CN113060082B - Abnormality processing method and device for vehicle-mounted firewall, vehicle-mounted firewall and automobile - Google Patents

Abstract

The application discloses an abnormality processing method and device of a vehicle-mounted firewall, the vehicle-mounted firewall and an automobile, which are applied to the technical field of automobiles and are used for solving the technical problem that the prior art cannot distinguish between a harmful abnormal state and a harmless abnormality under the condition that the automobiles are not networked. The method provided by the application comprises the following steps: reading historical abnormality recorded in an initial alarm record table when the whole vehicle is powered on; when an abnormality is reported in the period from the power-on of the whole vehicle to the power-off of the whole vehicle, scoring the reported abnormality once, and updating the score of the reported corresponding abnormality in the initial alarm record table; when the unreported historical abnormality exists in the initial alarm record table during the period from the power-on of the whole vehicle to the power-off of the whole vehicle, scoring the unreported historical abnormality once, and updating the score of the unreported abnormality in the initial alarm record table; if the updated abnormal score is within the preset range, judging the abnormal score as harmful, otherwise, judging the abnormal score as harmless.

Description

Exception handling method and device of vehicle-mounted firewall, vehicle-mounted firewall and automobile

Technical field

The present application relates to the field of automotive technology, and in particular to an exception handling method and device for a vehicle-mounted firewall, a vehicle-mounted firewall and an automobile.

Background technique

In the existing technology, the vehicle-mounted firewall can effectively identify the abnormal state of the vehicle and the malicious attacks suffered by hackers by alerting the detected abnormal vehicle behavior.

Due to factors such as fluctuations in the vehicle's own operating status, design and production errors, aging of electronic components, etc., vehicle network communication has an abnormal state that is inconsistent with design expectations. This abnormal state is harmless to the vehicle but may trigger the firewall. of alert. We believe that this type of anomaly does not belong to harmful vehicle anomalies such as malicious attacks by hackers, but can be defined as the "characteristics" of a vehicle.

Existing vehicle-mounted firewalls cannot distinguish the "characteristics" of the vehicle from harmful vehicle anomalies such as malicious attacks by hackers. As a result, anomalies related to the "characteristics" of the vehicle will be regarded as harmful anomalies and alarmed. As a result, the existing vehicle-mounted firewalls will Abnormal alarms may result in errors.

Contents of the invention

Embodiments of the present application provide an exception handling method and device for a vehicle-mounted firewall, a vehicle-mounted firewall and a car to solve the problem that the existing technology cannot combine the "characteristics" of the vehicle with malicious attacks by hackers and other harmful vehicle abnormal states when the car is not connected to the Internet. technical issues to distinguish.

According to one aspect of the present application, an exception handling method for a vehicle-mounted firewall is provided. The method includes:

When the entire vehicle is powered on, the initial alarm record table is read, and the initial alarm record table records historical anomalies and scores of the historical anomalies;

When an exception is reported through the vehicle firewall between the time the entire vehicle is powered on and the vehicle is powered off, the reported exception is scored once, and the score of the reported corresponding exception in the initial alarm record table is updated;

When there are unreported historical anomalies in the initial alarm record table from when the entire vehicle is powered on to when the entire vehicle is powered off, score the unreported historical anomalies once and update the corresponding unreported anomalies in the table. the score in the initial alarm record table;

If the updated score of the anomaly is within the preset range, the corresponding anomaly is determined to be a harmful anomaly; otherwise, the corresponding anomaly is determined to be a harmless anomaly.

According to another aspect of the present application, an exception handling device for a vehicle-mounted firewall is provided, and the device includes:

The table reading module is used to read the initial alarm record table when the entire vehicle is powered on. The initial alarm record table records historical anomalies and scores of the historical anomalies;

The first scoring module is used to score an abnormality reported through the vehicle firewall during the period from when the entire vehicle is powered on to when the entire vehicle is powered off, and to update the reported corresponding abnormality in the initial alarm. Record the scores in the table;

The second scoring module is used to score the unreported historical anomalies once and update them when there are unreported historical anomalies in the initial alarm record table from when the entire vehicle is powered on to when the entire vehicle is powered off. The score of the corresponding anomaly that has not been reported in the initial alarm record table;

The judgment module is configured to judge the corresponding abnormality as a harmful abnormality if the updated score of the abnormality is within a preset range; otherwise, judge the corresponding abnormality as a harmless abnormality.

A vehicle-mounted firewall provided according to yet another aspect of the present application includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the The steps of the exception handling method of the vehicle-mounted firewall.

According to yet another aspect of the present application, a car is provided, which includes the vehicle-mounted firewall.

The exception handling method, device, vehicle firewall and car proposed by this application are used to score reported exceptions and unreported historical exceptions respectively. Through analysis, it can be known that harmless exceptions have the characteristics of high frequency and continuous occurrence. , and harmful anomalies do not have this feature, so when reporting anomalies and unreported historical anomalies are scored separately, they are scored only once from when the entire vehicle is powered on to when the entire vehicle is powered off, regardless of whether the same exception is reported. No matter how many times it occurs, the anomaly will only be scored once, so that the score of the anomaly recorded in the initial alarm record table has the ability to identify, and the final score of each anomaly can distinguish harmful anomalies from harmless anomalies.

Description of drawings

In order to explain the technical solutions of the embodiments of the present application more clearly, the drawings needed to be used in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. , for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without exerting creative labor.

Figure 1 is a flow chart of an exception handling method of a vehicle-mounted firewall in an embodiment of the present application;

Figure 2 is a flow chart of an exception handling method of a vehicle-mounted firewall in another embodiment of the present application;

Figure 3 is a flow chart of an exception handling method of a vehicle-mounted firewall in yet another embodiment of the present application;

Figure 4 is a flow chart of an exception handling method of a vehicle-mounted firewall in yet another embodiment of the present application;

Figure 5 is an exemplary structural block diagram of an exception handling device of a vehicle-mounted firewall in an embodiment of the present application;

Figure 6 is a structural block diagram of a vehicle-mounted firewall in an embodiment of the present application;

Figure 7 is a schematic structural diagram of a car in an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application and are not used to limit the present application.

The implementation of this application is described in detail below with reference to specific drawings:

Figure 1 is a flow chart of an exception handling method of a vehicle-mounted firewall according to an embodiment of the present application. The following is a detailed description of the exception handling method of a vehicle-mounted firewall according to an embodiment of the present application in conjunction with Figure 1. As shown in Figure 1, the abnormality of the vehicle-mounted firewall The processing method includes the following steps S101 to S104.

S101. When the entire vehicle is powered on, the initial alarm record table is read. The initial alarm record table records historical anomalies and scores of the historical anomalies.

In one embodiment, the initial alarm record table may be stored in a non-volatile memory, and the historical anomalies recorded in the initial alarm record table may include both harmful anomalies and harmless anomalies.

Among them, the harmful anomaly may be maliciously attacked by hackers, and the harmless anomaly may be caused by vehicle network communication being inconsistent with design expectations due to factors such as fluctuations in the vehicle's own operating status, design and production errors, aging of electronic components, etc. Abnormal status.

S102. When an exception is reported through the vehicle firewall between the time the vehicle is powered on and the vehicle is powered off, score the reported exception once and update the score of the reported corresponding exception in the initial alarm record table. .

In one of the embodiments, scoring the reported abnormality once may be to score the abnormality when the abnormality is reported for the first time during the period from when the entire vehicle is powered on to when the entire vehicle is powered off. If the abnormality is reported before the entire vehicle is powered off, If you report again, you will not be graded.

Further, scoring the reported exception once may be adding points to the reported exception.

In one embodiment, if the reported exception is a historical exception recorded in the initial alarm record table, the historical score of the exception in the initial alarm record table is obtained, and the historical score of the exception is added to this The score given this time is used as the updated score of the anomaly.

S103. When there are unreported historical anomalies in the initial alarm record table from when the entire vehicle is powered on to when the entire vehicle is powered off, score the unreported historical anomalies and update the unreported corresponding ones. The score of anomalies in the initial alert record table.

In one embodiment, the scoring sign for the unreported historical anomaly is opposite to the scoring sign for the reported anomaly.

In one embodiment, assigning a score to the historical anomaly that has not been reported may mean deducting points for the anomaly that has not been reported.

In this embodiment, since harmful exceptions may not be reported every time the car is powered on, and harmless exceptions have the characteristics of continuous occurrence, points are deducted for unreported exceptions to reflect unreported exceptions. Exceptions are more likely to be harmful exceptions.

S104. If the updated score of the anomaly is within the preset range, determine the corresponding anomaly to be a harmful anomaly; otherwise, determine the corresponding anomaly to be a harmless anomaly.

In one embodiment, the preset range may be an artificially set range. For example, when the updated score of the anomaly is greater than a preset threshold, the anomaly is judged to be a harmless anomaly. When the updated When the score of the subsequent anomaly is less than or equal to the threshold, the corresponding anomaly is determined to be a harmful anomaly. Further, anomalies judged to be harmful may be subjected to alarm processing, or anomalies with a score greater than the threshold may be deleted from the initial alarm record table.

In one embodiment, the method further includes:

When the corresponding anomaly is judged to be a harmful anomaly, an alarm will be issued for the harmful anomaly;

When it is determined that the corresponding exception is a harmless exception, the harmless exception is deleted from the initial alarm record table.

In this embodiment, by scoring reported exceptions and unreported historical exceptions respectively, it can be learned through analysis that harmless exceptions have the characteristics of high frequency and continuous occurrence, while harmful exceptions do not have this characteristic, so when reporting When the anomalies and unreported historical anomalies are scored separately, they will only be scored once from the time when the entire vehicle is powered on to the time when the entire vehicle is powered off. No matter how many times the same exception is reported, the anomaly will only be scored once. This makes the anomaly scores recorded in the initial alarm record table discernible, and the final score assigned to each anomaly can distinguish harmful anomalies from harmless anomalies.

Figure 2 is a flow chart of an exception handling method for a vehicle-mounted firewall according to another embodiment of the present application. The following describes an exception handling method for a vehicle-mounted firewall according to another embodiment of the present application in conjunction with Figure 2. As shown in Figure 2, the method includes: On the basis of the above steps S101, S103 and S104, the above step S102 further includes the following steps S201 and S202.

S201. Obtain the abnormality reported during the period from when the entire vehicle is powered on to when the entire vehicle is powered off;

S202. Determine whether the initial alarm record table contains the reported exception. If so, add points to the reported exception when it is reported for the first time. Otherwise, add points to the reported exception. When the alarm is reported for the first time, an additional score is added based on zero, and the abnormality reported and the score are saved in the initial alarm record table.

In one embodiment, if the reported exception is not a historical exception recorded in the initial alarm record table, when the reported exception is saved in the initial alarm record table, the reported exception can be stored in the initial alarm record table. The score assigned is determined as the score recorded in the initial alarm record table for the anomaly.

Figure 3 is a flow chart of an exception handling method for a vehicle-mounted firewall according to another embodiment of the present application. The following describes an exception handling method for a vehicle-mounted firewall according to another embodiment of the present application in conjunction with Figure 3. As shown in Figure 3, the method includes: On the basis of the above steps S101, S102 and S104, the above step S103 further includes the following step S301.

S301. When there are unreported historical anomalies in the initial alarm record table from when the entire vehicle is powered on to when the entire vehicle is powered off, deduct points for the unreported historical anomalies and update the unreported historical anomalies. The score corresponding to the anomaly in the initial alarm record table.

In this embodiment, points may be added to the reported anomaly when it is reported for the first time, and correspondingly, points may be deducted for unreported historical anomalies to distinguish harmful anomalies from harmless anomalies.

In other embodiments, points may be deducted for the reported anomaly when it is reported for the first time, and correspondingly, points may be added for unreported historical anomalies, and harmful anomalies and harmless anomalies may also be distinguished.

This embodiment deducts points for unreported historical anomalies and adds points for reported anomalies, so as to widen the score between harmful anomalies and harmless anomalies, making it easier for the vehicle-mounted firewall to distinguish harmful anomalies from harmless anomalies.

Figure 4 is a flow chart of an exception handling method for a vehicle-mounted firewall in yet another embodiment of the present application. Alternatively, as shown in Figure 4, the above step S101 further includes the following step S401:

S401. When the vehicle is powered on, an initial alarm record table is read from the non-volatile memory. The initial alarm record table records historical anomalies and scores of the historical anomalies.

In one embodiment, the vehicle firewall exception handling method further includes the following step S402.

S402. When the entire vehicle is powered off, store the updated initial alarm record table as a new initial alarm record table in the non-volatile memory.

According to a usage scenario of this embodiment, for example: through M ignition cycles (where M is a preset value), the vehicle-mounted firewall learns the bus communication protocol of a vehicle and generates an error message that does not meet the bus communication protocol definition and design goals. Message behavior, as well as message cycle fluctuations caused by aging of electronic components and changes in bus load rate. Ignore abnormal vehicle behaviors caused by physical factors or design reasons, and expose and highlight malicious attacks and harmful abnormal vehicle states.

This application adds an alarm record table function inside the vehicle firewall to store the alarms (or abnormalities) issued by the vehicle firewall and the scores for the alarms. This application also designs a method to score each alarm.

An alarm's score is calculated based on its consecutive occurrence over multiple ignition cycles, reflecting the alarm's persistence during vehicle operation. When the score of an alarm in the record table is greater than or equal to a threshold x, it can be judged that the alarm is triggered by abnormal behavior that continues to occur at a high frequency, and the on-board firewall will no longer generate and send the alarm.

The vehicle-mounted firewall reads the record table from the non-volatile memory into the memory every time the vehicle is powered on, and during the operation of the vehicle-mounted firewall, the vehicle-mounted firewall updates and maintains the record table in the memory. Before each vehicle is powered off, the vehicle-mounted firewall writes the alarm record table in the memory into non-volatile memory, overwriting the old alarm record table. Therefore, this application allows the vehicle-mounted firewall to maintain two alarm record tables: one in memory, used during operation; one in non-volatile memory, used to save the contents of the alarm record table when the vehicle is not running. The on-board firewall only modifies the alarm record table in the memory, and only overwrites and reads the record table in the non-volatile memory.

During each ignition cycle, that is, while the vehicle is running between the time the vehicle is powered on and the vehicle is powered off, the on-board firewall updates the score of each alarm in the alarm record table only once. If the score of an alarm increases during this ignition cycle, it will not be reduced; on the contrary, if the score of an alarm does not change before the vehicle is powered off, the score will be reduced at this time. Unless the score of an alarm exceeds the threshold x, the on-board firewall will no longer modify the score of this alarm.

In this scenario, if an alarm occurs at least once within an ignition cycle, the score of the abnormality is +2; otherwise, the score is -1. The detailed logic is described below:

1) If the score of an alarm in the alarm record table is greater than or equal to the threshold x, the score of the alarm will not be modified while the vehicle is powered off;

2) If an alarm occurs, and the alarm's score in the record table is greater than or equal to 1 and less than the threshold x, and the alarm's score has not been modified in this ignition cycle, its score + 2, And it will not be modified later in this ignition cycle;

3) If an alarm occurs, and the alarm's score in the record table is greater than or equal to 1 and less than or equal to the threshold x, and the alarm's score has been modified during this ignition cycle, there is no need to update the record table;

4) If the score corresponding to an alarm in the record table has not been modified when the vehicle is powered off, and the score of the alarm is greater than or equal to 1 and less than or equal to the threshold x, then the score will be -1;

5) If the score of an alarm is equal to or less than 0 after -1, delete the record of the alarm from the record table;

6) If the alarm record table does not have a record for the alarm, create a new alarm record, and the initial score of the alarm is 2.

Each time the on-board firewall compares the alarm record table before sending an alarm, the exception can be processed as follows based on the scores of each alarm in the alarm record table:

1) If the same alarm exists and the score is greater than or equal to the threshold x, no alarm reminder will be sent to the alarm;

2) The same alarm exists, and the score is greater than or equal to 1 and less than the threshold x, then an alarm reminder is sent to the alarm;

3) If the same alarm does not exist, a new record of the alarm will be created, with the corresponding initial score being 2.

In this embodiment, each time the vehicle is powered off, the updated initial alarm record table is stored in the non-volatile memory as a new initial alarm record table, so that the next time the vehicle is powered on, The initial alarm record table read in the non-volatile memory is the updated initial alarm record table, which makes the exception handling method of the vehicle firewall cyclic. In the system, harmful anomalies and harmless anomalies can be further distinguished through score accumulation, making the distinction between harmful anomalies and harmless anomalies more obvious, allowing the on-board firewall to update its own policies to reduce the false alarm rate without over-the-air downloading or refreshing.

Figure 5 is an exemplary structural block diagram of an exception handling device for a vehicle-mounted firewall according to an embodiment of the present application. The following is a detailed description of the exception handling device for a vehicle-mounted firewall according to an embodiment of the present application in conjunction with Figure 5. As shown in Figure 5, the vehicle-mounted firewall The exception handling device 100 includes a table reading module 11, a first scoring module 12, a second scoring module 13 and a judgment module 14.

The table reading module 11 is used to read the initial alarm record table when the entire vehicle is powered on. The initial alarm record table records historical anomalies and scores of the historical anomalies.

In one embodiment, the initial alarm record table may be stored in a non-volatile memory, and the historical anomalies recorded in the initial alarm record table may include both harmful anomalies and harmless anomalies.

Among them, the harmful anomaly may be maliciously attacked by hackers, and the harmless anomaly may be caused by vehicle network communication being inconsistent with design expectations due to factors such as fluctuations in the vehicle's own operating status, design and production errors, aging of electronic components, etc. Abnormal status.

The first scoring module 12 is configured to, when an exception is reported through the on-board firewall between the time the entire vehicle is powered on and the entire vehicle is powered off, score the reported exception once, and update the reported corresponding exception to the initial value. The score in the alarm record table.

In one of the embodiments, scoring the reported abnormality once may be to score the abnormality when the abnormality is reported for the first time during the period from when the entire vehicle is powered on to when the entire vehicle is powered off. If the abnormality is reported before the entire vehicle is powered off, If you report again, you will not be graded.

Further, scoring the reported exception once may be adding points to the reported exception.

In one embodiment, if the reported exception is a historical exception recorded in the initial alarm record table, the historical score of the exception in the initial alarm record table is obtained, and the historical score of the exception is added to this The score given this time is used as the updated score of the anomaly.

The second scoring module 13 is used to score the unreported historical anomalies once in the initial alarm record table between when the entire vehicle is powered on and when the entire vehicle is powered off, and Update the score of the corresponding anomaly that has not been reported in the initial alarm record table.

In one embodiment, the scoring sign for the unreported historical anomaly is opposite to the scoring sign for the reported anomaly.

In one embodiment, assigning a score to the historical anomaly that has not been reported may mean deducting points for the anomaly that has not been reported.

In this embodiment, since harmful exceptions may not be reported every time the car is powered on, and harmless exceptions have the characteristics of continuous occurrence, points are deducted for unreported exceptions to reflect unreported exceptions. Exceptions are more likely to be harmful exceptions.

In one of the embodiments, the second scoring module 13 scores the unreported historical anomaly with a scoring sign that is opposite to the scoring sign for the reported anomaly.

The determination module 14 is configured to determine that the corresponding anomaly is a harmful anomaly if the updated score of the anomaly is within a preset range; otherwise, determine that the corresponding anomaly is a harmless anomaly.

In one embodiment, the preset range may be an artificially set range. For example, when the updated score of the anomaly is greater than a preset threshold, the anomaly is judged to be a harmless anomaly. When the updated When the score of the subsequent anomaly is less than or equal to the threshold, the corresponding anomaly is determined to be a harmful anomaly. Further, anomalies judged to be harmful may be subjected to alarm processing, or anomalies with a score greater than the threshold may be deleted from the initial alarm record table.

In one embodiment, the first scoring module 12 includes:

An exception acquisition unit is used to acquire the abnormality reported during the period from when the entire vehicle is powered on to when the entire vehicle is powered off;

The first judgment unit is used to judge whether the initial alarm record table contains the reported exception. If so, add points to the reported exception when it is reported for the first time. Otherwise, add points to the reported exception. When the abnormality is reported for the first time, points will be added based on zero, and the reported abnormality and the score will be saved in the initial alarm record table.

In one embodiment, if the reported exception is not a historical exception recorded in the initial alarm record table, when the reported exception is saved in the initial alarm record table, the reported exception can be stored in the initial alarm record table. The score assigned is determined as the score recorded in the initial alarm record table for the anomaly.

In one embodiment, the second scoring module 13 includes:

The point reduction unit is used to deduct points for the unreported historical anomalies when there are historical anomalies that have not been reported in the initial alarm record table from when the entire vehicle is powered on to when the entire vehicle is powered off.

In this embodiment, the first scoring module 12 can be used to add points to the reported anomaly when it is reported for the first time. Correspondingly, the second scoring module 13 can be used to deduct points for unreported historical anomalies. to distinguish harmful anomalies from harmless anomalies.

In other embodiments, the first scoring module 12 can also deduct points for the reported anomaly when it is reported for the first time, and correspondingly, the second scoring module 13 can add points for unreported historical anomalies. , can also distinguish harmful anomalies from harmless anomalies.

This embodiment deducts points for unreported historical anomalies and adds points for reported anomalies, so as to widen the score between harmful anomalies and harmless anomalies, making it easier for the vehicle-mounted firewall to distinguish harmful anomalies from harmless anomalies.

In one embodiment, the exception handling device 100 of the vehicle firewall further includes:

The alarm module is used to alarm and remind the harmful abnormality when it is judged that the corresponding abnormality is a harmful abnormality;

A deletion module, configured to delete the harmless exception from the initial alarm record table when it is determined that the corresponding exception is a harmless exception.

In one embodiment, the table reading module 11 is specifically used to read the initial alarm record table from the non-volatile memory when the vehicle is powered on;

Further, the exception handling device 100 of the vehicle firewall also includes:

A storage module configured to store the updated initial alarm record table as a new initial alarm record table into the non-volatile memory when the vehicle is powered off.

The exception handling device of the vehicle-mounted firewall provided in this embodiment scores reported exceptions and unreported historical exceptions respectively. Through analysis, it can be learned that harmless exceptions have the characteristics of high frequency and continuous occurrence, while harmful exceptions do not. Due to this feature, when reporting exceptions and unreported historical exceptions are scored separately, the score is only scored once from when the entire vehicle is powered on to when the vehicle is powered off. No matter how many times the same exception is reported, the score will be scored. The anomaly is only scored once, so that the anomaly score recorded in the initial alarm record table has the ability to identify, and the final score for each anomaly can distinguish harmful anomalies from harmless anomalies.

Figure 6 is a structural block diagram of a vehicle-mounted firewall in an embodiment of the present application. For specific limitations on the exception handling device of the vehicle-mounted firewall, please refer to the limitations on the exception handling method of the vehicle-mounted firewall mentioned above, which will not be described again here. Each module in the above-mentioned exception handling device of the vehicle-mounted firewall may be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above modules can be embedded in or independent of the processor in the vehicle firewall in the form of hardware, or can be stored in the memory of the vehicle firewall in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

In one embodiment, a vehicle-mounted firewall is provided, the internal structure diagram of which can be shown in Figure 6 . The vehicle-mounted firewall includes a processor, a memory, a network interface, an output device, and an input device connected through a system bus. Among them, the processor of the vehicle-mounted firewall is used to provide computing and control capabilities. The memory of the vehicle-mounted firewall includes non-volatile storage media and internal memory. The non-volatile storage medium stores an operating system and a computer program, and is specifically used to store the initial alarm record table. This internal memory provides an environment for the execution of operating systems and computer programs in non-volatile storage media. The network interface of the vehicle firewall is used to communicate with external devices through a network connection. When the computer program is executed by the processor, it implements an exception handling method for the vehicle-mounted firewall.

In one embodiment, a vehicle-mounted firewall is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the exception handling of the vehicle-mounted firewall in the above embodiment is implemented. The steps of the method are, for example, steps 101 to 104 shown in Figure 1 . Alternatively, when the processor executes the computer program, the functions of each module/unit of the exception handling device of the vehicle-mounted firewall in the above embodiment are implemented, such as the functions of modules 11 to 14 shown in FIG. 5 . To avoid repetition, they will not be repeated here.

In one embodiment, a computer-readable storage medium is provided, with a computer program stored thereon. When the computer program is executed by a processor, the steps of the exception handling method of the vehicle-mounted firewall in the above embodiment are implemented, for example, as shown in Figure 1 Step 101 to step 104. Alternatively, when the computer program is executed by the processor, the functions of each module/unit of the exception handling device of the vehicle firewall in the above embodiment are realized, such as the functions of modules 11 to 14 shown in Figure 5 . To avoid repetition, they will not be repeated here.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage. In the media, when executed, the computer program may include the processes of the above method embodiments.

According to yet another aspect of the present application, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of the exception handling method of the vehicle-mounted firewall are implemented.

Any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and/or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Synchlink DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

Figure 7 is a schematic structural diagram of a car in an embodiment of the present application. As shown in Figure 7, the car includes the above-mentioned vehicle-mounted firewall.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above functional units and modules is used as an example. In actual applications, the above functions can be allocated to different functional units and modules according to needs. Module completion means dividing the internal structure of the device into different functional units or modules to complete all or part of the functions described above.

The above-described embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still implement the above-mentioned implementations. The technical solutions described in the examples are modified, or some of the technical features are equivalently replaced; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions in the embodiments of this application, and should be included in within the protection scope of this application.

Claims (10)

1. An exception handling method for a vehicle-mounted firewall, characterized in that the method includes: When the entire vehicle is powered on, the initial alarm record table is read, and the initial alarm record table records historical anomalies and scores of the historical anomalies; When an exception is reported through the vehicle firewall between the time the entire vehicle is powered on and the vehicle is powered off, the reported exception is scored once, and the score of the reported corresponding exception in the initial alarm record table is updated; When there are unreported historical anomalies in the initial alarm record table from when the entire vehicle is powered on to when the entire vehicle is powered off, score the unreported historical anomalies once and update the corresponding unreported anomalies in the table. the score in the initial alarm record table; If the updated score of the anomaly is within the preset range, the corresponding anomaly is determined to be a harmful anomaly; otherwise, the corresponding anomaly is determined to be a harmless anomaly. 2. The abnormality handling method of the vehicle-mounted firewall according to claim 1, characterized in that when an abnormality is reported through the vehicle-mounted firewall during the period from powering on the entire vehicle to powering off the entire vehicle, the abnormality reported is processed. The steps of scoring once and updating the score of the reported corresponding anomaly in the initial alarm record table include: Obtain the exception reported during the period from when the entire vehicle is powered on to when the entire vehicle is powered off; Determine whether the initial alarm record table contains the reported exception. If so, add points to the reported exception when it is reported for the first time. Otherwise, add points to the reported exception when it is reported for the first time. When reporting, an additional score is added based on zero, and the reported abnormality and the score are saved in the initial alarm record table. 3. The abnormality handling method of the vehicle-mounted firewall according to claim 1, characterized in that when there is an unreported historical abnormality in the initial alarm record table during the period from when the entire vehicle is powered on to when the entire vehicle is powered off, The steps for scoring the unreported historical anomalies include: When there are unreported historical anomalies in the initial alarm record table from when the entire vehicle is powered on to when the entire vehicle is powered off, points will be deducted once for the unreported historical anomalies. 4. The vehicle firewall exception handling method according to claim 1, characterized in that the method further includes: When the corresponding anomaly is judged to be a harmful anomaly, an alarm will be issued for the harmful anomaly; When it is determined that the corresponding exception is a harmless exception, the harmless exception is deleted from the initial alarm record table. 5. The abnormality handling method of the vehicle-mounted firewall according to any one of claims 1 to 4, characterized in that the step of reading the initial alarm record table when the entire vehicle is powered on includes: When the entire vehicle is powered on, the initial alarm record table is read from the non-volatile memory; When the entire vehicle is powered off, the updated initial alarm record table is stored in the non-volatile memory as a new initial alarm record table. 6. An exception handling device for a vehicle-mounted firewall, characterized in that the device includes: The table reading module is used to read the initial alarm record table when the entire vehicle is powered on. The initial alarm record table records historical anomalies and scores of the historical anomalies; The first scoring module is used to score an abnormality reported through the vehicle firewall during the period from when the entire vehicle is powered on to when the entire vehicle is powered off, and to update the reported corresponding abnormality in the initial alarm. Record the scores in the table; The second scoring module is used to score the unreported historical anomalies once and update them when there are unreported historical anomalies in the initial alarm record table from when the entire vehicle is powered on to when the entire vehicle is powered off. The score of the corresponding anomaly that has not been reported in the initial alarm record table; The judgment module is configured to judge the corresponding abnormality as a harmful abnormality if the updated score of the abnormality is within a preset range; otherwise, judge the corresponding abnormality as a harmless abnormality. 7. The vehicle firewall exception handling device according to claim 6, wherein the first scoring module includes: An exception acquisition unit is used to acquire the abnormality reported during the period from when the entire vehicle is powered on to when the entire vehicle is powered off; The first judgment unit is used to judge whether the initial alarm record table contains the reported exception. If so, add points to the reported exception when it is reported for the first time. Otherwise, add points to the reported exception. When the abnormality is reported for the first time, points will be added based on zero, and the reported abnormality and the score will be saved in the initial alarm record table. 8. The vehicle firewall exception handling device according to claim 6, wherein the second scoring module includes: The point reduction unit is used to deduct points for the unreported historical anomalies when there are historical anomalies that have not been reported in the initial alarm record table from when the entire vehicle is powered on to when the entire vehicle is powered off. 9. A vehicle-mounted firewall, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that when the processor executes the computer program, the processor implements the claims as claimed in The steps of the exception handling method for the vehicle-mounted firewall described in any one of 1 to 5. 10. A car, characterized in that the car includes a vehicle-mounted firewall as claimed in claim 9.