means of the present invention,
And can be practiced according to the content of specification, and in order to allow the above and other objects of the present invention, feature and advantage can
Become apparent, below especially exemplified by the specific embodiment of the present invention.
Description of the drawings
By the detailed description for reading hereafter optional embodiment, various other advantages and benefit is common for this area
Technical staff will be clear from understanding.Accompanying drawing is only used for illustrating the purpose of optional embodiment, and is not considered as to the present invention
Restriction.And in whole accompanying drawing, it is denoted by the same reference numerals identical part.In the accompanying drawings：
The step of Fig. 1 shows a kind of vehicle attack detection method according to an embodiment of the invention flow chart；
The step of Fig. 2 shows a kind of vehicle attack detection method according to an embodiment of the invention flow chart；And
Fig. 3 shows a kind of structured flowchart of vehicle attack detecting device according to an embodiment of the invention.
Specific embodiment
The exemplary embodiment of the disclosure is more fully described below with reference to accompanying drawings.Although showing the disclosure in accompanying drawing
Exemplary embodiment, it being understood, however, that may be realized in various forms the disclosure and should not be by embodiments set forth here
Limited.On the contrary, there is provided these embodiments are able to be best understood from the disclosure, and can be by the scope of the present disclosure
Complete conveys to those skilled in the art.
With reference to Fig. 1, flow chart the step of show a kind of vehicle attack detection method according to an embodiment of the invention,
Specifically may include steps of：
Step 101, collection vehicle body bus data；
Step 102, determine the corresponding comentropy of the Vehicle Body Bus data；
If step 103, described information entropy exceed presetting range, it is determined that the Vehicle Body Bus are under attack, send alarm
Information.
In actual applications, attacker is to Vehicle Body Bus data generally by distorting, to reach the mesh of attack vehicle
's.The embodiment of the present invention can be used to carry out safety detection to vehicle bus, to find the attack to vehicle bus in time, and
And warning information is sent, and then improve the traffic safety and information security of user.
In actual applications, the embodiment of the present invention can pre-set safety detection rule, and be examined using the safety
Gauge is then detected to the Vehicle Body Bus data of Real-time Collection, to judge whether Vehicle Body Bus are under attack.Alternatively, it is described
Safety detection rule can be placed in vehicle locally, for example, can be by the safety detection rule setting in T-BOX
The car networkings such as (Telematics BOX, vehicle intelligent terminal), OBD (On-Board Diagnostic, onboard diagnostic system) set
In standby, because the car networking equipment has the function of collection vehicle body bus data, therefore, the embodiment of the present invention can be without again
Additionally increase independent functional module, to save hardware cost.
Or, the safety detection rule can also be placed in Cloud Server, set from Cloud Server to the car networking of vehicle
It is standby to issue the safety detection rule.The car networking equipment is regular to Real-time Collection by the safety detection that Cloud Server is issued
Vehicle Body Bus data carry out safety detection, when it is determined that Vehicle Body Bus are under attack, send warning information.The car networking sets
It is standby the Vehicle Body Bus data of collection and testing result to be uploaded to Cloud Server, so that Cloud Server can be to each car
The Vehicle Body Bus data and testing result that networked devices are uploaded are analyzed, excellent constantly to carry out to the safety detection rule
Change and update.
In the embodiment of the present invention, the comentropy of Vehicle Body Bus data is usual in certain limit during vehicle body operating condition
Inside fluctuated, namely Vehicle Body Bus data are generally in certain stable state.If the comentropy of Vehicle Body Bus data exceeds
Normal fluctuation range, then it is considered that Vehicle Body Bus are possible under attack.Therefore, safety detection rule specifically can be with
For：The corresponding comentropy of monitoring Vehicle Body Bus data, if described information entropy exceeds presetting range, it is determined that Vehicle Body Bus are attacked
Hit.Wherein, the presetting range can be that the Vehicle Body Bus data message entropy for obtaining is counted under Vehicle Body Bus normal condition
Fluctuation range.
In a kind of alternative embodiment of the present invention, the step for determining the corresponding comentropy of the Vehicle Body Bus data
Suddenly, specifically can include：
Step S11, obtain in preset time period the data volume of vehicle body status parameter values and institute in the Vehicle Body Bus data
State the total amount of data of Vehicle Body Bus data；
The total amount of data of step S12, the data volume according to the vehicle body status parameter values and the Vehicle Body Bus data, really
Determine the corresponding comentropy of the Vehicle Body Bus data.
In actual applications, the vehicle of different model generally has different bus control commands, and attacker is to vehicle body
Before bus is attacked, attack trial is generally carried out to vehicle first, corresponding attack cut-and-try process can include：By sending
It is substantial amounts of to attempt order, to attempt drawing the bus control commands of certain vehicle, such as braking commands, door opening command, and utilize
The bus control commands for obtaining carry out vehicle attack.During normal vehicle operation, the total amount of data of Vehicle Body Bus data
It is usually maintained in certain stable scope, if within certain time, attacker sends substantial amounts of brake by Vehicle Body Bus
Order is attempted, then substantial amounts of abnormal vehicle body status parameter values occurs in this time in Vehicle Body Bus data so that vehicle body shape
The data volume of state parameter value significantly increases, and then the total amount of data of Vehicle Body Bus data is consequently increased, so as to cause vehicle body total
The total amount of data of line number evidence exceeds normal fluctuation range.
Namely during attacker carries out attack trial to vehicle, attacker can send substantial amounts of by Vehicle Body Bus
Attempt order so that the total amount of data of the data volume of vehicle body status parameter values and the Vehicle Body Bus data in Vehicle Body Bus data
There is significantly change, therefore, the embodiment of the present invention is by vehicle body shape in the Vehicle Body Bus data in acquisition preset time period
The total amount of data of the data volume of state parameter value and the Vehicle Body Bus data, and according to the data of the vehicle body status parameter values
The total amount of data of amount and the Vehicle Body Bus data, determines the corresponding comentropy of the Vehicle Body Bus data.The comentropy can be with
The state of Vehicle Body Bus data in reflection preset time period, the state can include stable state or unstable state, for example,
Attacker sends the substantial amounts of order for attempting brake, then the comentropy of calculated Vehicle Body Bus data may be larger for one
Value, and beyond presetting range, then can determine the Vehicle Body Bus because under attack and unstable, therefore alarm can be sent
Information.
In embodiments of the present invention, the corresponding comentropy of the Vehicle Body Bus data can as follows be calculated：Really
The data volume of the fixed vehicle body status parameter values and the ratio of the total amount of data of the Vehicle Body Bus data, the calculating ratio,
And the product of the logarithm value (value for obtaining of taking the logarithm) of the ratio, using the negative value of the product for obtaining as the Vehicle Body Bus
The corresponding comentropy of data.
It is appreciated that the mode of the corresponding comentropy of above-mentioned calculating Vehicle Body Bus data is only as one kind application of the present invention
Example, in a particular application, the embodiment of the present invention is not any limitation as the concrete calculation of described information entropy.
To sum up, the vehicle attack detection method of the embodiment of the present invention, is sentenced by detecting the comentropy of Vehicle Body Bus data
Whether disconnected Vehicle Body Bus are under attack.Because the comentropy of Vehicle Body Bus data can reflect the stable shape of Vehicle Body Bus data
State, if the comentropy exceeds presetting range, illustrates that Vehicle Body Bus data are in not quietly state, namely Vehicle Body Bus data
In be possible to the abnormal data that occurs for attacking, hence, it can be determined that the Vehicle Body Bus are under attack, and send alarm letter
Breath, so that user takes measures to prevent the deep development attacked as early as possible, and then improves the traffic safety and information security of user.
In a kind of alternative embodiment of the present invention, the safety detection rule can also be：Monitor the Vehicle Body Bus
Whether the vehicle body status parameter values in data are in abnormality, if the vehicle body status parameter values are in abnormality, really
The fixed Vehicle Body Bus are under attack, send warning information.With reference to Fig. 2, one kind according to an embodiment of the invention is shown
The step of vehicle attack detection method flow chart, specifically may include steps of：
Step 201, collection vehicle body bus data；
Step 202, determine the corresponding comentropy of the Vehicle Body Bus data；
If step 203, described information entropy exceed presetting range, it is determined that the Vehicle Body Bus are under attack, send alarm
Information；
Whether step 204, the vehicle body status parameter values judged in the Vehicle Body Bus data are in abnormality；
If step 205, the vehicle body status parameter values are in abnormality, it is determined that the Vehicle Body Bus are under attack,
Send warning information.
It should be noted that the embodiment of the present invention for above-mentioned steps 202- step 203 and step 204- step 205 it
Between execution sequence be not any limitation as.For example, step 202- step 203 can be first carried out, then execution step 204- step 205；
Or first carry out step 204- step 205, then execution step 202- step 203；Or side by side while execution step 202- step
203 and step 204- step 205.
After vehicle start-up, each ECU (Electronic Control Unit, electronic control unit) of vehicle body just starts
Sequentially activate work, and the data for description vehicle body parameter occur, hereinafter referred to as vehicle body status parameter values are also begun in Vehicle Body Bus.
In a kind of alternative embodiment of the present invention, the vehicle body status parameter values at least include following parameter value：Speed, rotating speed, step speed,
Gear, oil mass, water temperature.
Whether the embodiment of the present invention can provide the vehicle body status parameter values judged in the Vehicle Body Bus data in different
The following alternative of normal state.
Scheme one
In a particular application, attacker is when attacking vehicle, attack trial stage in the early stage, is often directed to
Vehicle certain functional module individually carries out trial attack.Therefore, this programme is by judging whether single vehicle body status parameter values are located
In abnormality, can detect whether vehicle is under attack at the attack initial stage, to send warning information in time, reduce use as early as possible
The loss at family.
Specifically, whether the vehicle body status parameter values judged in the Vehicle Body Bus data are in the step of abnormality
Suddenly, can include：The vehicle body status parameter values are compared with normal parameter values, if the vehicle body status parameter values and institute
The difference for stating normal parameter values exceeds predetermined threshold value, it is determined that the vehicle body status parameter values are in abnormality.
For example, current rotating speed is detected substantially beyond rated speed, or, current water temperature substantially exceeds normal water temperature etc.,
Can determine that the vehicle body status parameter values are in abnormality.
Scheme two
It is not strict independent between the vehicle body status parameter values for being obtained in vehicle travel process, but mutually
Between there is certain incidence relation.There is incidence relation, the height of water temperature in the span and rotating speed and gear for such as stepping speed
It is low to there is also incidence relation etc. with rotating speed, outside air temperature, running time.Therefore, scheme two is by the car with incidence relation
Body status parameter values are detected, to judge whether Vehicle Body Bus are under attack, further improve the accuracy of attack detecting.
Specifically, whether the vehicle body status parameter values judged in the Vehicle Body Bus data are in the step of abnormality
Suddenly, can include：
Whether step S21, vehicle body status parameter values of the judgement with incidence relation correspond with corresponding normal range (NR)；
If there have at least one parameter value not meet in step S22, the vehicle body status parameter values with incidence relation to be corresponding
Normal range (NR), it is determined that the vehicle body status parameter values are in abnormality.
For example, speed, rotating speed and gear generally have incidence relation, gear be X shelves, speed in M0-N0km/s models
When enclosing interior, corresponding rated speed should be in the range of M1-N1RPM, if detecting current rotating speed beyond M1-N1RPM just
Often scope, then can determine that vehicle body status parameter values are in abnormality.Or, detect that current vehicle speed exceeds M0-N0KM/S
Normal range (NR), then can determine vehicle body status parameter values be in abnormality.
It is appreciated that such scheme one and scheme two provided judge vehicle body status parameter values whether in abnormality
Mode only as the present invention alternative embodiment, in actual applications, different judgement sides can be taken according to actual conditions
Formula.Alternatively, vehicle body shape can also be judged by the way that whether vehicle body status parameter values in detection Preset Time are in stable state
Whether state parameter value is in abnormality；For example, if detecting oil mass at short notice unstable state fluctuated occurs,
Then can determine that vehicle body status parameter values are in abnormality.
Alternatively, vehicle body state parameter can also be judged by the way that whether detector dial plate abnormal show value occurs
Whether value is in abnormality.For example, in the case where vehicle is not lighted a fire, instrument board but shows certain rotating speed or advanced in years
Speed etc., then can determine that vehicle body status parameter values are in abnormality.
Scheme three
This programme can collect vehicle body status parameter values sample of most of users during normal driving, the vehicle body
Status parameter values sample can include：The vehicle body state of normal vehicle body status parameter values sample namely positive sample and exception
Parameter value sample namely anti-sample, obtain according to the incidence relation between vehicle body status parameter values in above-mentioned positive sample and anti-sample
Characteristic vector, and positive sample and anti-sample are trained using features described above vector, trained by way of machine learning
Do well detection model, judges whether the vehicle body status parameter values in Vehicle Body Bus data are in using the state-detection model different
Normal state.Because the state-detection model can be obtained by a large amount of vehicle body status parameter values sample trainings collected, therefore, profit
Possess classification and the recognition capability of normal condition or abnormality with the state-detection model, therefore can improve what detection was attacked
Accuracy.
Specifically, whether the vehicle body status parameter values judged in the Vehicle Body Bus data are in the step of abnormality
Suddenly, can include：
Step S31, by the vehicle body status parameter values input state detection model；The state-detection model is according to receipts
Obtained by the vehicle body status parameter values sample of collection is trained；
If step S32, the output result of the state-detection model are abnormality, it is determined that the vehicle body state parameter
Value is in abnormality.
It is appreciated that the embodiment of the present invention is not any limitation as the concrete training method of the state-detection model.Example
Such as, the vehicle body status parameter values such as speed, rotating speed, gear, steering angle, water temperature, oil temperature in preset time period can be gathered to make
For vehicle body status parameter values sample, vehicle body status parameter values sample is normalized, the data after normalization are distinguished
Optimal models ginseng is obtained using BP (Error Back Propagation, error back propagation) scheduling algorithm training neutral net
Number, obtains state-detection model.
In a kind of alternative embodiment of the present invention, the state-detection model can be arranged in Cloud Server, described
The step of by the vehicle body status parameter values input state detection model, specifically can include：
The vehicle body status parameter values are uploaded to into the Cloud Server, vehicle body status parameter values input is described
State-detection model in Cloud Server carries out abnormal state detection.
In a particular application, it is possible to use car networking equipment gathers vehicle body status parameter values, and is uploaded to Cloud Server,
Cloud Server relies on big data to set up for detecting vehicle safety state using the vehicle body status parameter values of car networking equipment collection
State-detection model, the vehicle body status parameter values of the Real-time Collection in vehicle operation can be analyzed, once send out
Existing vehicle body status parameter values are in abnormality, you can send alarm, such that it is able to find that Vehicle Body Bus are under attack simultaneously in time
Take measures early to prevent the deep development attacked, reduce the loss of user.
Further, Cloud Server can be issued to the state-detection model in the car networking equipment of vehicle so that
It is local whether under attack i.e. using the state-detection model inspection Vehicle Body Bus data in vehicle.Car networking equipment may be used also
So that the vehicle body status parameter values and testing result of Real-time Collection are sent to Cloud Server, so that Cloud Server can be to described
State-detection model is continued to optimize.
In a particular application, because different user has different driving habits, the user for example having is accustomed in drive the cross
Suddenly accelerate in journey and anxious deceleration, so, using above-mentioned according to the vehicle body status parameter values sample gathered during normal vehicle operation
The state-detection model that this training is obtained is detected, it is possible to which detection obtains vehicle body status parameter values in abnormality, is
The state-detection model is enabled to meet the driving habit of different user, it is described in a kind of alternative embodiment of the present invention
Method can also comprise the steps：
Step S41, the driving behavior data for collecting user；
Step S42, the state-detection model is adjusted according to the driving behavior data of the user, to be accorded with
Share the state-detection model of family driving habit.
The embodiment of the present invention can be according to the driving behavior data of different user, the training sample to the state-detection model
Originally it is adjusted, to obtain meeting the personalized state-detection model of user's driving habit.For example, the height of rotating speed, it is anxious accelerate,
The anxious number of times for slowing down can reflect driving severity of user etc..The user more fierce for driving behavior, can be by slightly
The vehicle body such as larger speed, rotating speed status parameter values are examined as positive sample, the personalized state of the user for thus training
Surveying model can meet the driving habit of user, can identify the normal vehicle body state parameter for belonging to user's driving habit
Value, and identify the abnormal vehicle body status parameter values for belonging to Vehicle Body Bus attack.
In actual applications, those skilled in the art can flexibly choose as needed any one in above-mentioned three kinds of schemes
Plant or be combined.For example, for the judgement (such as scheme one and scheme two) of simple rule, can directly in car networking equipment
Judged, and for the complex rule (such as scheme three) for needing big data to analyze, vehicle body can be gathered by car networking equipment
Status parameter values are uploaded to Cloud Server and carry out learning training, then the state-detection model generated through learning training is issued to
Used in car networking equipment.
In actual applications, it is possible to occur causing the situation of vehicle abnormality due to vehicle faults itself, therefore, at this
In a kind of bright alternative embodiment, in the corresponding comentropy of the Vehicle Body Bus data presetting range, or the vehicle body are exceeded
When status parameter values are in abnormality, the warning information attacked can be sent；If however, in such cases by repairing
The physical detection means such as factory's detection determine that Vehicle Body Bus are not actually under attack, then illustrate that attack detecting result is wrong, car
Other failures are likely to occur, can now generate fault detection address.And can be by the Vehicle Body Bus data, vehicle body
Status parameter values and failure detection result are uploaded to Cloud Server and carry out big data analysis, further to optimize safety detection rule
Then and state-detection model, such that it is able to reduce the probability for attacking erroneous judgement, the accuracy of attack detecting is improved.
To sum up, the embodiment of the present invention is except judging Vehicle Body Bus by detecting the comentropy of Vehicle Body Bus data
It is no under attack, can also pass through whether the vehicle body status parameter values in detection Vehicle Body Bus data are sentenced in abnormality
Whether disconnected Vehicle Body Bus are under attack.For example, by whether judging single vehicle body status parameter values in abnormality, Ke Yi
The attack initial stage detects whether vehicle is under attack, to send warning information in time, the loss of user is reduced as early as possible.Or, lead to
Cross and the vehicle body status parameter values with incidence relation are detected, to judge whether Vehicle Body Bus are under attack, further carry
The accuracy of high attack detecting.Furthermore, can also whether under attack by state-detection model inspection Vehicle Body Bus, not only may be used
To improve the accuracy of detection, it is also possible that testing result meets the driving habit of different user.
With reference to Fig. 3, a kind of structured flowchart of vehicle attack detecting device according to an embodiment of the invention is shown, had
Body can be included such as lower module：
Data acquisition module 301, for gathering vehicle body bus data；
Comentropy determining module 302, for determining the corresponding comentropy of the Vehicle Body Bus data；
First attacks determining module 303, if exceeding presetting range for described information entropy, it is determined that the Vehicle Body Bus are received
To attack, warning information is sent.
In a kind of alternative embodiment of the present invention, described information entropy determining module 302 specifically can include：
Data volume acquisition submodule, for obtaining in preset time period vehicle body status parameter values in the Vehicle Body Bus data
Data volume and the Vehicle Body Bus data total amount of data；
Comentropy determination sub-module, for according to the data volume of the vehicle body status parameter values and the Vehicle Body Bus data
Total amount of data, determine the corresponding comentropy of the Vehicle Body Bus data.
In another kind of alternative embodiment of the present invention, described device can also include：
Abnormality judge module, for judging the Vehicle Body Bus data in vehicle body status parameter values whether in different
Normal state；
Second attacks determining module, if being in abnormality for the vehicle body status parameter values, it is determined that the vehicle body
Bus is under attack, sends warning information.
In another alternative embodiment of the present invention, the abnormality judge module specifically can include：
First judging submodule, for the vehicle body status parameter values to be compared with normal parameter values, if the car
Body status parameter values exceed predetermined threshold value with the difference of the normal parameter values, it is determined that the vehicle body status parameter values are in different
Normal state.
In another alternative embodiment of the present invention, the abnormality judge module specifically can include：
Second judging submodule, for judging it is corresponding whether the vehicle body status parameter values with incidence relation correspond with
Normal range (NR)；
Abnormal determination sub-module, if for having at least one parameter value not in the vehicle body status parameter values with incidence relation
Meet corresponding normal range (NR), it is determined that the vehicle body status parameter values are in abnormality.
In another alternative embodiment of the present invention, the abnormality judge module specifically can include：
Mode input submodule, for by the vehicle body status parameter values input state detection model；The state-detection
Model be according to collect vehicle body status parameter values sample be trained obtained by；
As a result output sub-module, if the output result for the state-detection model is abnormality, it is determined that described
Vehicle body status parameter values are in abnormality.
In another alternative embodiment of the present invention, described device can also include：
Behavior collection module, for collecting the driving behavior data of user；
Model adjusting module, for being adjusted to the state-detection model according to the driving behavior data of the user
It is whole, to obtain meeting the state-detection model of user's driving habit.
In another alternative embodiment of the present invention, the state-detection model is arranged in Cloud Server, the mould
Type input submodule, specifically can include：
Uploading unit, for the vehicle body status parameter values to be uploaded to into the Cloud Server, by the vehicle body state
The state-detection model that parameter value is input in the Cloud Server carries out abnormal state detection.
In another alternative embodiment of the present invention, the vehicle body status parameter values at least include following parameter：Speed,
Rotating speed, speed, gear, oil mass, water temperature advanced in years.
For device embodiment, due to itself and embodiment of the method basic simlarity, so description is fairly simple, it is related
Part is illustrated referring to the part of embodiment of the method.
Provided herein algorithm and display be not inherently related to any certain computer, virtual system or miscellaneous equipment.
Various general-purpose systems can also be used together based on teaching in this.As described above, construct required by this kind of system
Structure be obvious.Additionally, the present invention is also not for any certain programmed language.It is understood that, it is possible to use it is various
Programming language realizes the content of invention described herein, and the description done to language-specific above is to disclose this
Bright preferred forms.
In specification mentioned herein, a large amount of details are illustrated.It is to be appreciated, however, that the enforcement of the present invention
Example can be put into practice in the case of without these details.In some instances, known method, structure is not been shown in detail
And technology, so as not to obscure the understanding of this description.
Similarly, it will be appreciated that in order to simplify the disclosure and help understand one or more in each inventive aspect, exist
Above in the description of the exemplary embodiment of the present invention, each feature of the present invention is grouped together into single enforcement sometimes
In example, figure or descriptions thereof.However, the method for the disclosure should be construed to reflect following intention：I.e. required guarantor
The more features of feature that the application claims ratio of shield is expressly recited in each claim.More precisely, such as following
Claims reflect as, inventive aspect is all features less than single embodiment disclosed above.Therefore,
Thus the claims for following specific embodiment are expressly incorporated in the specific embodiment, wherein each claim itself
All as the separate embodiments of the present invention.
Those skilled in the art are appreciated that can be carried out adaptively to the module in the equipment in embodiment
Change and they are arranged in one or more equipment different from the embodiment.Can be the module or list in embodiment
Unit or component are combined into a module or unit or component, and can be divided in addition multiple submodule or subelement or
Sub-component.In addition at least some in such feature and/or process or unit is excluded each other, can adopt any
Combine to all features disclosed in this specification (including adjoint claim, summary and accompanying drawing) and so disclosed
Where all processes or unit of method or equipment are combined.Unless expressly stated otherwise, this specification is (including adjoint power
Profit is required, summary and accompanying drawing) disclosed in each feature can it is identical by offers, be equal to or the alternative features of similar purpose carry out generation
Replace.
Although additionally, it will be appreciated by those of skill in the art that some embodiments described herein include other embodiments
In included some features rather than further feature, but the combination of the feature of different embodiments means in of the invention
Within the scope of and form different embodiments.For example, in the following claims, embodiment required for protection appoint
One of meaning can in any combination mode using.
The present invention all parts embodiment can be realized with hardware, or with one or more processor operation
Software module realize, or with combinations thereof realization.It will be understood by those of skill in the art that can use in practice
Microprocessor or digital signal processor (DSP) are realizing vehicle attack detection method and device according to embodiments of the present invention
In some or all parts some or all functions.The present invention is also implemented as described herein for performing
Some or all equipment of method or program of device (for example, computer program and computer program).So
Realization the present invention program can store on a computer-readable medium, or can have one or more signal shape
Formula.Such signal can be downloaded from Internet platform and obtained, or be provided on carrier signal, or with any other shape
Formula is provided.
It should be noted that above-described embodiment the present invention will be described rather than limits the invention, and ability
Field technique personnel can design without departing from the scope of the appended claims alternative embodiment.In the claims,
Any reference symbol between bracket should not be configured to limitations on claims.Word " including " is not excluded the presence of not
Element listed in the claims or step.Word "a" or "an" before element does not exclude the presence of multiple such
Element.The present invention can come real by means of the hardware for including some different elements and by means of properly programmed computer
It is existing.If in the unit claim for listing equipment for drying, several in these devices can be by same hardware branch
To embody.The use of word first, second, and third does not indicate that any order.These words can be explained and be run after fame
Claim.
The invention discloses A1, a kind of vehicle attack detection method, including：
Collection vehicle body bus data；
Determine the corresponding comentropy of the Vehicle Body Bus data；
If described information entropy exceeds presetting range, it is determined that the Vehicle Body Bus are under attack, send warning information.
The step of A2, the method as described in A1, the determination Vehicle Body Bus data corresponding comentropy, including：
The data volume and the vehicle body for obtaining vehicle body status parameter values in the Vehicle Body Bus data in preset time period is total
The total amount of data of line number evidence；
According to the data volume and the total amount of data of the Vehicle Body Bus data of the vehicle body status parameter values, the car is determined
The corresponding comentropy of body bus data.
A3, the method as described in A1, methods described also includes：
Judge the vehicle body status parameter values in the Vehicle Body Bus data whether in abnormality；
If the vehicle body status parameter values are in abnormality, it is determined that the Vehicle Body Bus are under attack, send alarm
Information.
Whether A4, the method as described in A3, the vehicle body status parameter values judged in the Vehicle Body Bus data are in
The step of abnormality, including：
The vehicle body status parameter values are compared with normal parameter values, if the vehicle body status parameter values with it is described just
Often the difference of parameter value exceeds predetermined threshold value, it is determined that the vehicle body status parameter values are in abnormality.
Whether A5, the method as described in A3, the vehicle body status parameter values judged in the Vehicle Body Bus data are in
The step of abnormality, including：
Judge whether the vehicle body status parameter values with incidence relation correspond with corresponding normal range (NR)；
If having at least one parameter value not meet corresponding normal range (NR) in the vehicle body status parameter values with incidence relation,
Then determine that the vehicle body status parameter values are in abnormality.
Whether A6, the method as described in A3, the vehicle body status parameter values judged in the Vehicle Body Bus data are in
The step of abnormality, including：
By the vehicle body status parameter values input state detection model；The state-detection model is according to the vehicle body collected
Obtained by status parameter values sample is trained；
If the output result of the state-detection model is abnormality, it is determined that the vehicle body status parameter values are in different
Normal state.
A7, the method as described in A6, methods described also includes：
Collect the driving behavior data of user；
The state-detection model is adjusted according to the driving behavior data of the user, is driven with obtaining meeting user
Sail the state-detection model of custom.
A8, the method as described in A6, the state-detection model is arranged in Cloud Server, described by the vehicle body state
The step of parameter value input state detection model, including：
The vehicle body status parameter values are uploaded to into the Cloud Server, vehicle body status parameter values input is described
State-detection model in Cloud Server carries out abnormal state detection.
A9, the method as described in A2 to A8, the vehicle body status parameter values at least include following parameter：Speed, rotating speed, step
Speed, gear, oil mass, water temperature.
The invention discloses B10, a kind of vehicle attack detecting device, including：
Data acquisition module, for gathering vehicle body bus data；
Comentropy determining module, for determining the corresponding comentropy of the Vehicle Body Bus data；
First attacks determining module, if exceeding presetting range for described information entropy, it is determined that the Vehicle Body Bus are subject to
Attack, send warning information.
B11, the device as described in B10, described information entropy determining module, including：
Data volume acquisition submodule, for obtaining in preset time period vehicle body status parameter values in the Vehicle Body Bus data
Data volume and the Vehicle Body Bus data total amount of data；
Comentropy determination sub-module, for according to the data volume of the vehicle body status parameter values and the Vehicle Body Bus data
Total amount of data, determine the corresponding comentropy of the Vehicle Body Bus data.
B12, the device as described in B10, described device also includes：
Abnormality judge module, for judging the Vehicle Body Bus data in vehicle body status parameter values whether in different
Normal state；
Second attacks determining module, if being in abnormality for the vehicle body status parameter values, it is determined that the vehicle body
Bus is under attack, sends warning information.
B13, the device as described in B12, the abnormality judge module, including：
First judging submodule, for the vehicle body status parameter values to be compared with normal parameter values, if the car
Body status parameter values exceed predetermined threshold value with the difference of the normal parameter values, it is determined that the vehicle body status parameter values are in different
Normal state.
B14, the device as described in B12, the abnormality judge module, including：
Second judging submodule, for judging it is corresponding whether the vehicle body status parameter values with incidence relation correspond with
Normal range (NR)；
Abnormal determination sub-module, if for having at least one parameter value not in the vehicle body status parameter values with incidence relation
Meet corresponding normal range (NR), it is determined that the vehicle body status parameter values are in abnormality.
B15, the device as described in B12, the abnormality judge module, including：
Mode input submodule, for by the vehicle body status parameter values input state detection model；The state-detection
Model be according to collect vehicle body status parameter values sample be trained obtained by；
As a result output sub-module, if the output result for the state-detection model is abnormality, it is determined that described
Vehicle body status parameter values are in abnormality.
B16, the device as described in B15, described device also includes：
Behavior collection module, for collecting the driving behavior data of user；
Model adjusting module, for being adjusted to the state-detection model according to the driving behavior data of the user
It is whole, to obtain meeting the state-detection model of user's driving habit.
B17, the device as described in B15, the state-detection model is arranged in Cloud Server, the mode input submodule
Block, including：
Uploading unit, for the vehicle body status parameter values to be uploaded to into the Cloud Server, by the vehicle body state
The state-detection model that parameter value is input in the Cloud Server carries out abnormal state detection.
B18, the device as described in B11 to B17, the vehicle body status parameter values at least include following parameter：Speed, turn
Speed, speed, gear, oil mass, water temperature advanced in years.
Claims (10)
1. a kind of vehicle attack detection method, it is characterised in that methods described includes：
Collection vehicle body bus data；
Determine the corresponding comentropy of the Vehicle Body Bus data；
If described information entropy exceeds presetting range, it is determined that the Vehicle Body Bus are under attack, send warning information.
2. the method for claim 1, it is characterised in that the corresponding comentropy of the determination Vehicle Body Bus data
Step, including：
Obtain the data volume and the Vehicle Body Bus number of vehicle body status parameter values in the Vehicle Body Bus data in preset time period
According to total amount of data；
According to the data volume and the total amount of data of the Vehicle Body Bus data of the vehicle body status parameter values, determine that the vehicle body is total
Line number is according to corresponding comentropy.
3. the method for claim 1, it is characterised in that methods described also includes：
Judge the vehicle body status parameter values in the Vehicle Body Bus data whether in abnormality；
If the vehicle body status parameter values are in abnormality, it is determined that the Vehicle Body Bus are under attack, send warning information.
4. method as claimed in claim 3, it is characterised in that the vehicle body state ginseng in the judgement Vehicle Body Bus data
The step of whether numerical value is in abnormality, including：
The vehicle body status parameter values are compared with normal parameter values, if the vehicle body status parameter values and the normal ginseng
The difference of numerical value exceeds predetermined threshold value, it is determined that the vehicle body status parameter values are in abnormality.
5. method as claimed in claim 3, it is characterised in that the vehicle body state ginseng in the judgement Vehicle Body Bus data
The step of whether numerical value is in abnormality, including：
Judge whether the vehicle body status parameter values with incidence relation correspond with corresponding normal range (NR)；
If having at least one parameter value not meet corresponding normal range (NR) in the vehicle body status parameter values with incidence relation, really
The fixed vehicle body status parameter values are in abnormality.
6. method as claimed in claim 3, it is characterised in that the vehicle body state ginseng in the judgement Vehicle Body Bus data
The step of whether numerical value is in abnormality, including：
By the vehicle body status parameter values input state detection model；The state-detection model is according to the vehicle body state collected
Obtained by parameter value sample is trained；
If the output result of the state-detection model is abnormality, it is determined that the vehicle body status parameter values are in abnormal shape
State.
7. method as claimed in claim 6, it is characterised in that methods described also includes：
Collect the driving behavior data of user；
The state-detection model is adjusted according to the driving behavior data of the user, to obtain meeting user's driving habit
Used state-detection model.
8. method as claimed in claim 6, it is characterised in that the state-detection model is arranged in Cloud Server, described
The step of by the vehicle body status parameter values input state detection model, including：
The vehicle body status parameter values are uploaded to into the Cloud Server, the vehicle body status parameter values are input into into the cloud clothes
State-detection model in business device carries out abnormal state detection.
9. the method as described in claim 2 to 8, it is characterised in that the vehicle body status parameter values at least include following parameter：
Speed, rotating speed, speed, gear, oil mass, water temperature advanced in years.
10. a kind of vehicle attack detecting device, it is characterised in that described device includes：
Data acquisition module, for gathering vehicle body bus data；
Comentropy determining module, for determining the corresponding comentropy of the Vehicle Body Bus data；
First attacks determining module, if exceeding presetting range for described information entropy, it is determined that the Vehicle Body Bus are under attack,
Send warning information.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611239362.1A CN106650505A (en) | 2016-12-28 | 2016-12-28 | Vehicle attack detection method and device |
| PCT/CN2017/119413 WO2018121675A1 (en) | 2016-12-28 | 2017-12-28 | Vehicle attack detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611239362.1A CN106650505A (en) | 2016-12-28 | 2016-12-28 | Vehicle attack detection method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106650505A true CN106650505A (en) | 2017-05-10 |
Family
ID=58835323
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201611239362.1A Pending CN106650505A (en) | 2016-12-28 | 2016-12-28 | Vehicle attack detection method and device |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN106650505A (en) |
| WO (1) | WO2018121675A1 (en) |
Cited By (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107356821A (en) * | 2017-06-07 | 2017-11-17 | 中国科学院信息工程研究所 | A kind of device and vehicle checking method of information of vehicles safety detection |
| CN107566402A (en) * | 2017-10-13 | 2018-01-09 | 成都信息工程大学 | Vehicle electronics information system intrusion detection method based on SOEKS is with realizing |
| CN107566347A (en) * | 2017-08-10 | 2018-01-09 | 北京洋浦伟业科技发展有限公司 | Rolling code learning detection method and device, equipment and computer-readable recording medium |
| CN108173856A (en) * | 2017-12-28 | 2018-06-15 | 北京奇虎科技有限公司 | Vehicle communication data safety detection method, device and car-mounted terminal |
| CN108183954A (en) * | 2017-12-28 | 2018-06-19 | 北京奇虎科技有限公司 | A kind of detection method and device of vehicle safety |
| CN108200042A (en) * | 2017-12-28 | 2018-06-22 | 北京奇虎科技有限公司 | A kind of detection method of vehicle safety and vehicle safety management platform |
| WO2018121675A1 (en) * | 2016-12-28 | 2018-07-05 | 北京奇虎科技有限公司 | Vehicle attack detection method and device |
| CN108923904A (en) * | 2018-06-29 | 2018-11-30 | 百度在线网络技术（北京）有限公司 | Automobile command processing method, device, equipment, cloud platform and storage medium |
| CN109117632A (en) * | 2018-07-27 | 2019-01-01 | 北京梆梆安全科技有限公司 | A kind of method and apparatus for the risk that determining vehicle is invaded |
| CN109117639A (en) * | 2018-07-27 | 2019-01-01 | 北京梆梆安全科技有限公司 | A kind of detection method and device of intrusion risk |
| CN109286614A (en) * | 2018-01-05 | 2019-01-29 | 南京知行新能源汽车技术开发有限公司 | For reinforcing the method, equipment and storage medium of the network security in motor vehicles |
| CN109347823A (en) * | 2018-10-17 | 2019-02-15 | 湖南汽车工程职业学院 | A kind of CAN bus method for detecting abnormality based on comentropy |
| CN109375609A (en) * | 2018-10-18 | 2019-02-22 | 北京鼎力信安技术有限公司 | The detection method and device of abnormal aggression |
| CN109878341A (en) * | 2019-03-07 | 2019-06-14 | 广东轻工职业技术学院 | New energy vehicle intelligent network control method and its system |
| CN110275508A (en) * | 2019-05-08 | 2019-09-24 | 西安电子科技大学 | Vehicle-mounted CAN bus network method for detecting abnormality and system |
| CN110389572A (en) * | 2018-04-23 | 2019-10-29 | 上海博泰悦臻电子设备制造有限公司 | Vehicle part failure gives warning in advance method, system and server |
| CN111447166A (en) * | 2018-12-29 | 2020-07-24 | 北京奇虎科技有限公司 | Vehicle attack detection method and device |
| CN112204926A (en) * | 2018-06-01 | 2021-01-08 | 三菱电机株式会社 | Data communication control device, data communication control program, and vehicle control system |
| US11036561B2 (en) * | 2018-07-24 | 2021-06-15 | Oracle International Corporation | Detecting device utilization imbalances |
| CN114978579A (en) * | 2022-04-08 | 2022-08-30 | 联合汽车电子有限公司 | Information processing method, abnormality detection device, medium, and vehicle-mounted controller |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112653654A (en) * | 2019-10-12 | 2021-04-13 | 深圳市奇虎智能科技有限公司 | Security monitoring method and device, computer equipment and storage medium |
| CN113163369A (en) * | 2020-01-20 | 2021-07-23 | 北京新能源汽车股份有限公司 | Vehicle intrusion prevention processing method and device and automobile |
| CN113347134B (en) * | 2020-02-18 | 2022-07-19 | 国家计算机网络与信息安全管理中心浙江分中心 | Attack detection method and system for internet of vehicles TSP platform |
| CN111726774B (en) | 2020-06-28 | 2023-09-05 | 阿波罗智联(北京)科技有限公司 | Method, device, equipment and storage medium for defending attack |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014061021A1 (en) * | 2012-10-17 | 2014-04-24 | Tower-Sec Ltd. | A device for detection and prevention of an attack on a vehicle |
| CN103873319A (en) * | 2012-12-12 | 2014-06-18 | 现代自动车株式会社 | Apparatus and method for detecting in-vehicle network attack |
| CN105828333A (en) * | 2016-05-11 | 2016-08-03 | 北京航空航天大学 | Hacker vehicle detection method based on traffic abnormality of vehicular ad-hoc network |
| CN106184068A (en) * | 2016-06-30 | 2016-12-07 | 北京奇虎科技有限公司 | Automotive interior network security detection method and device, automobile |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106650505A (en) * | 2016-12-28 | 2017-05-10 | 北京奇虎科技有限公司 | Vehicle attack detection method and device |
-
2016
- 2016-12-28 CN CN201611239362.1A patent/CN106650505A/en active Pending
-
2017
- 2017-12-28 WO PCT/CN2017/119413 patent/WO2018121675A1/en active Application Filing
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014061021A1 (en) * | 2012-10-17 | 2014-04-24 | Tower-Sec Ltd. | A device for detection and prevention of an attack on a vehicle |
| CN103873319A (en) * | 2012-12-12 | 2014-06-18 | 现代自动车株式会社 | Apparatus and method for detecting in-vehicle network attack |
| CN105828333A (en) * | 2016-05-11 | 2016-08-03 | 北京航空航天大学 | Hacker vehicle detection method based on traffic abnormality of vehicular ad-hoc network |
| CN106184068A (en) * | 2016-06-30 | 2016-12-07 | 北京奇虎科技有限公司 | Automotive interior network security detection method and device, automobile |
Cited By (29)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2018121675A1 (en) * | 2016-12-28 | 2018-07-05 | 北京奇虎科技有限公司 | Vehicle attack detection method and device |
| CN107356821B (en) * | 2017-06-07 | 2019-08-16 | 中国科学院信息工程研究所 | A kind of device and vehicle checking method of information of vehicles safety detection |
| CN107356821A (en) * | 2017-06-07 | 2017-11-17 | 中国科学院信息工程研究所 | A kind of device and vehicle checking method of information of vehicles safety detection |
| CN107566347A (en) * | 2017-08-10 | 2018-01-09 | 北京洋浦伟业科技发展有限公司 | Rolling code learning detection method and device, equipment and computer-readable recording medium |
| CN107566402A (en) * | 2017-10-13 | 2018-01-09 | 成都信息工程大学 | Vehicle electronics information system intrusion detection method based on SOEKS is with realizing |
| CN107566402B (en) * | 2017-10-13 | 2020-08-04 | 成都信息工程大学 | SOEKS-based intrusion detection method and implementation of vehicle-mounted electronic information system |
| CN108173856A (en) * | 2017-12-28 | 2018-06-15 | 北京奇虎科技有限公司 | Vehicle communication data safety detection method, device and car-mounted terminal |
| CN108200042A (en) * | 2017-12-28 | 2018-06-22 | 北京奇虎科技有限公司 | A kind of detection method of vehicle safety and vehicle safety management platform |
| CN108183954A (en) * | 2017-12-28 | 2018-06-19 | 北京奇虎科技有限公司 | A kind of detection method and device of vehicle safety |
| CN109286614A (en) * | 2018-01-05 | 2019-01-29 | 南京知行新能源汽车技术开发有限公司 | For reinforcing the method, equipment and storage medium of the network security in motor vehicles |
| US10887349B2 (en) | 2018-01-05 | 2021-01-05 | Byton Limited | System and method for enforcing security with a vehicle gateway |
| CN110389572A (en) * | 2018-04-23 | 2019-10-29 | 上海博泰悦臻电子设备制造有限公司 | Vehicle part failure gives warning in advance method, system and server |
| CN112204926B (en) * | 2018-06-01 | 2022-03-04 | 三菱电机株式会社 | Data communication control device, nonvolatile memory, and vehicle control system |
| CN112204926A (en) * | 2018-06-01 | 2021-01-08 | 三菱电机株式会社 | Data communication control device, data communication control program, and vehicle control system |
| CN108923904A (en) * | 2018-06-29 | 2018-11-30 | 百度在线网络技术（北京）有限公司 | Automobile command processing method, device, equipment, cloud platform and storage medium |
| US11036561B2 (en) * | 2018-07-24 | 2021-06-15 | Oracle International Corporation | Detecting device utilization imbalances |
| CN109117639B (en) * | 2018-07-27 | 2021-03-16 | 北京梆梆安全科技有限公司 | Intrusion risk detection method and device |
| CN109117632A (en) * | 2018-07-27 | 2019-01-01 | 北京梆梆安全科技有限公司 | A kind of method and apparatus for the risk that determining vehicle is invaded |
| CN109117632B (en) * | 2018-07-27 | 2021-05-07 | 北京梆梆安全科技有限公司 | Method and device for determining risk of vehicle intrusion |
| CN109117639A (en) * | 2018-07-27 | 2019-01-01 | 北京梆梆安全科技有限公司 | A kind of detection method and device of intrusion risk |
| CN109347823A (en) * | 2018-10-17 | 2019-02-15 | 湖南汽车工程职业学院 | A kind of CAN bus method for detecting abnormality based on comentropy |
| CN109375609A (en) * | 2018-10-18 | 2019-02-22 | 北京鼎力信安技术有限公司 | The detection method and device of abnormal aggression |
| CN109375609B (en) * | 2018-10-18 | 2021-02-02 | 北京鼎力信安技术有限公司 | Abnormal attack detection method and device |
| CN111447166A (en) * | 2018-12-29 | 2020-07-24 | 北京奇虎科技有限公司 | Vehicle attack detection method and device |
| CN111447166B (en) * | 2018-12-29 | 2022-11-04 | 北京奇虎科技有限公司 | Vehicle attack detection method and device |
| CN109878341A (en) * | 2019-03-07 | 2019-06-14 | 广东轻工职业技术学院 | New energy vehicle intelligent network control method and its system |
| CN110275508A (en) * | 2019-05-08 | 2019-09-24 | 西安电子科技大学 | Vehicle-mounted CAN bus network method for detecting abnormality and system |
| CN110275508B (en) * | 2019-05-08 | 2021-09-28 | 西安电子科技大学 | Vehicle-mounted CAN bus network anomaly detection method and system |
| CN114978579A (en) * | 2022-04-08 | 2022-08-30 | 联合汽车电子有限公司 | Information processing method, abnormality detection device, medium, and vehicle-mounted controller |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2018121675A1 (en) | 2018-07-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106650505A (en) | Vehicle attack detection method and device | |
| US10382466B2 (en) | Cooperative cloud-edge vehicle anomaly detection | |
| US20200186560A1 (en) | System and method for time based anomaly detection in an in-vehicle communication network | |
| CN106843190B (en) | Distributed vehicle health management system | |
| CN109163913A (en) | A kind of Diagnosis method of automobile faults and relevant device | |
| WO2019133316A1 (en) | Reconstruction-based anomaly detection | |
| KR20180105850A (en) | Fault diagnosis system for vehicle and data security method thereof | |
| CN114374565A (en) | Intrusion detection method and device for vehicle CAN network, electronic equipment and medium | |
| CN113660137B (en) | Vehicle-mounted network fault detection method and device, readable storage medium and electronic equipment | |
| CN106559431A (en) | A kind of visual analysis method and device for automotive safety detection | |
| US11313894B2 (en) | Automobile battery failure prediction method and system | |
| Ryan et al. | Semiautonomous vehicle risk analysis: A telematics‐based anomaly detection approach | |
| CN108919776A (en) | A kind of assessment of failure method and terminal | |
| CN109101010A (en) | A kind of Diagnosis method of automobile faults and relevant device | |
| CN108081916A (en) | The startup method and device of vehicular air purifier | |
| CN113163369A (en) | Vehicle intrusion prevention processing method and device and automobile | |
| DE102017214661A1 (en) | Method for detecting a manipulation of at least one control device of a motor vehicle and processor device for a motor vehicle and motor vehicle | |
| JP2017091234A (en) | Vehicle control device | |
| CN112606779B (en) | Automobile fault early warning method and electronic equipment | |
| CN109150846B (en) | Vehicle intrusion detection method and vehicle intrusion detection device | |
| KR20160062259A (en) | Method, system and computer readable medium for managing abnormal state of vehicle | |
| CN109263650A (en) | Identify the method, apparatus and the vehicles of manpower intervention | |
| US20230283617A1 (en) | Attack analysis device, attack analysis method, and non-transitory computer-readable recording medium | |
| CN113554330A (en) | Training method and application method of security situation perception model of hydrological information platform | |
| CN112019512A (en) | Automobile network safety test system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170510 |