CN109150846B - Vehicle intrusion detection method and vehicle intrusion detection device - Google Patents
Vehicle intrusion detection method and vehicle intrusion detection device Download PDFInfo
- Publication number
- CN109150846B CN109150846B CN201810838180.9A CN201810838180A CN109150846B CN 109150846 B CN109150846 B CN 109150846B CN 201810838180 A CN201810838180 A CN 201810838180A CN 109150846 B CN109150846 B CN 109150846B
- Authority
- CN
- China
- Prior art keywords
- time period
- parameter
- preset time
- current
- vehicle
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
- H04L12/40052—High-speed IEEE 1394 serial bus
- H04L12/40104—Security; Encryption; Content protection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
- H04L2012/40208—Bus networks characterized by the use of a particular bus standard
- H04L2012/40215—Controller Area Network CAN
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
- H04L2012/40267—Bus for use in transportation systems
- H04L2012/40273—Bus for use in transportation systems the transportation system being a vehicle
Abstract
The application discloses a vehicle intrusion detection method and a vehicle intrusion detection device. The method comprises the following steps: acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period; and determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the constraint condition corresponding to the at least one parameter in the current first preset time period. According to the method and the device provided by the embodiment of the application, the occurrence of the vehicle intrusion event CAN be detected in the early stage of intrusion by detecting the abnormal CAN data frame containing unreasonable state parameters.
Description
Technical Field
The application belongs to the technical field of automobile safety, and particularly relates to a vehicle intrusion detection method and a vehicle intrusion detection device.
Background
With the development of vehicle intelligence, the programming and remote control of vehicle-mounted components become new trends, and more appear on the market. This intelligent trend brings convenience to users and also brings new intrusion opportunities to hackers. And because of the value and maneuverability of the vehicle itself, the intrusion will incur greater losses and risks than a personal computer.
CAN is a short name for Controller Area Network (CAN), is a serial communication protocol of ISO international standardization, developed by BOSCH company of germany, which is known to research and produce automotive electronics, and finally becomes international standard (ISO 11898), and CAN is one of the most widely used field buses internationally. In north america and western europe, the CAN bus protocol has become the standard bus for automotive computer control systems and embedded industrial control area networks, and has the J1939 protocol designed for large trucks and heavy work machinery vehicles with CAN as the underlying protocol.
Illegal intruders often detect the characteristics of the CAN data packets of an intruded vehicle by heuristically sending a series of CAN data packets, and then attack by simulating these normal CAN data packets.
Disclosure of Invention
The embodiment of the application provides a vehicle intrusion detection method and a vehicle intrusion detection device.
In one possible embodiment, there is provided a vehicle intrusion detection method, the method comprising:
acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period;
and determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the constraint condition corresponding to the at least one parameter in the current first preset time period.
In another possible embodiment, there is provided a vehicle intrusion detection apparatus, the apparatus including:
the system comprises a first acquisition module, a second acquisition module and a control module, wherein the first acquisition module is used for acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period;
and the intrusion detection module is used for determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the constraint condition corresponding to the at least one parameter in the current first preset time period.
In another possible implementation, a computer-readable medium is provided having stored therein a plurality of instructions adapted to be loaded and executed by a processor to:
acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period;
and determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the constraint condition corresponding to the at least one parameter in the current first preset time period.
In another possible embodiment, there is provided a vehicle intrusion detection apparatus, the server including:
a memory for storing instructions;
a processor for executing the memory-stored instructions, the instructions causing the processor to perform the steps of:
acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period;
and determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the constraint condition corresponding to the at least one parameter in the current first preset time period.
According to the method and the device provided by the embodiment of the application, the occurrence of the vehicle intrusion event CAN be detected in the early stage of intrusion by detecting the abnormal CAN data frame containing unreasonable state parameters.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application.
FIG. 1 is a schematic flow diagram of an example of a vehicle intrusion detection method according to one embodiment of the present application;
fig. 2(a) -2 (g) are block diagrams of various examples of a vehicle intrusion detection apparatus according to an embodiment of the present application;
fig. 3 is a block diagram illustrating a structure of still another example of a vehicle intrusion detection apparatus according to an embodiment of the present application.
Detailed Description
In order to make the objects, features and advantages of the present invention more apparent and understandable, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application, and it is apparent that the described embodiments are only a part of the embodiments of the present application, and not all the embodiments of the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
It will be understood by those within the art that the terms "first", "second", etc. in this application are used only to distinguish one device, module, parameter, etc., from another, and do not denote any particular technical meaning or necessary order therebetween.
SAE J1939 describes a network application of the CAN bus, which is the recommended standard of the american Society of Automotive Engineering (SAE), for providing a standardized architecture for communication between electronic components on medium and heavy road vehicles, including CAN network physical layer definition, data link layer definition, application layer definition, network layer definition, fault diagnosis, and network management. In the SAE J1939 protocol, not only the transmission type, the message structure and its segments, etc. are specified, but also the message content itself is precisely defined. The J1939 application layer (based on J1939-71) among others describes the actual data (parameters or network variables with value ranges, resolution, physical units and transmission types). Each message unambiguously corresponds to a number (SPN). Terms that may appear in various embodiments of the present application may be defined with reference to SAE J1939. The CAN data frame refers to a sequential bit field which is necessary for forming a CAN protocol frame, and starts with a start of frame (SOF) and ends with an end of frame (EOF); CAN data packet: a single CAN data frame is a packet, but a message contains a parameter group with a data length less than or equal to 8 bytes, and the message is also called a packet; message (Message): refers to one or more (PGN) data frames having the same reference group number.
Under different situations (contexts), states of a vehicle including the speed, the rotating speed, the temperature and the like often have a reasonable restricted range, the technical scheme of the application detects intrusion by detecting the rationality described about a single state of the vehicle in the CAN data packet load and/or the rationality after mutually referring a plurality of related states, and detects the occurrence of an intrusion event in the early stage of an attack.
Fig. 1 is a schematic flow chart of a vehicle intrusion detection method according to an embodiment of the present application. The method may be implemented by the Vehicle itself, for example, by an Electronic Control Unit (ECU) of the Vehicle, an In-Vehicle Infotainment (IVI) system, or by other devices independent of the Vehicle, or by remotely deployed devices. As shown in fig. 1, the method of the present embodiment includes:
s120, acquiring at least one parameter which is transmitted on the CAN bus and is associated with the state of the vehicle in the current first preset time period.
In the method of this embodiment, to avoid the vehicle from being intruded, the CAN data frames transmitted on the CAN bus are continuously detected, and the detected data frames in each preset time period (hereinafter referred to as a first preset time period, which may be arbitrarily set, for example, set to 0.5 second, 2 seconds, etc., according to the need of intrusion detection) are analyzed to detect abnormal state parameters. The payload portion of the CAN data frame will typically carry parameters describing the state of some aspect of the vehicle, such parameters including, but not limited to: vehicle speed, engine speed, accelerator pedal position, window status, etc.
In one possible implementation, the CAN data frames transmitted on the CAN bus may be acquired by one or more probes disposed on the CAN bus of the vehicle. Specifically, step S120 may further include:
s122, reading at least one data frame transmitted on the CAN bus through at least one detector arranged on the CAN bus of the vehicle.
And S124, analyzing the at least one data frame to obtain the at least one parameter.
For example, the parameters, the data types of the parameters, and the values of the parameters contained in the payload of the CAN data frame may be extracted and parsed according to the SAE J1939 protocol in a format specified by the protocol.
S140, determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the constraint condition corresponding to the at least one parameter in the current first preset time period.
In the method of this embodiment, reasonable constraint conditions CAN be set for parameters related to vehicle states in different situations, and according to the parameters detected in the first preset time period and the constraint conditions corresponding thereto, it CAN be determined whether there is an abnormal CAN data frame containing unreasonable parameters (the parameters do not meet the corresponding constraint conditions) sent by an intruder.
In the method of this embodiment, a detection threshold is further preset, and whether an intrusion event occurs is determined according to whether the number of the abnormal CAN data frames detected in each first preset time period exceeds the preset detection threshold.
Specifically, step S140 may further include
And S142, comparing the at least one parameter with a constraint condition corresponding to the at least one parameter in the current first preset time period.
And S144, responding to the condition that the number of the parameters which do not meet the corresponding constraint conditions exceeds a preset detection threshold value, and determining that the intrusion event occurs in the current first preset time period.
For example, if the acquired at least one parameter includes a plurality of vehicle speed values, and a part of the vehicle speed values is 100km/h, the constraint condition of the vehicle speed in the current first preset time period is as follows: the reasonable vehicle speed is within the range of 0-40 km, and if the vehicle speed value which does not fall within the reasonable vehicle speed range is determined to exceed 60%, the intrusion event can be determined to occur.
In the method of this embodiment, the constraint condition may be at least one reasonable value range of the parameter, may be a set of reasonable values, and may also be a set that includes at least one reasonable value range and also includes reasonable values. The constraints may be stored in any form in the device implementing the method of the present embodiment, for example, a mapping table of parameters and constraints.
In summary, the method of the present embodiment CAN detect the occurrence of the intrusion event in the early stage of the intrusion by detecting the abnormal CAN data frame containing the unreasonable state parameters.
In one possible implementation, different weights may also be set for different status parameters, for example, higher weights may be given to vehicle dynamics related parameters and lower weights may be given to entertainment and comfort related parameters. Under the condition of having the weight, the sum of products of all the parameters which do not meet the constraint condition and the weight thereof can be calculated, the sum of products of all the parameters acquired in the current first preset time period and the weight thereof can be compared with a preset detection threshold value, and then whether the intrusion event occurs in the current first preset time period or not can be judged.
In addition, the state parameters of the vehicle under different scenes should be subject to different constraints. Specifically, the method of this embodiment further includes:
and S160, determining a corresponding constraint condition of the at least one parameter in the current first preset time period.
In one possible implementation, "determining" may refer to acquiring, directly from the device itself implementing the method of the present embodiment, the stored constraints, or receiving the constraints from outside the device.
The constraints may be determined according to different scenarios. In one possible implementation, the constraint may comprise a first constraint relating to the driving state of the vehicle itself. For example, if the vehicle is in the initial starting state in the previous one or more first preset time periods, the first constraint condition that the vehicle speed is in the current first preset time period needs to be referred to this driving scenario, and considering that the vehicle speed is not too fast in the initial starting state, even if the vehicle speed value obtained in step S120 does not exceed the maximum possible vehicle speed of the vehicle, such vehicle speed value may still be abnormal. Specifically, step S160 may further include:
s161, determining a first constraint condition corresponding to at least one parameter in the current first preset time period according to at least one parameter associated with the state of the vehicle in at least one previous first preset time period and at least one rated performance parameter of the vehicle.
At least one nominal performance parameter refers to an inherent performance parameter of a vehicle component, including but not limited to: power performance parameters such as output power, torque and the like of the engine under different speeds within 100 kilometer of acceleration time; comfort equipment performance parameters such as time spent for a window from a closed state to a fully opened state, time required for complete opening of an electric tailgate, an air conditioner fan speed level list and the like; and the weight of the similar vehicle, how many windows and doors are, etc. The constraints of the vehicle state parameters are set with reference to at least one nominal performance parameter. For example, the vehicle speed constraint may not exceed the maximum vehicle speed that the vehicle can reach, and so on.
For example, if the vehicle speed is 5km/h, the maximum power of the engine of the vehicle is 100KW, and the vehicle body weight is 1.5 tons in the previous first preset period, the first constraint condition of the vehicle speed in the current first preset period may be determined according to the acceleration of the power and the mass or the acceleration of the speed and the time, that is, the reasonable vehicle speed range is (0, 26.67 km/h). Similarly, the first constraint condition of the window state in the current first preset time period can be calculated according to the closing speed of the window in the previous first preset time period, the time of issuing the closing instruction and the original closing state.
In order to improve the detection accuracy and prevent false detection and/or false detection as much as possible, in the method of the embodiment, different detection periods (i.e., first preset periods) may correspond to different constraints (i.e., first constraints) to match different scenarios. Specifically, in a possible implementation manner, each parameter and the corresponding first constraint condition need to be updated periodically, that is, step S160 is implemented once every at least one second preset time period. And in such an implementation, the method of the present embodiment further includes:
s180, recording the determined first constraint condition, a corresponding first preset time period and at least one parameter.
Specifically, in a possible implementation manner, a mapping table of vehicle state parameters and a first preset time period and a first constraint condition may be stored, and a sliding update window may be set for updating the mapping table: and at every second preset time interval, the sliding updating window slides forwards for a first preset time interval, a first constraint condition of the current first preset time interval is determined according to at least one state parameter in the first preset time interval included in the current sliding updating window, and the mapping table is updated. Preferably, the first preset time period is the same as the second preset time period. Taking the first preset time interval and the second preset time interval both being 2 seconds and the sliding updating window being 10 seconds as an example, the first constraint condition corresponding to the state parameter within 10-12 seconds of the vehicle starting can be determined according to the state parameter within 0-10 seconds of the vehicle starting, and recorded. And the constraint conditions corresponding to the state parameters within 12-14 seconds of vehicle starting can be determined according to the state parameters within 2-12 seconds of vehicle starting and recorded.
In an implementation manner in which the constraint condition includes a first constraint condition, in step S140, whether an intrusion event occurs within the current first preset time period may be determined according to the at least one parameter, the first constraint condition, and a preset detection threshold.
In another possible implementation, the constraint may include a second constraint related to an environment of the vehicle. The environment of the vehicle includes, but is not limited to: weather, road conditions, driving conditions of other vehicles at all sides, front, rear, left and right, and the like. In such an implementation, the method of this embodiment further includes:
s130, obtaining the environmental information of the vehicle in the current first preset time period.
The environmental information includes, but is not limited to, relevant parameter values of the front, rear, left and right vehicles of the current vehicle, the states of brake tail lamps of the front vehicle, the distance from the front and rear vehicles, the distance from the next red light, speed limit information of the road, and the like. The environmental information may be obtained from at least one sensor provided on the vehicle (e.g., an onboard camera), may be obtained from outside the vehicle (e.g., a central server) over a network, and/or may be obtained from a direct communication network established between vehicles. Specifically, step S160 may further include:
s162, according to the environment information and at least one rated performance parameter of the vehicle, determining a second constraint condition corresponding to the at least one parameter in the current first preset time period.
For example, if the distance from the vehicle to the current red light is less than 20m, the second constraint condition for the vehicle speed may be set to (0, 5 km/h).
For another example, if the acquired speed of the preceding vehicle in the previous first preset time period is 5km/h, the mass of the preceding vehicle is 1.5 tons, the maximum power of the engine of the preceding vehicle is 50kw, and the distance from the preceding vehicle is 5m, the first constraint condition of the speed of the preceding vehicle may be determined to be (0, 13.33km/h) according to the method of the embodiment, and then the first constraint condition may be directly used as the second constraint condition of the own vehicle.
In such an implementation, in step S140, whether an intrusion event occurs within the current first preset time period may be determined according to the at least one parameter, the second constraint condition, and a preset detection threshold.
In a further possible implementation, the constraint condition may relate both to the vehicle's own driving state and to the vehicle's environment. In such an implementation, in step S140, a constraint condition corresponding to at least one parameter associated with the state of the vehicle during at least one previous first preset time period, the environmental information, and at least one rated performance parameter of the vehicle may be determined according to the at least one parameter during the current first preset time period.
For example, if the vehicle speed is zero in the previous first preset time period and the distance from the vehicle to the current red light is less than 20m, the constraint condition of the vehicle speed in the current first preset time period is (0, 0).
In another possible implementation manner, the constraint condition may include both a first constraint condition and a second constraint condition, and in such an implementation manner, whether an intrusion event occurs may be determined according to the first constraint condition and the second constraint condition, and weights of results of the two manners are given, and whether an intrusion event occurs is finally determined by referring to the weights of the two manners. In such an implementation, in step S140, whether an intrusion event occurs within the current first preset time period may be determined according to the at least one parameter, the first constraint, the second constraint, and a preset detection threshold.
In addition, in order to further improve the accuracy of intrusion detection and reduce false alarms, the method of the embodiment may further collect feedback information of the user on intrusion detection. Specifically, the method of the present embodiment may include:
and S190, responding to the determined intrusion event, and prompting the user to generate the intrusion event.
And S192, obtaining the feedback of the user to the intrusion event.
And S194, determining the preset detection threshold value according to the feedback.
For example, if the user ignores a large portion (e.g., 95%) of the intrusion events, the preset detection threshold may be adjusted to be larger (to reduce false alarm conditions). Conversely, if the user has processed most (90%) of the intrusion events, the detection threshold will be set smaller (to reduce the instances of missed alarms).
In conclusion, the method of the embodiment can accurately detect the occurrence of the vehicle intrusion event.
It is understood by those skilled in the art that, in the method according to the embodiments of the present application, the sequence numbers of the steps do not mean the execution sequence, and the execution sequence of the steps should be determined by their functions and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.
Further, embodiments of the present application also provide a storage device, e.g., a computer-readable medium, comprising computer-readable instructions that when executed perform the following: the operations of the steps of the method in the embodiment shown in fig. 1 described above are performed.
Fig. 2(a) is a block diagram of a vehicle intrusion detection apparatus according to an embodiment of the present application. The device may be at least partially within the Vehicle itself, for example, a Vehicle Electronic Control Unit (ECU), In-Vehicle Infotainment (IVI) system, or other device independent of the Vehicle, or a remotely deployed device. As shown in fig. 2(a), the apparatus 200 of the present embodiment includes: a first acquisition module 220 and an intrusion detection module 240. Wherein the content of the first and second substances,
the first obtaining module 120 is configured to obtain at least one parameter transmitted on the CAN bus and associated with a state of the vehicle within a current first preset time period.
In the apparatus of this embodiment, to prevent the vehicle from being intruded, the first obtaining module 120 continuously detects the CAN data frames transmitted on the CAN bus, and analyzes the detected data frames within each preset time period (hereinafter referred to as a first preset time period, which may be arbitrarily set, for example, set to 0.5 second, 2 seconds, etc., according to the need of intrusion detection) to detect abnormal status parameters. The payload portion of the CAN data frame will typically carry parameters describing the state of some aspect of the vehicle, such parameters including, but not limited to: vehicle speed, engine speed, accelerator pedal position, window status, etc.
In one possible implementation, the first obtaining module 120 may read at least one data frame transmitted on a CAN bus of the vehicle through one or more probes disposed on the CAN bus. Specifically, as shown in fig. 2(b), the first obtaining module 220 may further include:
an obtaining unit 222, configured to read at least one data frame transmitted on the CAN bus through at least one detector disposed on the CAN bus of the vehicle.
The parsing unit 224 is configured to parse the at least one data frame to obtain the at least one parameter.
For example, the parsing unit 224 may extract and parse the parameters, the data types of the parameters, and the values of the parameters included in the payload of the CAN data frame according to the SAE J1939 protocol, in a format specified by the protocol.
The intrusion detection module 240 is configured to determine whether an intrusion event occurs within the current first preset time period according to the at least one parameter and a constraint condition corresponding to the at least one parameter within the current first preset time period.
In the device of the embodiment, reasonable constraint conditions CAN be set for parameters related to vehicle states under different situations, and according to the parameters detected in the first preset time period and the corresponding constraint conditions thereof, whether an abnormal CAN data frame containing unreasonable parameters and sent by an intruder exists CAN be determined (the parameters do not accord with the corresponding constraint conditions). In the apparatus of this embodiment, a detection threshold is further preset, and whether an intrusion event occurs is determined according to whether the number of the abnormal CAN data frames detected in each first preset time period exceeds the preset detection threshold.
Specifically, as shown in fig. 2(c), the intrusion detection module 240 may further include
A comparing unit 242, configured to compare the at least one parameter with a constraint condition corresponding to the at least one parameter in the current first preset time period.
And the intrusion detection unit 244 is configured to determine that an intrusion event occurs within the current first preset time period in response to that the number of parameters that do not satisfy the corresponding constraint conditions exceeds a preset detection threshold.
For example, if the acquired at least one parameter includes a plurality of vehicle speed values, and a part of the vehicle speed values is 100km/h, the constraint condition of the vehicle speed in the current first preset time period is as follows: the reasonable vehicle speed is within the range of 0-40 km, and if the vehicle speed value which does not fall within the reasonable vehicle speed range is determined to exceed 60%, the intrusion event can be determined to occur.
In the apparatus of this embodiment, the constraint condition may be at least one reasonable value range of the parameter, may be a set of reasonable values, and may also be a set that includes at least one reasonable value range and also includes reasonable values. The constraints may be stored in any form in the device implementing the method of the present embodiment, for example, a mapping table of parameters and constraints.
In summary, the apparatus of this embodiment CAN detect the occurrence of the intrusion event in the early stage of the intrusion by detecting the abnormal CAN data frame containing the unreasonable status parameters.
In one possible implementation, different weights may also be set for different status parameters, for example, higher weights may be given to vehicle dynamics related parameters and lower weights may be given to entertainment and comfort related parameters. Under the condition of having the weight, the sum of products of all the parameters which do not meet the constraint condition and the weight thereof can be calculated, the sum of products of all the parameters acquired in the current first preset time period and the weight thereof can be compared with a preset detection threshold value, and then whether the intrusion event occurs in the current first preset time period or not can be judged.
In addition, the state parameters of the vehicle under different scenes should be subject to different constraints. Specifically, as shown in fig. 2(d), the apparatus 200 of the present embodiment further includes:
the first determining module 260 is configured to determine a constraint condition corresponding to the at least one parameter in the current first preset time period.
In one possible implementation, "determining" may refer to acquiring, directly from the device itself implementing the method of the present embodiment, the stored constraints, or receiving the constraints from outside the device.
The constraints may be determined according to different scenarios. In one possible implementation, the constraint may comprise a first constraint relating to the driving state of the vehicle itself. For example, if the vehicle is in the initial starting state in the previous one or more first preset time periods, the first constraint condition that the vehicle speed is in the current first preset time period needs to refer to the driving scenario, and considering that the vehicle speed is not too fast in the initial starting state, even if the vehicle speed value acquired by the first acquiring module 220 does not exceed the maximum possible vehicle speed of the vehicle, such a vehicle speed value may still be abnormal. Specifically, the first determining module 260 may determine the first constraint condition corresponding to the at least one parameter during the current first preset time period according to the at least one parameter associated with the state of the vehicle during the previous at least one first preset time period and the at least one rated performance parameter of the vehicle.
At least one nominal performance parameter refers to an inherent performance parameter of a vehicle component, including but not limited to: power performance parameters such as output power, torque and the like of the engine under different speeds within 100 kilometer of acceleration time; comfort equipment performance parameters such as time spent for a window from a closed state to a fully opened state, time required for complete opening of an electric tailgate, an air conditioner fan speed level list and the like; and the weight of the similar vehicle, how many windows and doors are, etc. The constraints of the vehicle state parameters are set with reference to at least one nominal performance parameter. For example, the vehicle speed constraint may not exceed the maximum vehicle speed that the vehicle can reach, and so on.
For example, if the vehicle speed is 5km/h, the maximum power of the engine of the vehicle is 100KW, and the vehicle body weight is 1.5 tons in the previous first preset period, the first constraint condition of the vehicle speed in the current first preset period may be determined according to the acceleration of the power and the mass or the acceleration of the speed and the time, that is, the reasonable vehicle speed range is (0, 26.67 km/h). Similarly, the first constraint condition of the window state in the current first preset time period can be calculated according to the closing speed of the window in the previous first preset time period, the time of issuing the closing instruction and the original closing state.
In order to improve the detection accuracy and prevent false detection and/or false detection as much as possible, in the method of the embodiment, different detection periods (i.e., first preset periods) may correspond to different constraints (i.e., first constraints) to match different scenarios. Specifically, in a possible implementation manner, each parameter and the corresponding first constraint condition thereof need to be updated periodically, that is, the first determining module 260 needs to re-determine the first constraint condition every at least one second preset time period. And as shown in fig. 2(e), in such an implementation, the apparatus 200 of the present embodiment further includes:
a recording module 280, configured to record the determined first constraint condition, a first preset time period corresponding to the first constraint condition, and at least one parameter.
Specifically, in a possible implementation manner, the recording module 280 may store a mapping table of vehicle state parameters and a first preset time period and a first constraint condition, and may set a sliding update window for updating the mapping table: every second preset time interval, the sliding update window slides forwards for a first preset time interval, and the first determining module 260 determines the first constraint condition of the current first preset time interval according to the state parameter in at least one first preset time interval included in the current sliding update window, and updates the mapping table. Preferably, the first preset time period is the same as the second preset time period. Taking the first preset time period and the second preset time period both being 2 seconds and the sliding update window being 10 seconds as an example, the first constraint condition corresponding to the state parameter within 10 to 12 seconds of the vehicle start may be determined according to the state parameter within 0 to 10 seconds of the vehicle start, and recorded in the recording module 280. The constraint conditions corresponding to the state parameters within 12-14 seconds of vehicle start-up can be determined according to the state parameters within 2-12 seconds of vehicle start-up and recorded in the recording module 280.
In an implementation manner where the constraint condition includes a first constraint condition, the intrusion detection module 240 may determine whether an intrusion event occurs within the current first preset time period according to the at least one parameter, the first constraint condition, and a preset detection threshold.
In another possible implementation, the constraint may include a second constraint related to an environment of the vehicle. The environment of the vehicle includes, but is not limited to: weather, road conditions, driving conditions of other vehicles at all sides, front, rear, left and right, and the like. In such an implementation, as shown in fig. 2(f), the apparatus 200 of the present embodiment further includes:
a second obtaining module 230, configured to obtain environment information of the vehicle in the current first preset time period.
The environmental information includes, but is not limited to, relevant parameter values of the front, rear, left and right vehicles of the current vehicle, the states of brake tail lamps of the front vehicle, the distance from the front and rear vehicles, the distance from the next red light, speed limit information of the road, and the like. The second obtaining module 230 may obtain the environmental information from at least one sensor (e.g., an on-board camera) provided on the vehicle, may obtain the environmental information from outside the vehicle (e.g., a central server) through a network, and/or may obtain the environmental information from a direct communication network established between the vehicles. Specifically, the first determining module 260 may determine the second constraint condition corresponding to the at least one parameter within the current first preset time period according to the environmental information and at least one rated performance parameter of the vehicle.
For example, if the distance from the vehicle to the current red light is less than 20m, the second constraint condition for the vehicle speed may be set to (0, 5 km/h).
For another example, if the acquired speed of the preceding vehicle in the previous first preset time period is 5km/h, the mass of the preceding vehicle is 1.5 tons, the maximum power of the engine of the preceding vehicle is 50kw, and the distance from the preceding vehicle is 5m, the first constraint condition of the speed of the preceding vehicle may be determined to be (0, 13.33km/h) according to the method of the embodiment, and then the first constraint condition may be directly used as the second constraint condition of the own vehicle.
In such an implementation, the intrusion detection module 240 may determine whether an intrusion event occurs within the current first preset time period according to the at least one parameter, the second constraint condition, and a preset detection threshold.
In a further possible implementation, the constraint condition may relate both to the vehicle's own driving state and to the vehicle's environment. In such an implementation, the intrusion detection module 240 may determine the constraint condition corresponding to the at least one parameter during the current first preset time period according to the at least one parameter associated with the state of the vehicle during the previous at least one first preset time period, the environmental information, and the at least one rated performance parameter of the vehicle.
For example, if the vehicle speed is zero in the previous first preset time period and the distance from the vehicle to the current red light is less than 20m, the constraint condition of the vehicle speed in the current first preset time period is (0, 0).
In another possible implementation manner, the constraint condition may include both a first constraint condition and a second constraint condition, and in such an implementation manner, whether an intrusion event occurs may be determined according to the first constraint condition and the second constraint condition, and weights of results of the two manners are given, and whether an intrusion event occurs is finally determined by referring to the weights of the two manners. In such an implementation, the intrusion detection module 240 may determine whether an intrusion event occurs within the current first preset time period according to the at least one parameter, the first constraint condition, the second constraint condition, and a preset detection threshold.
In addition, in order to further improve the accuracy of intrusion detection and reduce false alarms, the device of the embodiment may further collect feedback information of the user on intrusion detection. Specifically, as shown in fig. 2(g), the apparatus 200 of the present embodiment may include:
and a prompt module 290 for prompting the user of the intrusion event in response to determining that the intrusion event occurs.
A third obtaining module 292, configured to obtain feedback of the user on the intrusion event.
A second determining module 294, configured to determine the preset detection threshold according to the feedback.
For example, if the user ignores a large portion (e.g., 95%) of the intrusion events, the preset detection threshold may be adjusted to be larger (to reduce false alarm conditions). Conversely, if the user has processed most (90%) of the intrusion events, the detection threshold will be set smaller (to reduce the instances of missed alarms).
In conclusion, the device of the embodiment can accurately detect the occurrence of the vehicle intrusion event.
Fig. 3 is a schematic structural diagram of an example of a vehicle intrusion detection device according to another embodiment of the present application, and the specific embodiment of the present application does not limit the specific implementation of the intrusion detection device. As shown in fig. 3, the vehicle intrusion detection apparatus 300 may include:
a processor (processor)310, a communication Interface (Communications Interface)320, a memory (memory)330, and a communication bus 340. Wherein:
the processor 310, communication interface 320, and memory 330 communicate with each other via a communication bus 340.
A communication interface 320 for communicating with network elements such as clients and the like.
The processor 310 is configured to execute the program 332, and may specifically perform the relevant steps in the foregoing method embodiments.
In particular, the program 332 may include program code comprising computer operating instructions.
The processor 310 may be a central processing unit CPU, or an application Specific Integrated circuit asic, or one or more Integrated circuits configured to implement embodiments of the present application.
And a memory 330 for storing a program 332. Memory 330 may comprise high-speed RAM memory and may also include non-volatile memory (non-volatile memory), such as at least one disk memory. The program 332 may be specifically configured to enable the vehicle intrusion detection device 300 to perform the following steps:
acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period;
and determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the constraint condition corresponding to the at least one parameter in the current first preset time period.
For specific implementation of each step in the program 332, reference may be made to corresponding steps and corresponding descriptions in units in the foregoing embodiments, which are not described herein again. It can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described devices and modules may refer to the corresponding process descriptions in the foregoing method embodiments, and are not described herein again.
It can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described apparatuses and modules may refer to the corresponding descriptions in the foregoing device embodiments, and are not repeated herein.
While the subject matter described herein is provided in the general context of execution in conjunction with the execution of an operating system and application programs on a computer system, those skilled in the art will recognize that other implementations may also be performed in combination with other types of program modules. Generally, program modules include routines, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types. Those skilled in the art will appreciate that the subject matter described herein may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and the like, as well as distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
Those of ordinary skill in the art will appreciate that the various illustrative elements and method steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to perform all or part of the steps of the method according to the embodiments of the present application. Such computer-readable storage media include physical volatile and nonvolatile, removable and non-removable media implemented in any manner or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. The computer-readable storage medium specifically includes, but is not limited to, a USB flash drive, a removable hard drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), an erasable programmable Read-Only Memory (EPROM), an electrically erasable programmable Read-Only Memory (EEPROM), flash Memory or other solid state Memory technology, a CD-ROM, a Digital Versatile Disk (DVD), an HD-DVD, a Blue-Ray or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer.
The above embodiments are only for illustrating the invention and are not to be construed as limiting the invention, and those skilled in the art can make various changes and modifications without departing from the spirit and scope of the invention, therefore, all equivalent technical solutions also belong to the scope of the invention, and the scope of the invention is defined by the claims.
Claims (23)
1. A vehicle intrusion detection method, the method comprising:
acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period;
determining a constraint condition corresponding to the at least one parameter in the current first preset time period;
the determining the constraint condition corresponding to the at least one parameter in the current first preset time period further includes:
determining a first constraint condition corresponding to at least one parameter in a current first preset time period according to at least one parameter associated with the state of the vehicle in at least one first preset time period and at least one rated performance parameter of the vehicle, and implementing the first constraint condition corresponding to the at least one parameter in the current first preset time period every at least one second preset time period, wherein the at least one rated performance parameter is an inherent performance parameter of each component of the vehicle;
determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the first constraint condition corresponding to the at least one parameter in the current first preset time period;
the determining whether the intrusion event occurs within the current first preset time period further includes:
comparing the at least one parameter with a constraint condition corresponding to the at least one parameter in the current first preset time period;
responding to the condition that the quantity of the parameters which do not meet the corresponding constraint conditions exceeds a preset detection threshold value, and determining that an intrusion event occurs in the current first preset time period;
the method further comprises the following steps:
and recording the determined first constraint condition, a first preset time period corresponding to the first constraint condition and at least one parameter.
2. The method of claim 1, wherein the obtaining at least one parameter transmitted on a Controller Area Network (CAN) bus associated with a status of the vehicle within a current first predetermined period of time further comprises:
reading at least one data frame transmitted on the CAN bus by at least one detector arranged on the CAN bus of the vehicle;
and analyzing the at least one data frame to obtain the at least one parameter.
3. The method of claim 1, wherein the first predetermined period of time is the same as the second predetermined period of time.
4. The method of claim 1, wherein the determining whether an intrusion event occurs within the current first preset time period further comprises:
and determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter, the first constraint condition and a preset detection threshold.
5. The method of claim 1, further comprising:
acquiring environmental information of the vehicle in the current first preset time period;
the determining the constraint condition corresponding to the at least one parameter in the current first preset time period further includes:
and determining a second constraint condition corresponding to the at least one parameter in the current first preset time period according to the environmental information and at least one rated performance parameter of the vehicle.
6. The method of claim 5, wherein the obtaining environmental information of the vehicle within the current first preset time period further comprises:
the environmental information is obtained from at least one sensor provided on the vehicle and/or from outside the vehicle.
7. The method of claim 5, wherein the determining whether the intrusion event occurs within the current first preset time period further comprises:
and determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter, the second constraint condition and a preset detection threshold.
8. The method of claim 4, further comprising:
acquiring environmental information of the vehicle in the current first preset time period;
the determining the constraint condition corresponding to the at least one parameter in the current first preset time period further includes:
determining a second constraint condition corresponding to at least one parameter in the current first preset time period according to the environmental information and at least one rated performance parameter of the vehicle;
the determining whether the intrusion event occurs within the current first preset time period further includes:
and determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter, the first constraint condition, the second constraint condition and a preset detection threshold value.
9. The method of claim 1, further comprising:
acquiring environmental information of the vehicle in the current first preset time period;
the determining the constraint condition corresponding to the at least one parameter in the current first preset time period further includes:
and determining a constraint condition corresponding to at least one parameter in the current first preset time period according to at least one parameter associated with the state of the vehicle in at least one first preset time period, the environmental information and at least one rated performance parameter of the vehicle.
10. The method of claim 1, further comprising:
prompting a user for an intrusion event in response to determining that the intrusion event occurs;
obtaining the feedback of the user to the intrusion event;
and determining the preset detection threshold according to the feedback.
11. The method of any one of claims 1 to 9, wherein said determining whether an intrusion event occurred within the current first preset time period further comprises:
and determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter, the constraint condition corresponding to the at least one parameter in the current first preset time period, the weight of the at least one parameter and a preset detection threshold.
12. A vehicle intrusion detection device, the device comprising:
the system comprises a first acquisition module, a second acquisition module and a control module, wherein the first acquisition module is used for acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period;
a first determining module, configured to determine a constraint condition corresponding to the at least one parameter in the current first preset time period;
the first determining module is used for determining a first constraint condition corresponding to at least one parameter in a current first preset time period according to at least one parameter associated with the state of the vehicle in at least one first preset time period and at least one rated performance parameter of the vehicle, and the first determining module is used for determining the first constraint condition corresponding to the at least one parameter in the current first preset time period every at least one second preset time period, wherein the at least one rated performance parameter is an inherent performance parameter of each component of the vehicle;
the intrusion detection module is used for determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the first constraint condition corresponding to the at least one parameter in the current first preset time period;
the intrusion detection module further comprises:
the comparison unit is used for comparing the at least one parameter with a constraint condition corresponding to the at least one parameter in the current first preset time period;
the intrusion detection unit is used for responding to the condition that the number of the parameters which do not meet the corresponding constraint conditions exceeds a preset detection threshold value, and determining that an intrusion event occurs in the current first preset time period;
the device further comprises:
and the recording module is used for recording the determined first constraint condition, a first preset time period corresponding to the first constraint condition and at least one parameter.
13. The apparatus of claim 12, wherein the first obtaining module further comprises:
the acquisition unit is used for reading at least one data frame transmitted on the CAN bus through at least one detector arranged on the CAN bus of the vehicle;
and the analysis unit is used for analyzing the at least one data frame to obtain the at least one parameter.
14. The apparatus of claim 12, wherein the intrusion detection module is configured to determine whether an intrusion event occurs within the current first predetermined time period according to the at least one parameter, the first constraint condition, and a predetermined detection threshold.
15. The apparatus of claim 12, further comprising:
the second acquisition module is used for acquiring the environmental information of the vehicle in the current first preset time period;
the first determining module is used for determining a second constraint condition corresponding to at least one parameter in the current first preset time period according to the environmental information and at least one rated performance parameter of the vehicle.
16. The apparatus of claim 15, wherein the second obtaining module is configured to obtain the environmental information from at least one sensor disposed on the vehicle and/or outside the vehicle.
17. The apparatus of claim 15, wherein the first determining module is configured to determine whether an intrusion event occurs within the current first predetermined time period according to the at least one parameter, the second constraint condition, and a predetermined detection threshold.
18. The apparatus of claim 14, further comprising:
the second acquisition module is used for acquiring the environmental information of the vehicle in the current first preset time period;
the first determining module is used for determining a second constraint condition corresponding to at least one parameter in the current first preset time period according to the environmental information and at least one rated performance parameter of the vehicle;
the intrusion detection module is used for determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter, the first constraint condition, the second constraint condition and a preset detection threshold value.
19. The apparatus of claim 12, further comprising:
the second acquisition module is used for acquiring the environmental information of the vehicle in the current first preset time period;
the first determining module is used for determining a constraint condition corresponding to at least one parameter in the current first preset time period according to at least one parameter associated with the state of the vehicle in at least one first preset time period, the environmental information and at least one rated performance parameter of the vehicle.
20. The apparatus of claim 12, further comprising:
the prompting module is used for responding to the determined occurrence of the intrusion event and prompting a user of the occurrence of the intrusion event;
a third obtaining module, configured to obtain feedback of the user on the intrusion event;
and the second determining module is used for determining the preset detection threshold according to the feedback.
21. The apparatus according to any one of claims 12 to 20, wherein the intrusion detection module is configured to determine whether an intrusion event occurs within the current first predetermined time period according to the at least one parameter, a constraint condition corresponding to the at least one parameter within the current first predetermined time period, a weight of the at least one parameter, and a predetermined detection threshold.
22. A computer readable medium having stored therein a plurality of instructions adapted to be loaded and executed by a processor:
acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period;
determining a constraint condition corresponding to the at least one parameter in the current first preset time period;
the determining the constraint condition corresponding to the at least one parameter in the current first preset time period further includes:
determining a first constraint condition corresponding to at least one parameter in a current first preset time period according to at least one parameter associated with the state of the vehicle in at least one first preset time period and at least one rated performance parameter of the vehicle, and implementing the first constraint condition corresponding to the at least one parameter in the current first preset time period every at least one second preset time period, wherein the at least one rated performance parameter is an inherent performance parameter of each component of the vehicle;
further performing: determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the first constraint condition corresponding to the at least one parameter in the current first preset time period;
the determining whether the intrusion event occurs within the current first preset time period further includes:
comparing the at least one parameter with a constraint condition corresponding to the at least one parameter in the current first preset time period;
responding to the condition that the quantity of the parameters which do not meet the corresponding constraint conditions exceeds a preset detection threshold value, and determining that an intrusion event occurs in the current first preset time period;
further performing: and recording the determined first constraint condition, a first preset time period corresponding to the first constraint condition and at least one parameter.
23. A vehicle intrusion detection device, the device comprising:
a memory for storing instructions;
a processor for executing the memory-stored instructions, the instructions causing the processor to perform the steps of:
acquiring at least one parameter which is transmitted on a Controller Area Network (CAN) bus and is related to the state of a vehicle in a current first preset time period;
determining a constraint condition corresponding to the at least one parameter in the current first preset time period;
the determining the constraint condition corresponding to the at least one parameter in the current first preset time period further includes:
determining a first constraint condition corresponding to at least one parameter in a current first preset time period according to at least one parameter associated with the state of the vehicle in at least one first preset time period and at least one rated performance parameter of the vehicle, and implementing the first constraint condition corresponding to the at least one parameter in the current first preset time period every at least one second preset time period, wherein the at least one rated performance parameter is an inherent performance parameter of each component of the vehicle;
further performing: determining whether an intrusion event occurs in the current first preset time period according to the at least one parameter and the first constraint condition corresponding to the at least one parameter in the current first preset time period;
the determining whether the intrusion event occurs within the current first preset time period further includes:
comparing the at least one parameter with a constraint condition corresponding to the at least one parameter in the current first preset time period;
responding to the condition that the quantity of the parameters which do not meet the corresponding constraint conditions exceeds a preset detection threshold value, and determining that an intrusion event occurs in the current first preset time period;
further performing: and recording the determined first constraint condition, a first preset time period corresponding to the first constraint condition and at least one parameter.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810838180.9A CN109150846B (en) | 2018-07-27 | 2018-07-27 | Vehicle intrusion detection method and vehicle intrusion detection device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810838180.9A CN109150846B (en) | 2018-07-27 | 2018-07-27 | Vehicle intrusion detection method and vehicle intrusion detection device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109150846A CN109150846A (en) | 2019-01-04 |
| CN109150846B true CN109150846B (en) | 2021-08-17 |
Family
ID=64799020
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810838180.9A Active CN109150846B (en) | 2018-07-27 | 2018-07-27 | Vehicle intrusion detection method and vehicle intrusion detection device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109150846B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR102642863B1 (en) * | 2017-12-19 | 2024-02-29 | 현대자동차주식회사 | Systems and methods for providing security to in-vehicle networks |
| CN110149348A (en) * | 2019-06-20 | 2019-08-20 | 北京经纬恒润科技有限公司 | The means of defence and device of In-vehicle networking |
| CN111107152A (en) * | 2019-12-19 | 2020-05-05 | 浙江军盾信息科技有限公司 | Internet of vehicles terminal intrusion processing method, device, equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101817335A (en) * | 2010-03-10 | 2010-09-01 | 奇瑞汽车股份有限公司 | Automotive theft-proof system and theft-proof control method |
| CN106184068A (en) * | 2016-06-30 | 2016-12-07 | 北京奇虎科技有限公司 | Automotive interior network security detection method and device, automobile |
| CN107117130A (en) * | 2017-04-01 | 2017-09-01 | 奇瑞汽车股份有限公司 | VATS Vehicle Anti-Theft System and method |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP6173541B2 (en) * | 2015-10-09 | 2017-08-02 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ | Security device, attack detection method and program |
-
2018
- 2018-07-27 CN CN201810838180.9A patent/CN109150846B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101817335A (en) * | 2010-03-10 | 2010-09-01 | 奇瑞汽车股份有限公司 | Automotive theft-proof system and theft-proof control method |
| CN106184068A (en) * | 2016-06-30 | 2016-12-07 | 北京奇虎科技有限公司 | Automotive interior network security detection method and device, automobile |
| CN107117130A (en) * | 2017-04-01 | 2017-09-01 | 奇瑞汽车股份有限公司 | VATS Vehicle Anti-Theft System and method |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109150846A (en) | 2019-01-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108989319B (en) | Vehicle intrusion detection method and vehicle intrusion detection device based on CAN bus | |
| US11748474B2 (en) | Security system and methods for identification of in-vehicle attack originator | |
| US11934520B2 (en) | Detecting data anomalies on a data interface using machine learning | |
| CN110226310B (en) | Electronic control device, fraud detection server, in-vehicle network system, in-vehicle network monitoring system, and method | |
| US10798114B2 (en) | System and method for consistency based anomaly detection in an in-vehicle communication network | |
| US11451579B2 (en) | System and method for protecting electronics systems of a vehicle from cyberattacks | |
| CN109150846B (en) | Vehicle intrusion detection method and vehicle intrusion detection device | |
| US11277417B2 (en) | System and method of generating rules for blocking a computer attack on a vehicle | |
| CN106031098B (en) | Abnormal frame coping method, abnormal detection electronic control unit and vehicle-mounted network system | |
| CN111030962B (en) | Vehicle-mounted network intrusion detection method and computer-readable storage medium | |
| EP3726782A1 (en) | On-vehicle network abnormality detection system and on-vehicle network abnormality detection method | |
| CN111311914B (en) | Vehicle driving accident monitoring method and device and vehicle | |
| WO2017024078A1 (en) | A method for detecting, blocking and reporting cyber-attacks against automotive electronic control units | |
| EP3547191A1 (en) | System and method of generating rules for blocking a computer attack on a vehicle | |
| CN115102707A (en) | Vehicle CAN network IDS safety detection system and method | |
| KR101791786B1 (en) | Vehicle security system and operation method | |
| CN114237995B (en) | Bus abnormity detection method, device, equipment and readable storage medium | |
| CN111145380A (en) | Reported data processing method and device adaptive to vehicle-mounted equipment and electronic equipment | |
| Laufenberg et al. | A framework for can communication and attack simulation | |
| JP7160206B2 (en) | SECURITY DEVICE, ATTACK RESPONSE PROCESSING METHOD, COMPUTER PROGRAM AND STORAGE MEDIUM | |
| CN117650941A (en) | CAN message detection method, detection device, processor and computer equipment | |
| CN115484059A (en) | Vehicle-mounted bus message processing method and device, vehicle-mounted terminal and storage medium | |
| JP2022172456A (en) | Detection/assessment of intrusion into electronic data system of vehicle | |
| KR20210063845A (en) | Device and method for analysis in-vehicle data | |
| KR20220082550A (en) | Vehicle |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |