Vehicle-to-Everything Abnormal Behavior Detection Method, Apparatus, and System

Patent metadata

Field	Value
Publication number	US-2021281986-A1
Application number	US-202117319663-A
Country	US
Kind code	A1
Filing date	May 13, 2021
Priority date	Nov 20, 2018
Publication date	Sep 9, 2021
Grant date	—

Abstract

A vehicle-to-everything (V2X) abnormal behavior detection method applied to a vehicle communications system that includes a V2X sending terminal, a V2X receiving terminal, and a V2X server. The method includes that the V2X receiving terminal receives a V2X message from the V2X sending terminal. The V2X receiving terminal determines, according to an abnormal behavior detection policy, that the V2X message is an abnormal message. The V2X receiving terminal sends a report message including the V2X message to the V2X server.

First claim

What is claimed is:

1 . A method implemented by a vehicle-to-everything (V2X) receiving terminal, wherein the method comprises:
receiving a first V2X message from a V2X sending terminal; determining, according to a first abnormal behavior detection policy, that the first V2X message is an abnormal message; and sending, to a V2X server in response to determining that the first V2X message is the abnormal message, a report message comprising the first V2X message.

2 . The method of claim 1 , wherein determining that the first V2X message is the abnormal message comprises:
obtaining an abnormal behavior feature from the first V2X message according to the first abnormal behavior detection policy; and determining, based on the abnormal behavior feature, that the first V2X message is the abnormal message.

3 . The method of claim 2 , wherein the abnormal behavior feature comprises at least one of:
an abnormal permission behavior feature; an abnormal position behavior feature; an abnormal speed behavior feature; or an abnormal event behavior feature.

4 . The method of claim 2 , wherein after determining that the first V2X message is the abnormal message, the method further comprises:
obtaining a first quantity of occurrences of the abnormal behavior feature during a first time period; obtaining a second quantity of occurrences of the abnormal behavior feature during a second time period, wherein the second time period is greater than the first time period; and determining that the V2X sending terminal has an abnormal behavior when the first quantity is greater than a first abnormal behavior threshold or when the second quantity is greater than a second abnormal behavior threshold.

5 . The method of claim 4 , wherein after determining that the V2X sending terminal has the abnormal behavior, the method further comprises adding the V2X sending terminal to a blacklist that intercepts a second V2X message received by the V2X receiving terminal.

6 . The method of claim 1 , wherein before receiving the first V2X message, the method further comprises obtaining the first abnormal behavior detection policy from the V2X server.

7 . The method of claim 6 , wherein the V2X sending terminal has an abnormal behavior, and wherein the method further comprises adding the V2X sending terminal to a blacklist that intercepts a second V2X message received by the V2X receiving terminal.

8 . The method of claim 1 , wherein after sending the report message, the method further comprises:
receiving a report message response from the V2X server; and determining, based on the report message response, whether the V2X sending terminal has an abnormal behavior.

9 . A method implemented by a vehicle-to-everything (V2X) server in a vehicle communications system, wherein the method comprises:
receiving, from a V2X receiving terminal in the vehicle communications system, a report message comprising a first V2X message of a V2X sending terminal in the vehicle communications system; determining, according to a second abnormal behavior detection policy and the report message, whether the V2X receiving terminal has an abnormal behavior; and determining, according to a third abnormal behavior detection policy and the first V2X message, whether the V2X sending terminal has the abnormal behavior.

10 . The method of claim 9 , wherein the report message comprises a certificate of the V2X receiving terminal, and wherein determining whether the V2X receiving terminal has the abnormal behavior comprises:
obtaining a plurality of certificates of the V2X receiving terminal from a first certificate authority in the vehicle communications system, wherein the first certificate authority is configured to issue the certificates to the V2X receiving terminal; determining a total quantity of reports of the V2X receiving terminal based on the certificates; and determining, based on the total quantity of reports, whether the V2X receiving terminal has the abnormal behavior.

11 . The method of claim 9 , wherein determining whether the V2X sending terminal has the abnormal behavior comprises:
obtaining a plurality of certificates of the V2X sending terminal from a second certificate authority in the vehicle communications system, wherein the second certificate authority is configured to issue the certificates to the V2X sending terminal; determining, based on the certificates and the first V2X message, a first total quantity of reports of a plurality of second V2X receiving terminals in the vehicle communications system, wherein the first total quantity of reports is of the second V2X receiving terminals for the V2X sending terminal or for the first V2X message; and determining, based on the first total quantity of reports, whether the V2X sending terminal has the abnormal behavior.

12 . The method of claim 9 , wherein determining whether the V2X sending terminal has the abnormal behavior comprises:
separately receiving second report messages from a plurality of second V2X receiving terminals; detecting, according to the third abnormal behavior detection policy, second V2X messages separately carried in the second report messages to obtain a plurality of abnormal behavior features; and performing statistical analysis on the abnormal behavior features to obtain whether the V2X sending terminal has the abnormal behavior.

13 . The method of claim 12 , wherein each of the abnormal behavior features comprises at least one of:
an abnormal permission behavior feature; an abnormal position behavior feature; an abnormal speed behavior feature; or an abnormal event behavior feature.

14 . The method of claim 9 , further comprising:
sending, to a third certificate authority in the vehicle communications system, a first certificate revocation request comprising a certificate of an abnormal V2X terminal, wherein the third certificate authority is configured to request a certificate revocation server in the vehicle communications system to revoke the certificate of the abnormal V2X terminal, and wherein the abnormal V2X terminal is either the V2X sending terminal having the abnormal behavior or the V2X receiving terminal having the abnormal behavior; and receiving, from the third certificate authority, a response indicating that the certificate of the abnormal V2X terminal is revoked.

15 . The method of claim 9 , further comprising:
sending, to a certificate revocation server in the vehicle communications system, a second certificate revocation request comprising a certificate of an abnormal V2X terminal, wherein the abnormal V2X terminal is either the V2X sending terminal having the abnormal behavior or the V2X receiving terminal having the abnormal behavior; and receiving, from the certificate revocation server, a response indicating that the certificate of the abnormal V2X terminal is revoked.

16 . The method of claim 9 , wherein after determining whether the V2X sending terminal has the abnormal behavior, the method further comprises:
generating a report message response indicating whether the V2X sending terminal has the abnormal behavior; and sending the report message response to the V2X receiving terminal.

17 . The method of claim 9 , wherein before receiving the report message, the method further comprises sending a first abnormal behavior detection policy to the V2X receiving terminal.

18 . The method of claim 9 , wherein determining whether the V2X sending terminal has the abnormal behavior comprises determining, according to the third ab

Assignees

• Huawei Tech Co Ltd

Inventors

• Zhu Jintao
• Li Fei
• He Chengdong

Classifications

• H04W4/44

  for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H] · CPC title

• H04W4/46

  for vehicle-to-vehicle communication [V2V] · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title