Quantitative analysis method for integrated safety risks of intelligent connected vehicles

Abstract

The present invention discloses a quantitative analysis method for the integrated safety risk of intelligent networked vehicles, which belongs to the field of intelligent networked vehicles. The method includes: based on the abstract model of each system, confirming the integrated safety attribute value and integrated safety analysis matrix of the functional safety, expected functional safety and information security of each system to determine the analysis priority of each system; for each target system analyzed in turn according to the analysis priority, the following are performed: evaluating the triggering risk coefficient of each unsafe behavior; determining the corresponding relationship table between unsafe behaviors and dangerous scenarios, and respectively determining the dangerous scenario exposure rate, risk controllability and risk accident severity of each unsafe behavior in each dangerous scenario; based on the triggering risk coefficient, dangerous scenario exposure rate, risk controllability and risk accident severity of each unsafe behavior, calculating the integrated safety risk value corresponding to the current target system. This scheme can realize the integrated quantitative evaluation of three types of safety risks.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent networked vehicles, and in particular to a quantitative analysis method for the fusion safety risks of intelligent networked vehicles. Background Art

[0002] With the continuous advancement of intelligent connected vehicle technology, safety considerations have become increasingly in-depth and have become a key topic in this field. Driven by the intelligence and networking of automobiles, the safety of future automobiles is not limited to collision protection, but also extends to functional safety, expected functional safety, and information security. These aspects not only cover the entire stage of vehicle operation, but also constitute the three key dimensions of intelligent connected vehicle safety, which are interdependent and closely related.

[0003] However, existing safety analysis methods are often conducted relatively independently, and a safety risk analysis method for intelligent connected vehicles that comprehensively considers functional safety, expected functional safety, and information security has not yet been formed, resulting in the safety risk analysis results being not comprehensive and reliable. Therefore, a new quantitative analysis method for the integrated safety risks of intelligent connected vehicles is urgently needed. Summary of the invention

[0004] The present invention provides a quantitative analysis method for the fusion safety risk of intelligent connected vehicles, which can solve the problem that the existing safety risk analysis method does not comprehensively consider functional safety, expected functional safety and information security, so that the fusion safety analysis results are not comprehensive and reliable. The technical solution is as follows:

[0005] On the one hand, a quantitative analysis method for the fusion safety risk of an intelligent connected vehicle is provided, the method comprising:

[0006] Based on the pre-established abstract models of each system of the intelligent connected vehicle, the functional safety attribute value, expected functional safety attribute value and information security attribute value of each system are respectively confirmed to calculate the fused safety attribute value and fused safety analysis matrix of each system respectively, and the analysis priority of each system is determined based on the fused safety attribute value;

[0007] For each target system whose fusion security attribute value is non-zero and is analyzed in sequence based on the analysis priority, the following is executed:

[0008] Based on the abstract model of the current target system and the fusion safety analysis matrix, evaluating the triggering risk coefficient of each unsafe behavior;

[0009] Determine the corresponding relationship table between unsafe behaviors and dangerous scenarios, and respectively determine the dangerous scenario exposure rate, risk controllability and risk accident severity of each unsafe behavior in each dangerous scenario;

[0010] Based on the trigger risk coefficient of each unsafe behavior, the dangerous scene exposure rate corresponding to each unsafe behavior in each dangerous scene, the risk controllability and the severity of the risk accident, the fusion safety risk value corresponding to the current target system is calculated.

[0011] On the other hand, a device for quantitatively analyzing the fusion safety risk of an intelligent connected vehicle is provided, the device comprising:

[0012] An analysis module, for respectively confirming the functional safety attribute value, expected functional safety attribute value and information security attribute value of each system based on the pre-established abstract model of each system of the intelligent connected vehicle, so as to respectively calculate the fused safety attribute value and fused safety analysis matrix of each system, and determine the analysis priority of each system based on the fused safety attribute value;

[0013] An evaluation module, for each target system whose fused safety attribute value is non-zero and is analyzed in sequence based on the analysis priority, performs: based on the abstract model of the current target system and the fused safety analysis matrix, evaluating the triggering risk coefficient of each unsafe behavior;

[0014] A determination module is used to determine the correspondence table between unsafe behaviors and dangerous scenarios, and to determine the dangerous scenario exposure rate, risk controllability and risk accident severity corresponding to each unsafe behavior in each dangerous scenario;

[0015] The calculation module is used to calculate the fused safety risk value corresponding to the current target system based on the trigger risk coefficient of each unsafe behavior, the dangerous scene exposure rate corresponding to each unsafe behavior in each dangerous scene, the risk controllability and the severity of the risk accident.

[0016] On the other hand, a computer device is provided, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of the above-mentioned method.

[0017] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned method are implemented.

[0018] On the other hand, a computer program product is provided, comprising a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0019] The technical solution provided by the present invention can at least bring the following beneficial effects:

[0020] Through the integrated safety attribute values ​​of each system, the analysis priority of the system can be determined, so as to give priority to the analysis and optimization of integrated safety risks for systems with greater integrated safety issues, so as to map the three different types of safety risks, namely functional safety, expected functional safety and information security, to unsafe behaviors at the vehicle level, thus achieving an integrated quantitative assessment of the three types of safety risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 It is a flow chart of a method for evaluating the fusion safety controllability of intelligent connected vehicles provided by an embodiment of the present invention;

[0023] Figure 2 It is an abstract modeling framework diagram provided by an embodiment of the present invention;

[0024] Figure 3 It is a structural diagram of an evaluation device for integrated safety and controllability of intelligent networked vehicles provided by an embodiment of the present invention;

[0025] Figure 4 It is a hardware architecture diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0027] The specific implementation of the above concept is described below.

[0028] Please refer to Figure 1 , an embodiment of the present invention provides a quantitative analysis method for the fusion safety risk of an intelligent connected vehicle, the method comprising:

[0029] Step 100, based on the pre-established abstract models of each system of the intelligent connected vehicle, respectively confirm the functional safety attribute value, expected functional safety attribute value and information security attribute value of each system, respectively calculate the fusion safety attribute value and fusion safety analysis matrix of each system, and determine the analysis priority of each system based on the fusion safety attribute value;

[0030] Step 102, for each target system whose fusion safety attribute value is non-zero and analyzed in sequence based on the analysis priority, the following are performed: based on the abstract model of the current target system and the fusion safety analysis matrix, the triggering risk coefficient of each unsafe behavior is evaluated;

[0031] Step 104, determining a correspondence table between unsafe behaviors and dangerous scenarios, and respectively determining the dangerous scenario exposure rate, risk controllability, and risk accident severity corresponding to each unsafe behavior in each dangerous scenario;

[0032] Step 106, based on the trigger risk coefficient of each unsafe behavior, the dangerous scene exposure rate corresponding to each unsafe behavior in each dangerous scene, the risk controllability and the severity of the risk accident, calculate the fusion safety risk value corresponding to the current target system.

[0033] In an embodiment of the present invention, the analysis priority of the system can be determined through the fusion safety attribute value of each system, so as to give priority to the analysis and optimization of the fusion safety risk of the system with greater fusion safety issues, so as to map the three different types of safety risks, namely functional safety, expected functional safety and information security, to unsafe behaviors at the vehicle level, thereby realizing the fusion quantitative evaluation of the three types of safety risks.

[0034] Described below Figure 1 How the various steps are performed.

[0035] For step 100:

[0036] In some implementations, the fused security attribute value and fused security analysis matrix of each system are determined by the following steps S1-S5:

[0037] Step S1, analyzing and confirming the function items, performance items and information flows in the current system based on the abstract model of the current system;

[0038] Step S2, respectively determining the influence relationship between each function item, each performance item and each predetermined unsafe behavior, so as to respectively determine the functional safety analysis matrix, the functional safety attribute value and the expected functional safety analysis matrix, and the expected functional safety attribute value;

[0039] Step S3, determining the security attributes of each information flow that are damaged when facing various information security threats, and determining the functional items and performance items affected when the security attributes of the information flow are damaged, so as to determine the impact relationship between the information flow and various unsafe behaviors, and further determine the information security analysis matrix and the information security attribute value;

[0040] Step S4, calculating the integrated safety attribute value of the current system based on the functional safety attribute value, the expected functional safety attribute value and the information security attribute value of the current system;

[0041] Step S5, concatenating the functional safety analysis matrix, the expected functional safety analysis matrix and the information security analysis matrix of the current system to obtain a fused safety analysis matrix of the current system.

[0042] In an embodiment of the present invention, the impact of information security is mapped to the impact caused by network threats on the vehicle, and by mapping to functional items and performance items, the connection between information security and functional safety and expected functional safety is established. Subsequently, at the level of unsafe vehicle behavior, the attribute values ​​of the three types of safety issues are uniformly quantified, and then the fused safety attribute value is calculated based on the three types of safety attribute values. This attribute value is only meaningful when at least two types of safety issues are involved. By fusing the safety attribute value, it is possible to identify whether the system involves fused safety issues and quantify the degree to which the system is affected by the combined impact of the three types of safety issues, which can improve the accuracy and reliability of the fused safety analysis results.

[0043] The following describes the execution method of steps S1-S5 in sequence.

[0044] For step S1:

[0045] First, the abstract modeling process is explained.

[0046] In the embodiment of the present invention, it is necessary to confirm the security goals and overall security requirements of the system according to the specifications and definitions of the intelligent connected vehicle system, and to abstractly model the system specifications and structures. Specifically, by establishing the perception layer, decision layer, execution layer, information flow, and energy flow abstract models, the functional logical relationship between the internal components of the system is constructed, as shown in 2. It can be understood that when analyzing a specific system, it is not necessary to include Figure 2 Instead of all the components shown in the figure, relevant components can be selected for adjustment according to actual conditions.

[0047] Among them, perception refers to the function of the system to perceive the external environment, including but not limited to the use of temperature sensors, pressure sensors, cameras, lidar and other sensors to collect external environmental information. Decision-making refers to the function of the system to formulate corresponding strategies and output instructions based on external information, including but not limited to hardware such as ECU and software such as decision-making algorithms. Action mainly refers to the function of accepting decision-making instructions and executing actions, including but not limited to controllers, control algorithms, actuators, etc. Information flow refers to the process of information exchange between each sub-component and the outside world, such as operation instructions, perception information and other data. Energy flow refers to the process of energy exchange between each sub-component and the outside world, such as mechanical energy transmitted through transmission mechanisms and hydraulic pipelines. Afterwards, on the basis of system abstract modeling, consider the impact of human operation and external environment on the system, and consider the impact of system output on vehicle behavior. At the same time, it is necessary to analyze and determine the safety-related systems that the system relies on. For example, the normal operation of the automatic emergency braking system (AEB) depends on the normal operation of the braking system. In addition, it is also necessary to analyze and determine the interactive content set of human-computer interaction during driver intervention and the information flow chain of each remote intervention instruction.

[0048] Therefore, the functional logical relationship between components in the system of intelligent connected vehicles is analyzed to divide each component into the corresponding perception layer, decision layer and execution layer, and the information exchange between each component and the outside is analyzed to determine several information flows in the system in order to establish an abstract model.

[0049] After obtaining the abstract model, we analyze it layer by layer according to the perception layer, decision layer and execution layer to confirm the functional items in the system; for example, the windshield wiper function item, etc.

[0050] Analyze the perception layer, decision layer, and execution layer layer by layer, and determine the output within and between layers, so that each output can be used as a performance item; among them, the performance items include sensing output and control output. Sensing output is the environmental information collected in the perception layer and output to the downstream components, and control output is the control instruction generated by the decision layer or execution layer and output to the downstream system. For example, the visual sensor output in the sensing output.

[0051] For step S2:

[0052] It should be noted that by decoupling the vehicle behavior in lateral and longitudinal motion, the following five unsafe behaviors are derived, which are summarized in Table 1:

[0053] Table 1 Unsafe behavior of vehicles

[0054]

[0055] In some embodiments, the functional safety attribute value is determined as follows:

[0056] Determine the three functional failure conditions of function loss, function error, and non-set function, and analyze whether each function item will cause predetermined unsafe vehicle behaviors under these three functional failure conditions;

[0057] For each function item, the unsafe behavior that will be directly caused by the current function item when the function fails is recorded as 1, otherwise it is recorded as 0, and the influence relationship between the current function item and each unsafe behavior is obtained to obtain the analysis matrix of the current function item;

[0058] The analysis matrices of each functional item in the current system are spliced ​​together to obtain a functional safety analysis matrix;

[0059] Based on the Frobenius norm of the functional safety analysis matrix, the functional safety attribute values ​​are determined.

[0060] In this embodiment, the functional failure situations are divided into three situations, and the specific descriptions are shown in the following Table 2.

[0061] Table 2 Description of functional failure

[0062]

[0063] The safety demonstration method based on Claim-Argument-Evidence (CAE) is used to analyze whether each functional item will cause predetermined unsafe behaviors of the vehicle under the three functional failure conditions. The results of the analysis are expressed in the form of Boolean values, that is, the unsafe behavior that will be directly caused by the current functional item under at least one functional failure condition is recorded as 1, otherwise it is recorded as 0, and the influence relationship between the current functional item and each unsafe behavior is obtained to obtain the analysis matrix of the current functional item. For example, the failure of the windshield wiper function item will limit the driver's vision in rainy and snowy weather, thereby causing unsafe behaviors of the vehicle. In this case, the failure of this functional item cannot be regarded as a problem that can directly cause safety.

[0064] Assuming that the system has three functional items, the impact relationship between each functional item and each unsafe behavior can be expressed as shown in Table 3 below.

[0065] Table 3 The relationship between each function item and each unsafe behavior

[0066]

[0067] According to Table 3, the analysis matrix of each functional item can be determined, which are: , and , the analysis matrices of the three functional items are spliced ​​to obtain the functional safety analysis matrix for:

[0068]

[0069] Functional safety attribute values ​​of the system According to the functional safety matrix The Frobenius norm is determined by using the following formula:

[0070]

[0071] In some embodiments, the expected functional safety attribute value is determined as follows:

[0072] Determine the four performance limitation conditions: output disappearance, output quantity different from expected quantity, unexpected output timing, and unexpected output duration, to analyze whether each performance item will cause predetermined unsafe behaviors of the vehicle under these four performance limitation conditions;

[0073] For each performance item, the unsafe behavior that will be directly caused by the current performance item when the performance is limited is recorded as 1, otherwise it is recorded as 0, and the influence relationship between the current performance item and each unsafe behavior is obtained to obtain the analysis matrix of the current performance item;

[0074] The analysis matrices of each performance item in the system are spliced ​​together to obtain the expected functional safety analysis matrix;

[0075] Based on the Frobenius norm of the expected functional safety analysis matrix, the expected functional safety attribute value is determined.

[0076] In this embodiment, the performance limitation situations are divided into four situations, and the specific descriptions are shown in the following Table 4.

[0077] Table 4 Description of performance limitations

[0078]

[0079] A safety argumentation method based on Claim-Argument-Evidence (CAE) is used to analyze whether each performance item will cause predetermined unsafe vehicle behaviors under these four performance-limited conditions. The analysis results are expressed in the form of Boolean values, that is, if the current performance item is restricted and degraded in at least one case, the unsafe behavior that can be directly caused is recorded as 1, otherwise it is recorded as 0. The impact relationship between the current performance item and each unsafe behavior is obtained to obtain the analysis matrix of the current functional item.

[0080] Assuming that the system has four performance items, the impact relationship between each performance item and each unsafe behavior can be expressed as shown in Table 5 below.

[0081] Table 5 The relationship between each performance item and each unsafe behavior

[0082]

[0083] According to Table 5, the analysis matrix of each performance item can be determined, which are: , , and , the analysis matrices of the four performance items are spliced ​​together to obtain the expected functional safety analysis matrix:

[0084]

[0085] Expected functional safety property values ​​of the system According to the expected functional safety analysis matrix The Frobenius norm is determined by using the following formula:

[0086]

[0087] For step S3:

[0088] In some implementations, step S3 may include:

[0089] For each information flow, execute:

[0090] Using threat identification algorithms, determine the security attributes of the information flow that are compromised when a preset information security threat is encountered; the security attributes include at least integrity, confidentiality, and availability;

[0091] Determine the functional items and performance items that are affected when each security attribute of the information flow is compromised;

[0092] Based on the influence relationship between the corresponding affected functional items and performance items and each unsafe behavior, determine the influence relationship between the information flow and each unsafe behavior to obtain an analysis matrix of the information flow;

[0093] The analysis matrices of each information flow in the system are spliced ​​together to obtain the information security analysis matrix;

[0094] Based on the Frobenius norm of the information security analysis matrix, the information security attribute value is determined.

[0095] In this embodiment, for each information flow, the STRIDE threat identification algorithm is used. The preset information security threats in the algorithm include identity fraud, data tampering, repudiation, information leakage and denial of service. The security attribute of the information flow will be damaged under the information security threat. Then, the function items and performance items affected when each security attribute of the information flow is damaged are determined to establish a mapping relationship between the security attributes of the information flow and the function items and performance items determined in step 102, as shown in Table 6. For example, if a fraudulent CAN message is sent to a brake electronic control unit (ECU), the integrity of the CAN message may be damaged, thereby causing the failure of the brake system function.

[0096] It should be noted that the security attributes of information flow include integrity (I), confidentiality (C) and availability (A), among which integrity refers to the fact that information has not been modified or tampered with without authorization during storage or transmission, confidentiality refers to the protection of information from unauthorized access or disclosure, and availability refers to the fact that information or systems are available when needed and can operate normally without interference or obstruction.

[0097] Table 6 Security attribute mapping

[0098]

[0099] In Table 6, when the information security threat does not affect the confidentiality of the information flow α, or when the confidentiality is destroyed and does not affect any functional items and performance items, it will result in confidentiality C having no corresponding mapping relationship.

[0100] After the security attribute mapping relationship is established, based on the influence relationship between the corresponding affected functional items and performance items and each unsafe behavior determined in step 102, the influence relationship between the information flow and each unsafe behavior can be determined to obtain an analysis matrix of the information flow.

[0101] The relationship between the information flow and the impact of each unsafe behavior is shown in Table 7 below.

[0102] Table 7 The relationship between information flow α and each unsafe behavior

[0103]

[0104] According to Table 7, the analysis matrix of information flow α can be determined as:

[0105]

[0106] By splicing the analysis matrices of all information flows in the system, we can get the information security analysis matrix ;

[0107] Information security attribute value of the system According to the information security analysis matrix The Frobenius norm is determined by using the following formula:

[0108]

[0109] For step S4:

[0110] In some implementations, the fused security attribute value is calculated as follows:

[0111]

[0112] In the formula, To integrate the security attribute value, , and They are the system’s functional safety attribute value, expected functional safety attribute value, and information security attribute value. is the intermediate variable, is a symbolic function.

[0113] In this embodiment, The operation rules are: when the parameter is greater than 0, Output 1; when the parameter is equal to 0, Output 0. Therefore, when at least 2 of the three security attribute values ​​are 0, is 0, and the fusion security attribute value is also 0, indicating that the system does not involve fusion security issues. Only when at least two security issues are involved, this fusion security attribute value is non-zero and has practical significance. The larger the value, the greater the impact of the three types of safety issues, namely functional safety, expected functional safety and information security, on the safety of the system. Therefore, by integrating the safety attribute value, it is possible to identify whether the system involves integrated safety issues and quantify the degree to which the system is affected by the three types of safety issues. After analyzing the integrated safety attribute values ​​of multiple systems, the larger the integrated safety attribute value, the system that is analyzed first can be improved to improve the efficiency of integrated safety analysis of various systems of intelligent connected vehicles.

[0114] For step S5:

[0115] The functional safety analysis matrix of the current system , Anticipated Functional Safety Analysis Matrix and Information Security Analysis Matrix Splice to get the fusion security analysis matrix of the current system :

[0116] In summary, an abstract model of each system of an intelligent connected vehicle is established in advance. By using the above steps S1-S5, the fusion safety attribute value and fusion safety analysis matrix of each system can be obtained. By sorting the fusion safety attribute values ​​from large to small, the analysis priority of each system can be determined, and the fusion safety risk analysis of the following steps 102-106 is not performed on the system with a fusion safety attribute of 0.

[0117] Regarding step 102:

[0118] In some implementations, step 102 may include the following steps B1-B5:

[0119] Step B1, using the reliability block diagram method, analyze and determine the failure rate of each functional item, so as to construct a functional safety risk trigger vector using the failure rates of all functional items of the current target system.

[0120] In this step, when evaluating the risk of functional safety issues triggering unsafe vehicle behavior, the reliability block diagram (RBD) method is used for each functional item of the current target system. By analyzing and calculating the possibility of potential functional failure modes of each component in the current target system, the contribution of the failure mode of each component and its configuration to the failure probability of the functional item of the current target system is determined, thereby obtaining the failure rate of the functional item. The failure rate of the i-th functional item is recorded as Build functional safety risk trigger vectors for the current target system :

[0121]

[0122] Where m means that the system has m functional items.

[0123] Step B2, using scenario analysis and scenario testing, determine the trigger probability of performance limitation of each performance item, so as to construct the expected functional safety risk trigger vector using the trigger probability of all performance items of the current target system.

[0124] In this step, when assessing the risk of expected functional safety issues triggering unsafe vehicle behavior, we use brainstorming, expert experience, previous project experience, etc. to use scenario analysis to determine the specific triggering conditions for performance limitation (degradation) of each performance item in the current target system. The probability of each trigger condition causing the performance limitation of the performance item is determined through scenario testing to determine the triggering probability of performance limitation of each performance item j, recorded as Build the expected functional safety risk trigger vector for the current target system :

[0125]

[0126] Where n means that the system has n performance items.

[0127] Step B3, using the common vulnerability scoring system, evaluates the attack feasibility index of each information flow of the current target system to determine the vulnerability of each information flow.

[0128] In this step, the information security risk trigger vector is determined from two aspects, namely, the vulnerability of the system and the capability requirements of the attacker. Specifically, the Common Vulnerability Scoring System (CVSS) is used to evaluate the attack feasibility index of each information flow from four aspects: attack vector, attack complexity, required permissions, and user interactivity. The attack feasibility index Normalize to determine the vulnerability of the information flow , which is calculated as follows:

[0129]

[0130] Step B4, using the expert evaluation method, evaluates the capability requirement index of each information flow of the current target system for the attacker.

[0131] In this step, the expert evaluation method is used to evaluate the attacker's ability index of the information flow from three aspects: the attacker's ability to use complex tools, the requirement for experience and knowledge in this field, and the ability to cover up traces and remain in the system for a long time without being discovered. ,in The result range is [0,1].

[0132] Step B5, based on the vulnerability and capability requirement index of each information flow, calculate the trigger coefficient of each information flow, so as to construct an information security risk trigger vector using the trigger coefficients of all information flows of the current target system.

[0133] The current target system is calculated by the following formula The risk trigger coefficient of the information flow is denoted as , the calculation formula is as follows:

[0134]

[0135] Construct the information security risk trigger vector of the current target system for:

[0136]

[0137] Where l means that the system has l information flows.

[0138] Step B6, based on the integrated safety analysis matrix, functional safety risk trigger vector, expected functional safety risk trigger vector and information security risk trigger vector of the current target system, calculate the trigger risk coefficient of each unsafe behavior respectively.

[0139] The trigger risk factor for each unsafe behavior is calculated as:

[0140] Unsafe deceleration:

[0141] Unsafe acceleration:

[0142] Unsafe speed maintenance:

[0143] Unsafe Turns:

[0144] Unsafe Tilt:

[0145] In the formula, For step 100, the fusion security analysis matrix of the current target system is obtained. is the first row of the fusion security analysis matrix, is the length of the first row vector norm of the fusion security analysis matrix, is the functional safety risk trigger vector, Trigger vector for expected functional safety risk, Trigger vector for information security risk.

[0146] Finally, the trigger risk vector of the unsafe behavior of the current target system is formed for:

[0147]

[0148] Regarding step 104:

[0149] In this step, firstly, a corresponding relationship table between unsafe behaviors and dangerous scenarios needs to be determined, wherein one unsafe behavior corresponds to multiple dangerous scenarios. Next, the dangerous scenarios corresponding to each unsafe behavior are analyzed and determined.

[0150] Obtain the scenario database, extract key feature parameters for each scenario data in the database, so that each scenario contains the corresponding data of each three-level dimension as shown in Table 8, that is, each scenario data contains physical field data and information field data, the physical field data contains natural domain data and traffic domain data, and the traffic domain data contains road layer data, traffic infrastructure data and road user data. However, after extracting the three-level dimensional data in Table 8 below for each scenario data, some scenarios lack at least one dimensional information. According to the data completeness, the scenes in the scenario database are divided into native scenes and missing scenes. The scenes containing all dimensional information are native scenes. For scenes with missing dimensional information, the missing dimensional parameters are supplemented based on the statistical results of historical data of the relevant dimensions, and they are defined as regenerated scenes. Native scenes have higher priority in subsequent risk assessments, and their risk assessment results are given higher confidence.

[0151] Table 8 Scene data construction hierarchy

[0152]

[0153] Then, each unsafe behavior is analyzed. First, the unsafe behaviors in the first step are quantitatively graded. Specifically, specific values ​​are set for vehicle motion characteristics, including vehicle speed, acceleration, lateral speed, heading angle, and tilt angle. Then, the same type of unsafe behaviors are grouped according to the value. After completing the quantitative grading of unsafe behaviors, the safety risks in the native scenario are analyzed first. The scenario danger level in the assessment is defined as the risk level of an imminent collision with a vehicle driven with a certain type of unsafe behavior in the scenario. This is to determine in which scenarios each unsafe behavior is likely to occur, and to determine the dangerous scenarios corresponding to each unsafe behavior. After completing the risk analysis of the native scenario, a safety assessment is conducted on the regenerated scenario to further improve the correspondence table between unsafe behaviors and dangerous scenarios.

[0154] Next, the calculation methods of the dangerous scenario exposure rate, risk controllability and risk accident severity corresponding to each unsafe behavior in each dangerous scenario are explained respectively.

[0155] In some implementations, the dangerous scene exposure rate corresponding to each unsafe behavior in each dangerous scene is determined by:

[0156] For each set of unsafe behaviors and dangerous scenarios in the corresponding relationship table, execute:

[0157] Count the occurrence probability of the current dangerous scene in the scene database;

[0158] Determine the confidence coefficient of the current dangerous scenario based on the data completeness of the current dangerous scenario;

[0159] Based on the occurrence probability and confidence coefficient, the dangerous scenario exposure rate corresponding to the current unsafe behavior in the current dangerous scenario is calculated.

[0160] The specific calculation formula is:

[0161]

[0162] In the formula, is the exposure rate of dangerous scenes, r represents the rth unsafe behavior, s represents the sth dangerous scene, is the probability of occurrence of the current dangerous scene in the scene database, is the confidence coefficient, , which is related to the number of dimensions of the supplemented parameters. The more dimensions of the supplemented parameters, the smaller the value. If it is a native scene, The value is 1.

[0163] In some implementations, the risk controllability of each unsafe behavior in each dangerous scenario is determined by the following steps K1-K6:

[0164] Step K1, based on the abstract model of the current target system, analyzing and confirming the security-related systems related to the current target system, the interactive content set of human-computer interaction, and the information flow chain of each remote intervention instruction;

[0165] Step K2, determining the autonomous risk controllability gain coefficient, the human misuse coefficient of driving intervention, and the remote intervention controllability gain coefficient based on the safety-related system, the interactive content set, and the information flow chain of each remote intervention instruction;

[0166] Step K3, for each dangerous scenario of each unsafe behavior in the corresponding relationship table between unsafe behaviors and dangerous scenarios, the following steps are performed: obtaining a pre-generated classification table of autonomous risk controllability, driving intervention controllability, and remote intervention controllability;

[0167] Step K4, based on the classification table, determining the autonomous risk controllability level, the driving intervention controllability level and the remote intervention controllability level to which the current unsafe behavior belongs in the current scenario;

[0168] Step K5, based on the autonomous risk controllability level, driving intervention controllability level, remote intervention controllability level of the current unsafe behavior in the current scenario, as well as the autonomous risk controllability gain coefficient, human misuse coefficient and remote intervention controllability gain coefficient, comprehensively evaluate the risk controllability of the current unsafe behavior in the current scenario.

[0169] In the existing risk controllability assessment methods, generally only the probability that the driver or other potentially at-risk persons can fully control the hazardous event to avoid specific injuries is estimated. This controllability assessment only considers the risk controllability based on human intervention. With the continuous development of intelligent network technology, when the autonomous driving technology reaches L3 or higher, it is necessary to consider the autonomous risk controllability of the vehicle system; at the same time, with the continuous maturity of vehicle-road-cloud integration technology, the controllability of remote monitoring of risks cannot be ignored. Therefore, there is currently a lack of comprehensive safety controllability assessment methods for intelligent connected vehicles. It should be noted that the "controllability" mentioned in the present invention is defined in accordance with ISO 26262. According to this standard, the larger the evaluation value, the higher the difficulty of risk control.

[0170] In the embodiment of the present invention, the integrated safety controllability of intelligent networked vehicles is analyzed and evaluated from three levels: the autonomous risk controllability based on the target system itself, the risk controllability based on driver access, and the risk controllability based on remote intervention. Through this multi-level evaluation method, the safety risk management mechanism of intelligent networked vehicles in different scenarios can be comprehensively analyzed to ensure that the difficulty of controlling risks is comprehensively evaluated and understood under autonomous control, manual intervention, and remote monitoring.

[0171] For step K1:

[0172] refer to Figure 2 ,When abstract modeling of each system, the security associated system related to the current target ,system, the set of interactive contents of human-computer interaction, and the ,information flow chain of each remote intervention command can be confirmed.

[0173] For step K2:

[0174] Next, the determination methods of the three gain coefficients, namely, the autonomous risk controllability gain coefficient, the human misuse coefficient of driving intervention, and the remote intervention controllability gain coefficient, are explained in detail.

[0175] In some embodiments, the autonomous risk controllability gain coefficient is determined as follows:

[0176] Determine the association category between each associated system in the security associated system and the target system;

[0177] Based on the degree of dependence of the target system on the associated system whose associated category is supporting association, the gain coefficient corresponding to each associated system of supporting association is quantified;

[0178] quantifying a gain coefficient of the redundant association based on the redundancy of the association system whose association category is the redundant association;

[0179] quantifying the gain coefficient of the protective association based on the protection degree of the association system whose association category is protective association;

[0180] Based on the gain coefficients corresponding to each associated system of the supporting association, the gain coefficients of the redundant association and the gain coefficients of the protective association, the autonomous risk controllability gain coefficient is determined.

[0181] In this embodiment, the relationship between the target system and the safety-related system is analyzed to determine the association category, including supporting association, redundant association, and protective association. Supporting association means that the safety function of the target system depends on the function of the associated system, such as the safety issue of AEB depends on the normal operation of the basic function of the braking system. Redundant association means that when the target system has a safety risk, its backup system can provide redundant functions to improve reliability. Protective association means that in addition to the protection function of the target system itself, there are additional safety protection systems, such as the "safety co-pilot system."

[0182] By analyzing the degree of dependence of the target system on the associated system in the supporting association, the gain coefficient corresponding to each associated system of the supporting association is quantified. It can be understood that the higher the degree of dependence, the lower the gain coefficient, which will increase the evaluation value of controllability, that is, the degree of dependence is proportional to the controllability gain coefficient.

[0183] Based on the redundancy of the associated systems in the redundant association, the gain coefficient of the redundant association is quantified. It can be understood that the higher the redundancy of the associated systems in the redundant association, the higher the gain coefficient of the redundant association, which will reduce the evaluation value of the controllability, that is, the number of associated systems in the redundant association is inversely proportional to the controllability gain coefficient.

[0184] Based on the protection degree of the associated system of the protective association, the gain coefficient of the protective association is quantified. It can be understood that the higher the protection degree of the associated system in the protective association, the higher the gain coefficient of the protective association, the lower the evaluation value of the controllability, that is, the protection degree of the associated system in the protective association is inversely proportional to the controllability gain coefficient.

[0185] Multiply the gain coefficients corresponding to each associated system of the supporting association, the gain coefficient of the redundant association, and the gain coefficient of the protective association to obtain the autonomous risk controllability gain coefficient .

[0186] In some embodiments, the human error coefficient is determined as follows:

[0187] Confirm whether each interaction content in the interaction content set of human-computer interaction is information type or action type;

[0188] Obtaining predetermined levels of difficulty for the driver to understand information interactions and preset coefficients for each level;

[0189] Determining a level of difficulty for the driver to understand each interactive content belonging to the information category in the interactive content set, so as to determine a misuse coefficient of each interactive content belonging to the information category based on a preset coefficient;

[0190] Obtaining the complexity level of the predetermined action-type interaction when executed by the driver, and the preset coefficient of each level;

[0191] Determine the complexity level of each interactive content belonging to the action class in the interactive content set, so as to determine the misuse coefficient of each interactive content belonging to the action class;

[0192] The human misuse coefficient is determined based on the misuse coefficient of each interactive content belonging to the information category and the misuse coefficient of each interactive content belonging to the action category.

[0193] In this embodiment, the interaction content between the human driver and the system is divided into information and action. It is necessary to confirm whether each interaction content in the interaction content set is information or action. The information type is the system prompting the driver and passengers to inform them of information, such as visual warning information, auditory warning information, etc. The action type is to require the driver and passengers to perform corresponding actions according to the prompts, such as taking over the steering wheel, stepping on the brake pedal, etc. In order to evaluate the difficulty of the information interaction for the driver to understand and the complexity of the action interaction when the driver executes it, it is necessary to prepare an interaction content level table in advance and determine a preset coefficient for each level. As shown in Table 9 below.

[0194] Table 9 Interactive content rating table

[0195]

[0196] The preset coefficients of the information level of understanding in the information category and the reaction level in the action category are 1, and the preset coefficients increase with the increase of the complexity level of understanding and the complexity level of operation. It can be understood that the larger the preset coefficients, the smaller the controllability.

[0197] Determine the level of difficulty for the driver to understand each interactive content belonging to the information category in the interactive content set, and then the preset coefficient of the corresponding level can be determined as the misuse coefficient of the interactive content; similarly, determine the level of complexity of each interactive content belonging to the action category in the interactive content set, and then the preset coefficient of the corresponding level can be determined as the misuse coefficient of the interactive content. The human misuse coefficient is determined by multiplying the misuse coefficient of each interactive content in the interactive content set. .

[0198] In some embodiments, the remote intervention controllability gain coefficient is determined as follows:

[0199] For each remote intervention command, execute:

[0200] Determine the nodes in the information flow chain corresponding to the current remote intervention instruction that can be attacked by the network;

[0201] Evaluate the probability coefficient of each node being attacked by the network, as well as the impact coefficient of the network attack on the remote control function, to determine the remote intervention controllability gain coefficient corresponding to the current remote intervention instruction.

[0202] In this embodiment, a node refers to a related component in the information flow chain. When analyzing the controllability of remote intervention, the vehicle-side control chain of remote intervention is first identified, including the entire process from receiving information on the vehicle side to final execution, and the flow path and related components of the control information flow are analyzed. First, the probability coefficient of the network attack to achieve an effective attack on the node on the remote control chain is evaluated. Based on the information security attribute analysis, a mapping relationship between the threat and the functional failure and performance degradation of the components on the control chain is established to analyze and determine the impact coefficient of the network attack on the remote control function, such as incomplete information, tampering, leakage, etc. For example, when the automatic emergency braking system (AEB) or braking function of the vehicle is remotely intervened to complete the emergency braking, if the network attack at this time is aimed at functional items that are not related to the braking process, such as the AEB function of prompting personnel to intervene, etc., although these attacks may cause unsafe behaviors of the vehicle, these attacks cannot directly affect the controllability based on remote intervention, so they are not considered in this case. Based on this, the remote intervention controllability gain coefficient can be obtained. , which can quantify the impact of information security threats on the controllability of remote intervention.

[0203] For steps K3 and K4:

[0204] In this embodiment, the controllability classification level table is shown in Table 10 below.

[0205] Table 10 Controllability classification table

[0206]

[0207] Based on the classification table in Table 10, determine the autonomous risk controllability level, driving intervention controllability level and remote intervention controllability level values ​​of the current unsafe behavior in the current scenario.

[0208] For step K5:

[0209] In the embodiment of the present invention, the risk controllability of the current unsafe behavior in the current scenario is evaluated in the following way:

[0210] In the formula, The risk of the rth unsafe behavior in the tth scenario is controllable , and They are the autonomous risk controllability gain coefficient, human misuse coefficient and remote intervention controllability gain coefficient, , and They are respectively the autonomous risk controllability level, driving intervention controllability level and remote intervention controllability level of the current unsafe behavior in the current scenario.

[0211] Therefore, in the embodiment of the present invention, when analyzing the controllability of autonomous risks, not only the control ability of the system itself to the risk is considered, but also the correlation between the safety functions of the systems is included in the evaluation of the risk control ability. If the implementation of the safety function of the target system needs to rely on other basic systems, backup systems with functional redundancy, or monitoring systems, these factors will have an impact on the risk control ability of the system itself, and this impact will be quantified as a gain coefficient. When analyzing the controllability based on driving intervention, the impact of human misuse on controllability is considered according to the complexity and difficulty of interaction between man and machine, and quantified as a human misuse coefficient. In addition, the impact of cyber attack threats on control risks based on remote intervention is also considered. Through this multi-level evaluation method, the safety risk management mechanism of intelligent connected vehicles in different scenarios can be comprehensively analyzed to ensure that the difficulty of controlling risks is comprehensively evaluated and understood under autonomous control, manual intervention, and remote monitoring.

[0212] In some implementations, the severity of the risk accident corresponding to each unsafe behavior in each dangerous scenario is determined by:

[0213] Based on the risk scenarios associated with unsafe behaviors, the degree of harm that will be caused once a safety accident occurs is analyzed. The Abbreviated Injury Scale (AIS) proposed by the Association for the Advancement of Automotive Medicine (AAAM) is used to determine the degree of harm, which is recorded as , r represents the corresponding r-th unsafe behavior, and t represents the severity of the t-th scenario associated with the r-th unsafe behavior.

[0214] Regarding step 106:

[0215] In some implementations, the fusion security risk value corresponding to the current target system It is determined as follows:

[0216] Unsafe deceleration:

[0217] Unsafe acceleration:

[0218] Unsafe speed maintenance:

[0219] Unsafe Turns:

[0220] Unsafe Tilt:

[0221] The total fusion security risk value is:

[0222] In the formula, are the trigger risk coefficients of each unsafe behavior, are the dangerous scene exposure rate vectors corresponding to each unsafe behavior, are the risk controllability vectors corresponding to each unsafe behavior, are the risk accident severity vectors corresponding to each unsafe behavior.

[0223] In some implementations, after calculating the fusion security risk value corresponding to the current target system, the method further includes:

[0224] Based on the fusion security risk value corresponding to the current target system, the security gradient of each functional item, each performance item and each information flow is derived and calculated to determine the contribution ranking to the fusion security risk value.

[0225] In this embodiment, the chain rule can be used to trace back each function item, each performance item, and each information flow to calculate the security gradient of each item. , in order to evaluate the contribution of each item to the fusion safety risk value. This method calculates the impact of each input on the output, determines the factor with the greatest impact, and thus determines the priority direction for improvement.

[0226] Taking the calculation of the safety gradient of the distance function item a in the above steps as an example, the formula is as follows:

[0227]

[0228] In the formula, To integrate the security risk value, is the failure rate of function item a in step 102, It is the trigger risk vector of the unsafe behavior of the target system.

[0229] Therefore, the obtained fusion security risk value can not only provide a quantitative result of the system's fusion risk, but also trace the impact of different types of security issues on the fusion security risk value through back propagation similar to neural network optimization, determine the priority of subsequent optimization according to the security gradient, identify the weak links in the system design, and quickly optimize the system's security design.

[0230] Please refer to Figure 3 The embodiment of the present invention provides a device for quantitatively analyzing the fusion safety risk of an intelligent networked vehicle, the device comprising:

[0231] The analysis module 301 is used to confirm the functional safety attribute value, expected functional safety attribute value and information security attribute value of each system based on the pre-established abstract model of each system of the intelligent connected vehicle, calculate the fusion safety attribute value and fusion safety analysis matrix of each system, and determine the analysis priority of each system based on the fusion safety attribute value;

[0232] The evaluation module 302 is used to perform, for each target system whose fusion safety attribute value is non-zero and is analyzed in sequence based on the analysis priority: based on the abstract model of the current target system and the fusion safety analysis matrix, evaluating the triggering risk coefficient of each unsafe behavior;

[0233] The determination module 303 is used to determine the correspondence table between unsafe behaviors and dangerous scenarios, and respectively determine the dangerous scenario exposure rate, risk controllability and risk accident severity corresponding to each unsafe behavior in each dangerous scenario;

[0234] The calculation module 304 is used to calculate the fusion safety risk value corresponding to the current target system based on the trigger risk coefficient of each unsafe behavior, the dangerous scene exposure rate corresponding to each unsafe behavior in each dangerous scene, the risk controllability and the severity of the risk accident.

[0235] In one embodiment of the present invention, the fused security attribute value and fused security analysis matrix of each system in the analysis module 301 are determined in the following manner:

[0236] Analyze and confirm the functional items, performance items and information flows in the current system based on the abstract model of the current system;

[0237] Determine the influence relationship between each function item, each performance item and each predetermined unsafe behavior, so as to determine the functional safety analysis matrix, functional safety attribute value and expected functional safety analysis matrix, expected functional safety attribute value respectively;

[0238] Determine the security attributes of each information flow that are damaged when facing various information security threats, and determine the functional items and performance items affected when the security attributes of the information flow are damaged, so as to determine the impact relationship between the information flow and various unsafe behaviors, and further determine the information security analysis matrix and information security attribute values;

[0239] Calculate the integrated safety attribute value of the current system based on the functional safety attribute value, expected functional safety attribute value and information security attribute value of the current system;

[0240] The functional safety analysis matrix, expected functional safety analysis matrix and information security analysis matrix of the current system are spliced ​​together to obtain the integrated safety analysis matrix of the current system.

[0241] In one embodiment of the present invention, the functional safety attribute value in the analysis module 301 is determined in the following manner:

[0242] Determine the three functional failure conditions of function loss, function error, and non-set function, and analyze whether each function item will cause predetermined unsafe vehicle behaviors under these three functional failure conditions;

[0243] For each function item, the unsafe behavior that will be directly caused by the current function item when the function fails is recorded as 1, otherwise it is recorded as 0, and the influence relationship between the current function item and each unsafe behavior is obtained to obtain the analysis matrix of the current function item;

[0244] The analysis matrices of each functional item in the current system are spliced ​​together to obtain a functional safety analysis matrix;

[0245] Based on the Frobenius norm of the functional safety analysis matrix, the functional safety attribute values ​​are determined.

[0246] In one embodiment of the present invention, the evaluation module 302 is used to perform:

[0247] Using the reliability block diagram method, analyze and determine the failure rate of each functional item, so as to construct a functional safety risk trigger vector using the failure rates of all functional items of the current target system;

[0248] Utilize scenario analysis and scenario testing to determine the trigger probability of performance limitation of each performance item, so as to construct the expected functional safety risk trigger vector using the trigger probability of all performance items of the current target system;

[0249] Use the common vulnerability scoring system to evaluate the attack feasibility index of each information flow of the current target system to determine the vulnerability of each information flow;

[0250] Use the expert evaluation method to evaluate the capability requirement index of each information flow of the current target system for the attacker;

[0251] Based on the vulnerability and capability requirement index of each information flow, the trigger coefficient of each information flow is calculated to construct an information security risk trigger vector using the trigger coefficients of all information flows in the current target system;

[0252] Based on the integrated safety analysis matrix, functional safety risk trigger vector, expected functional safety risk trigger vector and information security risk trigger vector of the current target system, the trigger risk coefficient of each unsafe behavior is calculated respectively.

[0253] In one embodiment of the present invention, the risk controllability corresponding to each unsafe behavior in each dangerous scenario in the determination module 303 is determined in the following manner:

[0254] Based on the abstract model of the current target system, analyze and confirm the security-related systems related to the current target system, the interactive content set of human-computer interaction, and the information flow chain of each remote intervention instruction;

[0255] Based on the safety-related system, the interactive content set and the information flow chain of each remote intervention command, the autonomous risk controllability gain coefficient, the human misuse coefficient of driver intervention and the remote intervention controllability gain coefficient are determined respectively;

[0256] For each dangerous scenario of each unsafe behavior in the corresponding relationship table between unsafe behaviors and dangerous scenarios, execute:

[0257] Obtain a pre-generated classification table of autonomous risk controllability, driver intervention controllability, and remote intervention controllability;

[0258] Based on the classification table, determine the autonomous risk controllability level, driving intervention controllability level and remote intervention controllability level of the current unsafe behavior in the current scenario;

[0259] Based on the autonomous risk controllability level, driving intervention controllability level, remote intervention controllability level of the current unsafe behavior in the current scenario, as well as the autonomous risk controllability gain coefficient, human misuse coefficient and remote intervention controllability gain coefficient, the risk controllability of the current unsafe behavior in the current scenario is comprehensively evaluated.

[0260] In one embodiment of the present invention, after calculating the fusion security risk value corresponding to the current target system, the calculation module 304 is further used to:

[0261] Based on the fusion security risk value corresponding to the current target system, the security gradient of each functional item, each performance item and each information flow is derived and calculated to determine the contribution ranking to the fusion security risk value.

[0262] It should be noted that the quantitative analysis device for the integrated safety risk of intelligent networked vehicles provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the above device embodiment and the method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0263] The embodiment of the present application also provides a computer device, please refer to Figure 4 The computer device includes a processor and a memory, wherein at least one instruction, at least one program, a code set or an instruction set is stored in the memory, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by the processor to implement the quantitative analysis method for the fusion safety risk of intelligent connected vehicles provided by the above-mentioned method embodiments.

[0264] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the quantitative analysis method for the fusion safety risks of intelligent connected vehicles provided in the above-mentioned method embodiments.

[0265] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the quantitative analysis method for the fusion safety risks of intelligent connected vehicles described in any of the above embodiments.

[0266] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0267] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0268] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0269] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A quantitative analysis method for the fusion safety risk of intelligent connected vehicles, characterized in that: The method comprises: Based on the pre-established abstract models of each system of the intelligent connected vehicle, the functional safety attribute value, expected functional safety attribute value and information security attribute value of each system are respectively confirmed to calculate the fused safety attribute value and fused safety analysis matrix of each system respectively, and the analysis priority of each system is determined based on the fused safety attribute value; For each target system whose fusion security attribute value is non-zero and is analyzed in sequence based on the analysis priority, the following is executed: Based on the abstract model of the current target system and the fusion safety analysis matrix, evaluating the triggering risk coefficient of each unsafe behavior; Determine the corresponding relationship table between unsafe behaviors and dangerous scenarios, and respectively determine the dangerous scenario exposure rate, risk controllability and risk accident severity of each unsafe behavior in each dangerous scenario; Calculate the fusion safety risk value corresponding to the current target system based on the trigger risk coefficient of each unsafe behavior, the dangerous scene exposure rate corresponding to each unsafe behavior in each dangerous scene, the risk controllability and the severity of the risk accident; The fusion safety attribute value and fusion safety analysis matrix of each system are determined as follows: Analyze and confirm the functional items, performance items and information flows in the current system based on the abstract model of the current system; Determine the influence relationship between each function item, each performance item and each predetermined unsafe behavior, so as to determine the functional safety analysis matrix, functional safety attribute value and expected functional safety analysis matrix, expected functional safety attribute value respectively; Determine the security attributes of each information flow that are damaged when facing various information security threats, and determine the functional items and performance items affected when the security attributes of the information flow are damaged, so as to determine the impact relationship between the information flow and various unsafe behaviors, and further determine the information security analysis matrix and information security attribute values; Calculate the integrated safety attribute value of the current system based on the functional safety attribute value, expected functional safety attribute value and information security attribute value of the current system; The functional safety analysis matrix, expected functional safety analysis matrix and information security analysis matrix of the current system are spliced ​​to obtain the integrated safety analysis matrix of the current system; The abstract model based on the current target system and the fusion safety analysis matrix, evaluating the triggering risk coefficient of each unsafe behavior, includes: Using the reliability block diagram method, analyze and determine the failure rate of each functional item, so as to construct a functional safety risk trigger vector using the failure rates of all functional items of the current target system; Utilize scenario analysis and scenario testing to determine the trigger probability of performance limitation of each performance item, so as to construct the expected functional safety risk trigger vector using the trigger probability of all performance items of the current target system; Use the common vulnerability scoring system to evaluate the attack feasibility index of each information flow of the current target system to determine the vulnerability of each information flow; Use the expert evaluation method to evaluate the capability requirement index of each information flow of the current target system for the attacker; Based on the vulnerability and capability requirement index of each information flow, the trigger coefficient of each information flow is calculated to construct an information security risk trigger vector using the trigger coefficients of all information flows in the current target system; Based on the fused safety analysis matrix of the current target system, the functional safety risk trigger vector, the expected functional safety risk trigger vector and the information security risk trigger vector, the trigger risk coefficient of each unsafe behavior is calculated respectively.

2. The method according to claim 1, characterized in that The functional safety attribute value is determined as follows: Determine the three functional failure conditions of function loss, function error, and non-set function, and analyze whether each function item will cause predetermined unsafe vehicle behaviors under these three functional failure conditions; For each function item, the unsafe behavior that will be directly caused by the current function item when the function fails is recorded as 1, otherwise it is recorded as 0, and the influence relationship between the current function item and each unsafe behavior is obtained to obtain the analysis matrix of the current function item; The analysis matrices of each functional item in the current system are spliced ​​together to obtain a functional safety analysis matrix; Based on the Frobenius norm of the functional safety analysis matrix, a functional safety attribute value is determined.

3. The method according to claim 1, characterized in that The risk controllability of each unsafe behavior in each dangerous scenario is determined in the following way: Based on the abstract model of the current target system, analyze and confirm the security-related systems related to the current target system, the interactive content set of human-computer interaction, and the information flow chain of each remote intervention instruction; Determining an autonomous risk controllability gain coefficient, a human misuse coefficient of driving intervention, and a remote intervention controllability gain coefficient based on the safety association system, the interactive content set, and the information flow transfer chain of each remote intervention instruction respectively; For each dangerous scenario of each unsafe behavior in the corresponding relationship table between unsafe behaviors and dangerous scenarios, execute: Obtain a pre-generated classification table of autonomous risk controllability, driver intervention controllability, and remote intervention controllability; Based on the classification table, determining the autonomous risk controllability level, the driving intervention controllability level and the remote intervention controllability level to which the current unsafe behavior belongs in the current scenario respectively; Based on the autonomous risk controllability level, driving intervention controllability level, remote intervention controllability level of the current unsafe behavior in the current scenario, as well as the autonomous risk controllability gain coefficient, the human misuse coefficient and the remote intervention controllability gain coefficient, the risk controllability of the current unsafe behavior in the current scenario is comprehensively evaluated.

4. The method according to claim 1, characterized in that After calculating the fusion security risk value corresponding to the current target system, the method further includes: Based on the fused security risk value corresponding to the current target system, the security gradients of each functional item, each performance item and each information flow are derived and calculated to determine the contribution ranking to the fused security risk value.

5. A quantitative analysis device for the fusion safety risk of intelligent connected vehicles, characterized in that: The device comprises: An analysis module, for respectively confirming the functional safety attribute value, expected functional safety attribute value and information security attribute value of each system based on the pre-established abstract model of each system of the intelligent connected vehicle, so as to respectively calculate the fused safety attribute value and fused safety analysis matrix of each system, and determine the analysis priority of each system based on the fused safety attribute value; An evaluation module, for each target system whose fused safety attribute value is non-zero and is analyzed in sequence based on the analysis priority, performs: based on the abstract model of the current target system and the fused safety analysis matrix, evaluating the triggering risk coefficient of each unsafe behavior; A determination module is used to determine the correspondence table between unsafe behaviors and dangerous scenarios, and to determine the dangerous scenario exposure rate, risk controllability and risk accident severity corresponding to each unsafe behavior in each dangerous scenario; A calculation module, used to calculate the fusion safety risk value corresponding to the current target system based on the trigger risk coefficient of each unsafe behavior, the dangerous scene exposure rate corresponding to each unsafe behavior in each dangerous scene, the risk controllability and the severity of the risk accident; The fused safety attribute value and fused safety analysis matrix of each system in the analysis module are determined in the following way: Analyze and confirm the functional items, performance items and information flows in the current system based on the abstract model of the current system; Determine the influence relationship between each function item, each performance item and each predetermined unsafe behavior, so as to determine the functional safety analysis matrix, functional safety attribute value and expected functional safety analysis matrix, expected functional safety attribute value respectively; Determine the security attributes of each information flow that are damaged when facing various information security threats, and determine the functional items and performance items affected when the security attributes of the information flow are damaged, so as to determine the impact relationship between the information flow and various unsafe behaviors, and further determine the information security analysis matrix and information security attribute values; Calculate the integrated safety attribute value of the current system based on the functional safety attribute value, expected functional safety attribute value and information security attribute value of the current system; The functional safety analysis matrix, expected functional safety analysis matrix and information security analysis matrix of the current system are spliced ​​to obtain the integrated safety analysis matrix of the current system; The evaluation module is used to perform: Using the reliability block diagram method, analyze and determine the failure rate of each functional item, so as to construct a functional safety risk trigger vector using the failure rates of all functional items of the current target system; Utilize scenario analysis and scenario testing to determine the trigger probability of performance limitation of each performance item, so as to construct the expected functional safety risk trigger vector using the trigger probability of all performance items of the current target system; Use the common vulnerability scoring system to evaluate the attack feasibility index of each information flow of the current target system to determine the vulnerability of each information flow; Use the expert evaluation method to evaluate the capability requirement index of each information flow of the current target system for the attacker; Based on the vulnerability and capability requirement index of each information flow, the trigger coefficient of each information flow is calculated to construct an information security risk trigger vector using the trigger coefficients of all information flows in the current target system; Based on the integrated safety analysis matrix, functional safety risk trigger vector, expected functional safety risk trigger vector and information security risk trigger vector of the current target system, the trigger risk coefficient of each unsafe behavior is calculated respectively.

6. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any one of the methods described in claims 1-4.

7. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 4 are implemented.

8. A computer program product, characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images