Intelligent network connection automobile penetration test path generation method and system based on knowledge graph

Abstract

The invention relates to the technical field of automobile network security, in particular to an intelligent networked automobile penetration test path generation method and system based on a knowledge graph, and the method comprises the steps: constructing an intelligent networked automobile intranet penetration test security knowledge graph through fusing multi-source heterogeneous data based on an intranet E / E architecture; generating a potential attack path based on the knowledge graph by using a depth-first search algorithm of dynamic pruning optimization; a multi-dimensional space-time risk assessment framework is utilized to quantify path threat intensity and execution feasibility, and quantitative assessment on the generated attack path is realized; and according to an evaluation result, selecting a high-risk and feasible attack path to carry out an actual penetration test, and discovering security vulnerabilities and weaknesses in the system. According to the method, the attack surface is fully covered, the high-value attack path is efficiently generated, the threat intensity and the execution feasibility are accurately and quantitatively evaluated, and the safety test efficiency and accuracy of the intelligent network connection automobile intranet are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of automotive network security technology, and in particular to a method and system for generating penetration test paths for intelligent connected vehicles based on a knowledge graph, which is suitable for path generation for penetration tests in modern in-vehicle networks (IVNs). Background Art

[0002] As the intelligentization process of intelligent connected vehicle technology accelerates, the in-vehicle network and the external network are deeply interconnected through heterogeneous protocol stacks, resulting in an exponential expansion of the attack surface and a significant increase in the complexity of security threat vectors and potential attack paths.

[0003] Research on penetration testing for automobiles is not yet mature, and early penetration test path generation technologies mainly focused on manual design methods based on expert experience. This type of method builds test cases through manual analysis of target systems (such as on-board ECUs and communication protocols) by security engineers, combined with known attack patterns (such as CAN bus replay and OTA firmware hijacking). Since manual design can achieve high-precision testing for specific vehicle models or protocols, this method is practical when the complexity of the in-vehicle network is relatively low. However, with the upgrade of the electronic architecture of intelligent connected vehicles, such as the introduction of domain controllers, traditional methods face bottlenecks such as low test coverage and slow response speeds, making it difficult to adapt to the multi-node, highly dynamic in-vehicle network environment.

[0004] Subsequently, the automated path generation technology based on rule engines gradually matured. This type of technology automatically derives potential attack paths (for example, the penetration chain from "unauthenticated diagnostic interface" to "ECU firmware extraction") through a predefined attack rule library and protocol state machine model. In this way, the test efficiency is significantly improved, and some unknown attack scenarios can be covered. However, this type of method relies heavily on the completeness of the rule library. When faced with new attack methods (such as AI adversarial sample attacks on in-vehicle infotainment systems) or complex protocol interactions (such as the authentication process under the SecOC security mechanism), the paths it generates often lack flexibility and adaptability.

[0005] Furthermore, path generation methods based on probabilistic models are beginning to be explored and applied. These methods utilize Markov decision processes (MDPs) or reinforcement learning (RL) to simulate attacker behavior and predict penetration paths through probabilistic state transitions. While theoretically capable of addressing path optimization in dynamic environments, model training requires a large amount of real-world attack data. The scarcity of vehicular network attack samples means that these methods face the dual challenges of data starvation and overfitting in practical deployments.

[0006] In summary, existing IoV penetration testing technologies each have their own strengths and weaknesses, but they still lack attack surface coverage and generation efficiency. Therefore, future research and development should focus on integrating multi-source data to build a comprehensive, dynamically addable empirical knowledge base, as well as efficient, dynamically adjustable path generation algorithms. Summary of the Invention

[0007] The present invention aims to address the shortcomings of existing intelligent connected vehicle penetration testing technologies, such as insufficient attack surface coverage, low generation efficiency, reliance on expert experience and rule bases, poor adaptability to new attacks, and model overfitting caused by data scarcity. A method and system for generating penetration testing paths for intelligent connected vehicles based on a knowledge graph is proposed. By constructing an intelligent connected vehicle penetration testing knowledge graph that integrates multi-dimensional security factors, combined with a dynamic pruning optimization algorithm and a multi-dimensional spatiotemporal risk assessment framework, the efficiency and speed of penetration testing are effectively improved, the threat intensity and execution feasibility of the attack chain are quantified, and a security testing and defense solution is provided for vehicle networks.

[0008] In order to achieve the above purpose, the technical solutions adopted are:

[0009] The present invention provides a method for generating a penetration test path for an intelligent connected vehicle based on a knowledge graph, comprising the following steps:

[0010] Based on the in-vehicle network E / E architecture, a security knowledge graph for penetration testing of intelligent connected vehicle in-vehicle networks is constructed by integrating multi-source heterogeneous data. The multi-source heterogeneous data fusion includes data integration across four test layers: protocol layer, application layer, system layer, and hardware layer.

[0011] Generate potential attack paths based on the knowledge graph using a depth-first search algorithm optimized by dynamic pruning;

[0012] A multi-dimensional spatiotemporal risk assessment framework is used to quantify the threat intensity and execution feasibility of the path, enabling quantitative evaluation of the generated attack path.

[0013] Based on the assessment results, high-risk and feasible attack paths are selected for actual penetration testing to discover security holes and weaknesses in the system.

[0014] According to the method for generating penetration test paths for intelligent connected vehicles based on knowledge graphs of the present invention, multi-source heterogeneous data fusion further includes data integration of the four-dimensional test surfaces of the protocol layer, application layer, system layer, and hardware layer, specifically including:

[0015] Analyze in-vehicle Ethernet protocols, bus protocols, wireless communication protocols, and private business protocols, and extract attack test surface data at the protocol layer;

[0016] Analyze business-related software, autonomous driving-related programs, UDS programs, vehicle control programs, vehicle-machine apps and control apps, and OTA software upgrades to extract attack test surface data at the application layer;

[0017] Analyze firmware, system ports, binary program functions and vulnerabilities, as well as sensitive files and important configuration files, to extract attack surface data at the system level;

[0018] Analyze chips, debug ports, serial ports, and firmware extraction to extract attack test surface data at the hardware layer.

[0019] According to the method for generating a penetration test path for an intelligent connected vehicle based on a knowledge graph of the present invention, further, the construction of the knowledge graph specifically includes:

[0020] Node construction: Import ECU, vehicle network, vehicle vulnerability, attack steps, defense measures, and vehicle permissions as nodes into the knowledge graph; the nodes contain "id", "name", "type", "location", "functions", "security_level", and "LABEL" attributes;

[0021] Relationship building: Establish network connection relationships, attack chain relationships, defense coverage relationships, and vulnerability exposure relationships between nodes.

[0022] According to the method for generating a penetration test path for an intelligent connected vehicle based on a knowledge graph of the present invention, further, the relationship construction includes the following association methods:

[0023] Network connection relationship: represents the network connection between node entities, including interface type, communication direction, network connection type and connection properties;

[0024] Attack chain relationship: Focuses on the relationship between attack steps and vulnerability exploitation, marking CVSS scores and tactical phase dependencies;

[0025] Defense coverage relationship: Form a complete attack-defense mapping relationship with the attack chain relationship, clarify the defense type, technical implementation and implementation difficulty;

[0026] Vulnerability exposure relationship: Build a mapping relationship between hardware assets and vulnerabilities, clarify the physical and logical exposure surfaces of the vulnerabilities, and mark the attack vectors, CVSS scores, and disclosure time.

[0027] According to the method for generating penetration test paths for intelligent connected vehicles based on knowledge graphs of the present invention, further, the depth-first search algorithm of dynamic pruning optimization includes:

[0028] Define the four-tuple state space S = (P, R acc ,P path ,dt ), where P is the node sequence of the current attack path, R acc is the cumulative risk value of the path, P path is the path reachability probability, d t is the time decay factor;

[0029] The search process is optimized by using depth constraint pruning, probabilistic feasibility pruning, risk prediction pruning and loop suppression mechanisms.

[0030] According to the method for generating penetration test paths for intelligent connected vehicles based on knowledge graphs of the present invention, the multi-dimensional spatiotemporal risk assessment framework further includes a comprehensive risk calculation model and a path reachability probability model:

[0031] Comprehensive risk calculation model:

[0032]

[0033] Among them, R total (P k ) represents the attack chain P k The comprehensive risk value, P k represents the effective attack path, v i represents the i-th node in the attack path, R base (v i ) represents node v i The basic risk value, c rel (e i-1,i ) represents edge e i-1,i The propagation coefficient, w a (v i ) represents node v i The asset weight, γ t represents the time decay rate, Indicates that the attack chain length is |P k Total attenuation factor when |

[0034] Path reachability probability model:

[0035]

[0036] Among them, P prob (P k ) represents the attack chain P k The path reachability probability, e ij Denotes attack step v i to v j The edge, c rel (e ij ) represents edge e ij The propagation coefficient of .

[0037] According to the method for generating penetration test paths for intelligent connected vehicles based on knowledge graphs of the present invention, further, the edge propagation coefficient is assigned according to the relationship type, including: a direct causal relationship coefficient of 0.85, an enabling key capability coefficient of 0.95, an auxiliary support coefficient of 0.75, and an attack accuracy working coefficient of 0.70.

[0038] According to the method for generating penetration test paths for intelligent connected vehicles based on knowledge graphs of the present invention, further, the asset weights are dynamically mapped according to the asset types, including: a remote communication and interface module weight of 1.5, an in-vehicle network and communication protocol weight of 1.6, an in-vehicle operating system and software weight of 1.3, a vehicle control unit weight of 1.4, and an external data and supply chain component weight of 1.0.

[0039] Furthermore, the present invention also provides a system for generating penetration test paths for intelligent connected vehicles based on a knowledge graph, which is used to implement the above-mentioned method for generating penetration test paths for intelligent connected vehicles based on a knowledge graph, comprising:

[0040] The knowledge graph construction module is used to build a security knowledge graph for penetration testing of the intelligent connected vehicle in-vehicle network based on the in-vehicle network E / E architecture by integrating multi-source heterogeneous data. The multi-source heterogeneous data fusion includes data integration across four test layers: protocol layer, application layer, system layer, and hardware layer.

[0041] The path generation module is used to generate potential attack paths based on the knowledge graph using a depth-first search algorithm optimized by dynamic pruning;

[0042] The risk assessment module is used to quantify the threat intensity and execution feasibility of the path using a multi-dimensional spatiotemporal risk assessment framework, thereby achieving a quantitative assessment of the generated attack path;

[0043] The penetration testing module is used to select high-risk and feasible attack paths for actual penetration testing based on the assessment results to discover security holes and weaknesses in the system.

[0044] The beneficial effects achieved by adopting the above technical solution are:

[0045] 1. Comprehensive attack surface coverage

[0046] The present invention constructs a comprehensive security knowledge graph for in-vehicle network penetration testing of intelligent connected vehicles by integrating multi-source heterogeneous data from four-dimensional test surfaces: protocol layer, application layer, system layer, and hardware layer. This multi-dimensional data integration can systematically identify cross-layer attack paths, effectively covering complex in-vehicle network attack surfaces, and solving the problem of insufficient attack surface coverage in existing technologies.

[0047] 2. Improve penetration testing efficiency

[0048] This paper uses a depth-first search algorithm optimized with dynamic pruning to generate potential attack paths based on a knowledge graph. Through deep constraint pruning, probabilistic feasibility pruning, risk prediction pruning, and loop suppression mechanisms, this algorithm significantly improves the efficiency of path generation, avoids inefficient searches, and addresses the low generation efficiency issues of existing technologies.

[0049] 3. Quantitatively evaluate attack paths

[0050] This paper combines a multi-dimensional spatiotemporal risk assessment framework to quantitatively evaluate generated attack paths. By integrating risk calculation models and path reachability probability models, it accurately quantifies the threat intensity and feasibility of attack chains, breaking through the limitations of traditional static risk assessments.

[0051] 4. Dynamic Update and Adaptability

[0052] This invention supports online updating of the knowledge graph, enabling the dynamic addition of new attack patterns, defense measures, and vulnerability information. This dynamic evolutionary capability enables the system to adapt to the rapidly changing network security environment and respond promptly to new attack methods, resolving the problem of poor adaptability to new attacks in existing technologies.

[0053] 5. Improve the accuracy of security testing

[0054] This method uses quantitative assessment to select high-risk yet feasible attack paths for actual penetration testing, enabling more accurate identification of security vulnerabilities and weaknesses in the system. This approach eliminates the traditional over-reliance on expert experience in penetration testing, improving test accuracy and reliability and addressing the limitations of existing technologies that rely on expert experience and rule bases.

[0055] In summary, this solution comprehensively improves the security testing and defense capabilities of the in-vehicle network of intelligent connected vehicles through innovative technical means, providing an effective solution to complex network security challenges. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings of the embodiments of the present invention. The drawings are only used to illustrate some embodiments of the present invention, but not to limit all embodiments of the present invention thereto.

[0057] Figure 1 This is a flow chart of a method for generating a penetration test path for an intelligent connected vehicle based on a knowledge graph according to an embodiment of the present invention;

[0058] Figure 2 This is a schematic diagram of the in-vehicle network E / E architecture according to an embodiment of the present invention;

[0059] Figure 3This is an example diagram of knowledge graph node construction according to an embodiment of the present invention;

[0060] Figure 4 This is an example diagram of a network connection relationship according to an embodiment of the present invention;

[0061] Figure 5 This is an example diagram of the defense coverage relationship of an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The following will be combined with the accompanying drawings of specific embodiments of the present invention to clearly and completely describe the exemplary embodiments of the present invention. Unless otherwise defined, technical or scientific terms used in the present invention should be given the common meanings understood by people with ordinary skills in the relevant field.

[0063] This embodiment discloses a method for generating penetration test paths for intelligent connected vehicles based on a knowledge graph. It aims to construct a penetration test knowledge graph for intelligent connected vehicles that integrates multi-dimensional security factors through the vulnerability characteristics of the vehicle's internal network and the fusion of multi-source data. Then, based on a depth-first search algorithm optimized by dynamic pruning and a multi-dimensional spatiotemporal risk assessment framework, it effectively quantifies the threat intensity and execution feasibility of the attack chain. This solution abandons the limitations of knowledge and experience in the traditional penetration test process, improves the efficiency and speed of penetration testing, and provides a security testing and defense solution for vehicle networks. Figure 1 As shown, the method specifically includes the following steps:

[0064] Step S101: Based on the in-vehicle network E / E architecture, a security knowledge graph for penetration testing of the in-vehicle network of intelligent connected vehicles is constructed by integrating multi-source heterogeneous data such as electronic control units (ECUs), networks, communication protocols, vulnerabilities, attack techniques and defenses. The multi-source heterogeneous data fusion includes data integration on four test planes: protocol layer, application layer, system layer and hardware layer.

[0065] In the evolution of intelligent connected vehicle electronic and electrical architecture, the current mainstream technology paths can be divided into three paradigms: distributed architecture, domain-controlled architecture, and regional architecture. Among them, the domain-controlled architecture has the advantages of functional domain decoupling and resource concentration. The in-vehicle network E / E architecture under this architecture is as follows: Figure 2 As shown in Figure 2, multi-level security research on the in-vehicle network attack test surface of intelligent connected vehicles can be carried out based on a layered model to conduct a systematic security assessment. The following details the attack test surface in four core dimensions: protocol layer, application layer, system layer, and hardware layer.

[0066] (1) Protocol layer test surface

[0067] The protocol layer is a key architectural layer for in-vehicle network attack testing, and its security analysis is directly related to the stability and security of internal vehicle communications. When analyzing in-vehicle Ethernet protocols, in addition to using Wireshark to capture and analyze data packets, it's also important to pay attention to the real-time performance assurance mechanisms of the Time-Sensitive Networking (TSN) protocol. For example, in the transmission of high-definition video streams between an onboard camera and an autonomous driving domain controller, flaws in the TSN protocol can cause image delays or frame drops, potentially impacting autonomous driving decisions. Regarding bus protocol diagnostics, the CAN bus is a key focus due to its widespread use within vehicles. CANoe not only simulates communications but also tests abnormal responses of vehicle ECUs (electronic control units) by injecting error frames. Hackers have exploited CAN bus protocol vulnerabilities to remotely control vehicle braking systems, highlighting the importance of error handling mechanisms in diagnostic protocols. When analyzing wireless communication protocols, the Bluetooth pairing and authentication process carries the risk of man-in-the-middle attacks. Aircrack-ng can capture Bluetooth handshake packets and brute-force crack the pairing password. When analyzing proprietary service protocols, some automakers' customized telematics protocols may fail to effectively encrypt communication data, potentially leaking sensitive information such as vehicle location and driving trajectory.

[0068] (2) Application layer test surface

[0069] The application layer plays a central role in in-vehicle network attack testing. Various applications directly impact vehicle functionality and user experience, making their security paramount. In business-related software analysis, vehicle infotainment systems often lack strict access control for external devices, allowing malicious USB devices to inject viruses through the vehicle's USB ports, damaging the system or stealing user privacy. Checkmarx and AppScan effectively detect such code logic vulnerabilities. In autonomous driving program analysis, MATLAB Simulink can simulate scenarios such as extreme weather and complex road conditions to test the autonomous driving algorithm's ability to handle unexpected situations. Algorithm flaws could potentially cause a collision in certain scenarios. In UDS program analysis, Vehicle Spy can perform fuzz testing on diagnostic services, for example, by sending a large number of malformed diagnostic requests to the ECU to test for vulnerabilities such as buffer overflows that could be exploited by hackers to gain control of the vehicle. In vehicle control program analysis, IDA Pro reverse engineering revealed hardcoded passwords in the electronic power steering program of some older models, allowing hackers to crack the passwords and tamper with steering commands. When analyzing in-car apps and vehicle control apps, MobSF detected that some apps used plaintext communication during data transmission and failed to perform secondary authentication of user identities, making user accounts vulnerable to theft and remote vehicle control. During OTA software upgrade analysis, if Binwalk parsed the upgrade package and found missing signature verification, hackers could tamper with the upgrade file, insert malicious code, and take control of the entire vehicle system during the upgrade.

[0070] (3) System layer test surface

[0071] System-level attack testing is crucial for ensuring the secure operation of in-vehicle networks. The firmware, ports, programs, and files involved are crucial for vehicle system stability. During firmware analysis, firmware extracted by Binwalk may contain undisclosed debugging interfaces. Reverse engineering with IDA Pro can exploit these interfaces to bypass security mechanisms. For example, the dashboard firmware of a certain brand of vehicle contained an unclosed debugging port, allowing attackers to modify mileage data. During system port analysis, Nmap scanning revealed that some vehicles have open SSH ports by default. If administrators fail to change the default password, hackers can use brute force logins to gain system control. For binary program function and vulnerability analysis, Ghidra can decompile complex ECU programs. Researchers previously used Ghidra to discover a stack overflow vulnerability in the startup routine of an ECU, potentially leading to a denial of service. When analyzing sensitive files and important configuration files, if access permissions are not set for configuration files obtained through FileZilla, hackers can modify the vehicle's network configuration parameters, allowing the vehicle to connect to malicious networks and upload and download malicious files.

[0072] (4) Hardware layer test surface

[0073] Hardware-layer attack testing is a fundamental line of defense for in-vehicle network security testing, directly impacting the security and reliability of the vehicle's underlying hardware. During chip analysis, a logic analyzer monitors chip signal transmissions and can reveal timing leaks when processing encrypted data. By analyzing signal timing variations, attackers can decrypt encryption keys. During debug port analysis, the JTAGulator detects that the vehicle ECU's JTAG port is not physically protected, allowing hackers to access and modify the chip's internal program code. During serial port analysis, PuTTY connects to the vehicle's debug serial port. If serial communication is not authenticated, attackers can send malicious commands to the serial port, disrupting the vehicle's electronic systems. Regarding firmware extraction, when Flashrom retrieves firmware from hardware, if the hardware does not encrypt the firmware storage area, hackers can easily extract the firmware, analyze sensitive information, make malicious modifications, and then re-flash it into the hardware, disrupting vehicle functionality.

[0074] To integrate relevant knowledge graph data, vulnerability information, attack tactics, defense information, and vehicle ECU and protocol information were extracted from the NVD standardized vulnerability information database and the MITRE ATT&CK standardized cybersecurity attack and defense knowledge base. Data processing specifically includes two steps: multi-level screening and attack-defense correlation.

[0075] ①Multi-level screening

[0076] Multi-level screening involves layered filtering and matching of heterogeneous data from multiple sources (such as vulnerability libraries, attack tactics, and vehicle protocols) when building a security knowledge graph. This process extracts only information that is strongly relevant to in-vehicle network penetration testing, avoiding noise interference. This process achieves precise screening through a triple filtering mechanism: keyword matching, protocol feature detection, and domain feature verification.

[0077] First, the tactical nodes, attack techniques and defense measures of the in-vehicle network in the database are extracted based on the multi-condition matching feature. The input text T is first passed through the keyword matching layer based on the predefined keyword set K = {k1,…,k n} (such as CAN bus, ECU), detect existence. Then enter the protocol feature detection layer, using the protocol regular set P = {p1, ..., p m} (e.g., \bcan\b matches the CAN protocol) for pattern recognition. Finally, through the domain feature verification layer, the intersection of the domain word set D = {d1, d2} (e.g., vehicle) and T is checked. If multiple matching results meet one of the criteria, they can be determined as relevant text. The triple filtering mechanism can be expressed using the following three formulas.

[0078]

[0079] ②Attack and Defense Association

[0080] The bipartite graph model G = (V, E) is constructed through the defense measure association algorithm to achieve the topological association between attack techniques and defense measures. The vertex set V consists of two types of mutually exclusive nodes, and the technology node set V T ={t1,t2,...,t m} represents the attack technology item in MITRE ATT&CK, and the defense node set V D ={d1,d2,...,d n} corresponds to security control measures in standards such as NIST SP 800-53. The edge set E generates directed edges through the predicate function Mitigates(d, t), and establishes a connection if and only if the defense measure d can effectively mitigate the technology t (for example, a firewall rule can block a specific vulnerability exploit chain).

[0081] The construction process of the knowledge graph is as follows:

[0082] (1) Node construction

[0083] Knowledge graphs are designed to describe various entities or concepts that exist in the real world and reveal the relationships between them. By structuredly integrating multi-source heterogeneous data from the Internet of Vehicles (IoV), such as ECUs, vulnerabilities, and defenses, and building an entity relationship network, we can systematically identify cross-layer attack paths and optimize the prioritization of penetration testing scenarios.

[0084] Neo4j is an open source graph database implemented in Java. You can use the LOAD CSV command to import data from CSV files into the database. Each line represents the data of a node, and the field values are separated by commas. When analyzing the attack test surface and extracting data, the vulnerability, ECU node, protocol, attack tactics, and defense information are highly integrated and associated to generate a CSV file, such as Figure 3 The LOAD statement can construct the structured CSV file into nodes, so that the nodes contain "id", "name", "type", "location", "functions", "security_level" and "LABEL" attributes.

[0085] Because complete attribute information is imported along with ECU node information, the resulting ECU node information comprehensively covers all relevant information and can be queried using MATCH queries. Vehicle vulnerabilities, defenses, vehicle networks, vehicle permissions, and attack steps are then imported as nodes in the same order as above, yielding all nodes in the knowledge graph.

[0086] (2) Relationship building

[0087] A relationship can be formed between two node entities. In this solution, a total of five relationships are constructed.

[0088] "network_connections" represents network connection relationships. For example, the ECU with ID 001 is connected to the power CAN bus. Each relationship is established with interface, direction, TYPE and properties attributes, which describe information such as connection lines and interfaces, two-way or one-way communication, physical connection or logical connection.

[0089] "Attackchain" represents the attack chain relationship. It not only focuses on the relationship between attack steps and vulnerability exploitation, providing specific attack methods and vulnerability CVSS scores, but also describes the logical connection and stage evolution between attack steps, revealing the dependencies and tactical flow of steps in the attack chain. The two are linked through ATK-ID, providing technical details of attack nodes, building dynamic links between attack steps, and forming a complete threat modeling framework.

[0090] "Defendcover" represents a complete attack-defense mapping between defense coverage and the "Attackchain." Defense nodes detail specific protections against attack steps and vulnerabilities (such as AES encryption and quantum communication security), clearly defining the defense type, technical implementation, and implementation difficulty. This directly corresponds to the attack chain: each defense measure precisely intercepts the attack steps and exploited vulnerabilities in the "Attackchain," forming a three-dimensional "attack-vulnerability-defense" matrix.

[0091] "EXPOSURE" represents vulnerability exposure relationships, clearly defining the physical and logical exposure areas of a vulnerability. Each record is annotated with a specific attack vector (e.g., "OBD-II physical access," "LIN bus injection"), a CVSS score, and a disclosure date. These complement the attack chain relationship: "EXPOSURE" locates the hardware location of the vulnerability, while "Attackchain" describes the attack steps that exploit these vulnerabilities, jointly supporting attack path tracing and prioritizing critical asset protection.

[0092] The constructed "network_connections" and "Defendcover" relationships are as follows: Figure 4 、 5 shown.

[0093] Step S102: Generate potential attack paths based on the knowledge graph using a depth-first search algorithm optimized by dynamic pruning.

[0094] (1) Constructing an enhanced graph structure

[0095] Enhanced graph structure modeling is based on the directed graph G = (V, E) to formally represent the attack chain topology, and its node and edge attributes are semantically enhanced through multi-dimensional features. Each node v in the node set V i Contains dual attribute characteristics: core risk quantitative indicator R base (v i ) Directly maps the vulnerability CVSS scoring system standardized output value cvss(v i ), reflecting the inherent threat intensity of the attack step; asset type weight coefficient w a (v i ) is dynamically mapped according to the preset asset type weight table as shown in Table 1, which is used to characterize the differential amplification effect of different asset categories on risk transmission. ij Define the causal relationship between attack steps, whose attributes include binary features: relationship type label t(e ij ) Explicitly mark the logical pattern between attack behaviors (such as 'leads_to' represents direct causal relationship, 'enables' represents conditional enabling relationship), the propagation intensity coefficient c rel (e ij ) Through the preset relationship type mapping table such as Table 2, quantitative assignment is performed to accurately determine the impact weight of different types of customer relationships on the probability transmission of the attack chain.

[0096] Table 1 Asset Type Weight Table

[0097] Asset Type Weight Setting basis Remote communication and interface modules 1.5 T-Box module, Bluetooth / Wi-Fi module, etc. In-vehicle network and communication protocols 1.6 CAN bus, automotive Ethernet, etc. In-vehicle operating systems and software 1.3 Linux in-vehicle OS, infotainment system Vehicle Control Unit 1.4 ECU firmware, sensors, actuators External data and supply chain components 1.0 Third-party in-vehicle applications, hardware supplier firmware

[0098] Table 2 Relationship type mapping table

[0099]

[0100]

[0101] (2) Dynamic pruning

[0102] The depth-first search algorithm for dynamic pruning optimization adopts a non-recursive iterative framework based on a stack data structure, and its state space is represented by S=(P,R acc ,P path ,d t ) is formally defined, where P is the node sequence of the current attack path, recording the topological execution order of the attack steps; R acc The cumulative risk value of the path is quantified by linearly superimposing the local risk of each node after the relationship propagation coefficient and asset weight are corrected; P path is the path reachability probability, which is dynamically calculated by the continuous product of the propagation coefficients of the path edge set; d t is the time decay factor, using a discretized exponential decay model Simulate the attenuation effect of the attack chain's timeliness on the comprehensive evaluation value. The pruning strategy optimizes computational efficiency through multi-dimensional constraints, including depth constraint pruning, probabilistic feasibility pruning, risk prediction pruning, and loop suppression mechanisms:

[0103]

[0104] Among them, max is the maximum path exploration depth. For example, if max=10, when the path length exceeds this value, further search is stopped, which limits the maximum length of the search path and avoids the increase in computational complexity caused by too deep paths. p is the preset threshold of path reachability probability (θ p =0.05), if the current path is reachable with probability P path <θ p , determines that the possibility of the actual execution of this path is extremely low, and immediately terminates the subsequent node traversal. pred Predicting risk for forward-looking expansion nodes, θ R is the risk threshold (θ R =0.5), when R pred =(R acc +ΔR)·d t γ t <0.5θ R , discard low-risk branches, where R acc is the accumulated risk value of the current path, ΔR is the incremental risk of the node to be expanded, is the total attenuation factor when the path length is |P|, γ t This represents the time decay rate (fixed value 0.93), which represents the exponential decay coefficient of the risk or success probability over time during the execution of the attack chain. The loop suppression mechanism prevents loops by recording visited nodes to avoid endless loops or repeated visits to the same node during the search process.

[0105] The research also supports the expansion of nodes and relationships. The risk propagation model iteratively updates the state parameters through the following rules. When the expanded node v j Update parameters when:

[0106] ΔR=R base (v j )·c rel (e ij )·w a (v j )

[0107] R′ acc =R acc +ΔR

[0108] P′ path =Ppath c rel (e ij )

[0109] d′ t =d t γ t (γ t =0.93)

[0110] Step S103: Quantify the path threat intensity and execution feasibility using a multi-dimensional spatiotemporal risk assessment framework to achieve a quantitative assessment of the generated attack path.

[0111] Through the multi-dimensional spatiotemporal risk assessment framework, the attack chain P k The threat intensity and execution feasibility are jointly analyzed, and the effective path P k The comprehensive risk value R total (P k ) Using the node risk linear accumulation and dynamic attenuation product model, the path reachability probability P prob (P k ) is modeled by the joint constraints of the conduction probability multiplication and time attenuation, and the formulas are:

[0112]

[0113] Among them, R total (P k ) represents the attack chain P k The comprehensive risk value, P k represents the effective attack path, v i represents the i-th node in the attack path, R base (v i ) represents node v i The basic risk value, c rel (e i-1,i ) represents edge e i-1,i The propagation coefficient, w a (v i ) represents node v i The asset weight, γ t represents the time decay rate, Indicates that the attack chain length is |P k The total attenuation factor when |

[0114]

[0115] Among them, P prob (P k ) represents the attack chain P k The path reachability probability, e ij Denotes attack step v i to vj The edge, c rel (e ij ) represents edge e ij The propagation coefficient of .

[0116] On the effective path P k The comprehensive risk value R total (P k ) Node Basic Risk R base (v i ) Based on CVSS score, the propagation coefficient c rel (e i-1,i ) reflects the transmission efficiency of the causal relationship between steps, and the asset weight w a (v i ) Strengthen the threat amplification effect of key assets, time decay Simulate the inhibitory effect of attack chain timeliness on cumulative risk. proh (P k ) where the continuous product term describes the dependence of the transition probabilities between attack steps, and the attenuation term quantifies the negative impact of the execution time window compression on the success rate. Together, the two construct a spatiotemporal dynamic framework for attack chain feasibility assessment.

[0117] Step S104: Based on the evaluation results, select high-risk and feasible attack paths to conduct actual penetration testing. These tests can help discover security holes and weaknesses in the system and provide a basis for subsequent security reinforcement.

[0118] Corresponding to the above method, this embodiment also discloses a system for generating penetration test paths for intelligent connected vehicles based on a knowledge graph, the system comprising:

[0119] The knowledge graph construction module is used to build a security knowledge graph for penetration testing of the in-vehicle network of intelligent connected vehicles based on the in-vehicle network E / E architecture by integrating multi-source heterogeneous data. The multi-source heterogeneous data fusion includes data integration on four-dimensional testing surfaces: protocol layer, application layer, system layer and hardware layer.

[0120] The path generation module is used to generate potential attack paths based on the knowledge graph using a depth-first search algorithm optimized by dynamic pruning.

[0121] The risk assessment module is used to quantify the threat intensity and execution feasibility of the path using a multi-dimensional spatiotemporal risk assessment framework, and to achieve quantitative evaluation of the generated attack path.

[0122] The penetration testing module is used to select high-risk and feasible attack paths for actual penetration testing based on the assessment results to discover security holes and weaknesses in the system.

[0123] This embodiment also discloses a computer-readable storage medium storing a computer program, which implements the above method when executed by a processor.

[0124] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A method for generating penetration test paths for intelligent connected vehicles based on knowledge graphs, characterized in that: The following steps are involved: Based on the in-vehicle network E / E architecture, a security knowledge graph for penetration testing of intelligent connected vehicle in-vehicle networks is constructed by integrating multi-source heterogeneous data. The multi-source heterogeneous data fusion includes data integration across four test layers: protocol layer, application layer, system layer, and hardware layer. Generate potential attack paths based on the knowledge graph using a depth-first search algorithm optimized by dynamic pruning; A multi-dimensional spatiotemporal risk assessment framework is used to quantify the threat intensity and execution feasibility of the path, enabling quantitative evaluation of the generated attack path. Based on the assessment results, high-risk and feasible attack paths are selected for actual penetration testing to discover security holes and weaknesses in the system.

2. The method for generating penetration test paths for intelligent connected vehicles based on knowledge graph according to claim 1 is characterized in that: Multi-source heterogeneous data fusion includes data integration on the protocol layer, application layer, system layer and hardware layer, specifically including: Analyze in-vehicle Ethernet protocols, bus protocols, wireless communication protocols, and private business protocols, and extract attack test surface data at the protocol layer; Analyze business-related software, autonomous driving-related programs, UDS programs, vehicle control programs, vehicle-machine apps and control apps, and OTA software upgrades to extract attack test surface data at the application layer; Analyze firmware, system ports, binary program functions and vulnerabilities, as well as sensitive files and important configuration files, to extract attack surface data at the system level; Analyze chips, debug ports, serial ports, and firmware extraction to extract attack test surface data at the hardware layer.

3. The method for generating penetration test paths for intelligent connected vehicles based on knowledge graph according to claim 1 is characterized in that: The construction of the knowledge graph specifically includes: Node construction: Import ECU, vehicle network, vehicle vulnerability, attack steps, defense measures, and vehicle permissions as nodes into the knowledge graph; the nodes contain "id", "name", "type", "location", "functions", "security_level", and "LABEL" attributes; Relationship building: Establish network connection relationships, attack chain relationships, defense coverage relationships, and vulnerability exposure relationships between nodes.

4. The method for generating penetration test paths for intelligent connected vehicles based on knowledge graph according to claim 3 is characterized in that: The relationship building includes the following association methods: Network connection relationship: represents the network connection between node entities, including interface type, communication direction, network connection type and connection properties; Attack chain relationship: Focuses on the relationship between attack steps and vulnerability exploitation, marking CVSS scores and tactical phase dependencies; Defense coverage relationship: Form a complete attack-defense mapping relationship with the attack chain relationship, clarify the defense type, technical implementation and implementation difficulty; Vulnerability exposure relationship: Build a mapping relationship between hardware assets and vulnerabilities, clarify the physical and logical exposure surfaces of the vulnerabilities, and mark the attack vectors, CVSS scores, and disclosure time.

5. The method for generating penetration test paths for intelligent connected vehicles based on knowledge graph according to claim 1, characterized in that: The depth-first search algorithm of the dynamic pruning optimization includes: Define the four-tuple state space S = (P, R acc ,P path ,d t ), where P is the node sequence of the current attack path, R acc is the cumulative risk value of the path, P path is the path reachability probability, d t is the time decay factor; The search process is optimized by using depth constraint pruning, probabilistic feasibility pruning, risk prediction pruning and loop suppression mechanisms.

6. The method for generating penetration test paths for intelligent connected vehicles based on knowledge graph according to claim 1, characterized in that: The multi-dimensional spatiotemporal risk assessment framework includes a comprehensive risk calculation model and a path reachability probability model: Comprehensive risk calculation model: Among them, R total (P k ) represents the attack chain P k The comprehensive risk value, P k represents the effective attack path, v i represents the i-th node in the attack path, R base (v i ) represents node v i The basic risk value, c rel (e i-1,i ) represents edge e i-1,i The propagation coefficient, w a (v i ) represents node v i The asset weight, γ t represents the time decay rate, Indicates that the attack chain length is |P k Total attenuation factor when | Path reachability probability model: Among them, P prob (P k ) represents the attack chain P k The path reachability probability, e ij Denotes attack step v i to v j The edge, c rel (e ij ) represents edge e ij The propagation coefficient of .

7. The method for generating penetration test paths for intelligent connected vehicles based on knowledge graph according to claim 6 is characterized in that: The edge propagation coefficient is assigned according to the relationship type, including: direct causal relationship coefficient 0.85, key capability activation coefficient 0.95, auxiliary support coefficient 0.75, and attack accuracy coefficient 0.

70.

8. The method for generating penetration test paths for intelligent connected vehicles based on knowledge graph according to claim 6 is characterized in that: The asset weights are dynamically mapped based on the asset type, including: remote communication and interface module weight 1.5, vehicle network and communication protocol weight 1.6, vehicle operating system and software weight 1.3, vehicle control unit weight 1.4, and external data and supply chain component weight 1.

0.

9. A knowledge graph-based intelligent connected vehicle penetration test path generation system, characterized in that: A method for generating a penetration test path for an intelligent connected vehicle based on a knowledge graph according to any one of claims 1 to 8, comprising: The knowledge graph construction module is used to build a security knowledge graph for penetration testing of the intelligent connected vehicle in-vehicle network based on the in-vehicle network E / E architecture by integrating multi-source heterogeneous data. The multi-source heterogeneous data fusion includes data integration across four test layers: protocol layer, application layer, system layer, and hardware layer. The path generation module is used to generate potential attack paths based on the knowledge graph using a depth-first search algorithm optimized by dynamic pruning; The risk assessment module is used to quantify the threat intensity and execution feasibility of the path using a multi-dimensional spatiotemporal risk assessment framework, thereby achieving a quantitative assessment of the generated attack path; The penetration testing module is used to select high-risk and feasible attack paths for actual penetration testing based on the assessment results to discover security holes and weaknesses in the system.

10. A computer-readable storage medium storing a computer program, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images