Threat perception testing method and system for intelligent connected vehicles based on intrinsic security

Abstract

The present invention discloses a threat perception test method and system for intelligent networked vehicles based on intrinsic security, the method comprising: constructing several standard parts of the same category as the tested parts according to the category of the tested parts in the intelligent networked vehicles, and initializing the tested parts and standard parts; distributing standardized use cases to the initialized tested parts and standard parts for multiple rounds of testing, obtaining the test results of the tested parts and standard parts in each round of testing, and obtaining the judgment results of the tested parts according to the judgment method and judgment basis for all test results after the test is executed; and outputting feedback on the judgment results. The present invention is based on a dynamic, heterogeneous, and redundant architecture of intrinsic security, and can complete the perception, discovery, and preliminary positioning of vulnerabilities / defects of key vehicle components without relying on a priori knowledge base, providing integrated protection for functional safety and network security.

Description

Technical Field

[0001] The present invention relates to the field of intelligent networked vehicle safety technology, and in particular to an intelligent networked vehicle threat perception testing method and system based on intrinsic safety. Background Art

[0002] With the rapid development of intelligence and networking, the technology of intelligent connected vehicles (CAVs, Connected and autonomous vehicles) has been continuously improved, aiming to ensure more convenient and safe transportation for people. While CAVs bring people a comfortable driving experience, the probability of random failure of the information-physical system required for rich assisted driving functions and more and more intelligent cockpit services continues to increase. In addition, the interface of the information-physical system brings a large number of network attack threats, software vulnerabilities being exploited by hackers and other risks. It is reported that now a smart connected car contains nearly a thousand chips (10 times that of a smartphone), involving more than 200 million lines of software and hardware code (4 times that of the Windows system), and there are dozens of exposed attack entrances. Therefore, once the key components of the vehicle fail randomly or are invaded by malicious attackers, not only will the driver's privacy information be lost, but the vehicle may even be controlled by the attacker, resulting in serious loss of people's lives and property.

[0003] As an ecosystem where information and physical systems are intertwined, CAVs involve various key components inside the vehicle, including Advanced Driving Assistance System (ADAS), Telematics BOX (TBOX), In-Vehicle Infotainment (IVI), vehicle gateways and various domain controllers. This complexity makes the sources of failures / threats more diverse, thereby increasing the frequency of functional safety and network security. In addition, CAVs involve the cross-integration of multiple disciplines, and key components face the following challenges: First, "chain length", that is, the long supply chain of components makes it difficult to locate risks; second, "lack of library", that is, the lack of a priori safety knowledge base makes it difficult to perceive threats; third, "black box", that is, the opaque software and hardware codes of core components make targeted testing difficult. Therefore, it is extremely important to carry out threat perception testing of CAVs components.

[0004] The existing threat perception test methods for key components of CAVs are difficult to perceive, discover and initially locate vulnerabilities / defects of key vehicle components without relying on a priori knowledge base when faced with "long chain, missing inventory and black box". Therefore, how to build an efficient vulnerability detection technology system and tool system for key components of intelligent connected vehicles, support the construction of an endogenous security threat perception test platform, and realize the integrated protection of functional safety and network threat perception of CAVs components has become a problem that needs to be solved urgently. Summary of the invention

[0005] Technical purpose: In response to the defects in the existing technology, the present invention discloses a threat perception testing method and system for intelligent connected vehicles based on intrinsic security. Based on the dynamic, heterogeneous, and redundant (DHR) architecture of intrinsic security, it can complete the vulnerability / defect perception, discovery, and preliminary positioning of key vehicle components without relying on a priori knowledge base, providing integrated protection for functional safety and network security.

[0006] Technical solution: In order to achieve the above technical objectives, the present invention adopts the following technical solution.

[0007] A threat perception testing method for intelligent connected vehicles based on intrinsic security, including:

[0008] According to the category of the DUT in the intelligent connected car, several standard parts with the same category as the DUT are constructed, and the DUT and standard parts are initialized;

[0009] Standardized test cases are distributed to the initialized PUT and standard parts for multiple rounds of testing. The test results of the PUT and standard parts are obtained in each round of testing. After the test is completed, the judgment result of the PUT is obtained according to the judgment method and judgment basis for all test results; feedback is output on the judgment result.

[0010] A threat perception test system for intelligent networked vehicles based on intrinsic security, the system comprising: a display and control terminal, a test bench and a test cabinet connected to the display and control terminal; the test bench is used to place standard parts and tested parts and supply power to them;

[0011] The test cabinet is deployed with a mimic threat perception test server, which is used to implement the above-mentioned intelligent connected vehicle threat perception test method based on intrinsic security;

[0012] The display and control terminal deploys the mimicry threat perception platform as the front-end interface of the mimicry threat perception test server.

[0013] Beneficial effects:

[0014] (1) The present invention constructs several standard parts of the same category as the tested parts for threat perception testing. Based on the dynamic, heterogeneous, and redundant (DHR) architecture with inherent security, it can complete the vulnerability / defect perception, discovery, and preliminary positioning of key vehicle components without relying on a priori knowledge base, providing integrated protection for functional safety and network security.

[0015] (2) The present invention designs a multi-scenario test case library for functional safety and network security of intelligent connected vehicles with reference to various international standards to improve the accuracy of test results;

[0016] (3) The present invention proposes a data alignment technology based on multi-dimensional processing to ensure that the data involved in the adjudication meets the constraint conditions of "same time, same place, same content" to the greatest extent, thus ensuring the fairness of subsequent adjudication;

[0017] (4) The present invention proposes a consistency judgment basis based on dynamic threshold deviation, which can effectively solve the problem of uncertainty, instability and non-uniqueness of output data caused by the differences in software and hardware conditions of the tested parts and the standard parts;

[0018] (5) The present invention proposes a time-constrained adjudication method and a cost-constrained adjudication method, providing optional adjudication methods for actual testing process requirements, thereby achieving the purpose of cost reduction / efficiency improvement. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is a flow chart of the method of the present invention;

[0020] Figure 2 It is a framework diagram of the present invention;

[0021] Figure 3 is a system architecture diagram of the present invention;

[0022] Figure 4 It is a schematic diagram of the test scheme of the present invention;

[0023] Figure 5 is a flow chart of the adjudication of the present invention;

[0024] Figure 6 Schematic diagram of an ADAS test system according to Embodiment 1;

[0025] Figure 7 Schematic diagram of the ADAS testing method of Example 1;

[0026] Figure 8 This is a schematic diagram of a TBOX test system according to Embodiment 2;

[0027] Fig. 9 This is a schematic diagram of the TBOX testing method of Example 2. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0029] As attached Figure 1 , Attachment Figure 4 and attached Figure 5 As shown, a threat perception test method for an intelligent networked vehicle based on intrinsic security of the present invention comprises the following steps:

[0030] Step 1: According to the category of the DUT in the intelligent connected car, several standard parts with the same category as the DUT are constructed, and the DUT and standard parts are initialized;

[0031] The standard parts and the tested parts are heterogeneous. Heterogeneous Heterogeneity refers to the differences between devices of different brands, types or technical standards. These heterogeneous components may have significant differences in operating systems, processor architectures, communication protocols, etc. In some embodiments of the present invention, heterogeneous standard parts of the same category as the tested parts can be constructed from different manufacturers and models.

[0032] The initialization of the tested part and the standard part includes: controlling the tested part and the standard part to meet the constraint conditions of "same time, same place, same content"; the data alignment technology based on multi-dimensional processing is designed in the present invention to achieve that the data involved in the adjudication meets the constraint conditions of "same time, same place, same content" to the greatest extent, thereby ensuring the fairness of the subsequent adjudication;

[0033] The constraints of "same time, same place, same content" include the following:

[0034] In the time dimension, on the one hand, the local time of each device under test and standard part is corrected through global timing to ensure that the system time inside each device under test and standard part is consistent; on the other hand, by building an output information buffer pool and using short-time prediction technology, the data involved in the decision are predicted to the same moment, ensuring that the time of multiple information involved in the decision is the same.

[0035] The information buffer pool is a module used to temporarily store, manage and synchronize data from different sources. Its purpose is to temporarily save the data as it flows in and process it at the appropriate time to ensure the time consistency of subsequent processing or analysis. The information buffer pool is usually used to process asynchronously arriving data to ensure that the time points of each information are consistent during the adjudication or analysis stage.

[0036] Steps to build an information cache pool: (1) Data collection and input: Collect information flows from different data sources into the cache pool. These data refer to the data that need to be involved in the judgment, that is, the test results of the tested parts and standard parts; these data may come from multiple sources such as sensors, network requests, database queries, etc. Each piece of data usually has a timestamp to identify the time when the data was generated. (2) Cache mechanism: The queue (FIFO) method can be used to store data, and the data can be classified and stored according to the timestamp. (3) Data synchronization: The cache pool can trigger the data synchronization mechanism regularly or under specific conditions (such as the data volume reaches a threshold) to adjust the data arriving at different times to the same time. If the arrival frequency of the data source is different, the cache pool also needs to align the data, that is, to ensure that the data from different sources can be compared or fused at the same time point.

[0037] Short-term forecasting techniques refer to techniques for predicting data trends or changes within a short time frame. These techniques can predict data values ​​within a short period of time in the future based on historical data, and are usually used to ensure data consistency during processing.

[0038] Commonly used short-term forecasting methods include:

[0039] (1) Linear regression: Use a linear regression model to predict the value in the next period of time based on the past observations. This method is simple and fast to calculate.

[0040] (2) Time series forecasting models: such as the ARIMA (AutoRegressive Integrated Moving Average) model, which can make short-term forecasts based on the past trends and periodicity of the time series.

[0041] (3) Exponential smoothing: Exponential smoothing is used to make short-term forecasts by giving higher weights to recent data. It is suitable for processing time series data with obvious trends but high noise.

[0042] (4) Kalman filter: used for estimating and predicting the state of a dynamic system, and can smoothly predict state changes in a short period of time under a noisy background.

[0043] In order to achieve time synchronization of multiple channels of information, the following steps can be taken:

[0044] (1) Timestamp standardization: In the information buffer pool, the timestamps of all the multiple information involved in the decision are standardized. For example, a certain time point is selected as the benchmark, and the time of all data is adjusted to the time difference relative to the benchmark.

[0045] (2) Data compensation and interpolation: For data that is not synchronized in time, short-term prediction technology can be used to compensate or interpolate the missing data. In this way, the data is aligned to the same time point.

[0046] (3) Synchronization point selection: According to system requirements, select a synchronization point as the time point for data arbitration, for example, the first moment of every second as the synchronization point. At this point in time, all data in the cache pool should be synchronized.

[0047] (4) Data adjudication: Once all data are synchronized and compensated at the same point in time, the synchronized data can be used for adjudication, analysis, or further processing.

[0048] In the spatial position dimension, the output data of the measured part and all the standard parts are transformed to achieve mapping into the same Cartesian coordinate system, ensuring that the multi-channel output data involved in the judgment have a unified spatial position reference coordinate system; the spatial dimension refers to the position and posture in a three-dimensional Cartesian coordinate system, specifically including:

[0049] 1. Position coordinates: This usually involves the precise position of an object in three-dimensional space, usually represented by three coordinates: x, y, and z. Each coordinate axis corresponds to a dimension in space.

[0050] 2. Orientation: Orientation refers to the direction or orientation of an object in space, usually represented by Euler angles (Yaw, Pitch, Roll) or quaternions. Orientation describes how an object rotates in its position.

[0051] In the present invention, the output data of the tested part and all the standard parts carry spatial position information. In order to unify the spatial position dimension, the output data of the tested part and all the standard parts need to be mapped into the same Cartesian coordinate system to facilitate subsequent judgment and comparison.

[0052] In some embodiments of the present invention, corresponding sensors, such as cameras, lidars, IMUs, etc., can be installed on the test piece and all standard parts; and by measuring key parameters of the installation position of each sensor, coordinate transformation of the output information of the test piece and all standard parts can be achieved.

[0053] In terms of the semantic content of the output data, the output data is selectively screened or equivalently replaced through preset rules to ensure that the data involved in the arbitration is at the intersection of the semantic content of the output data of each executor.

[0054] Through preset rules, the output data is selectively screened or equivalently replaced, including: building preset rules for different standardized use cases, extracting or equivalently replacing part of the output data and then outputting it.

[0055] (1) Take lane line detection as an example: one ADAS (from manufacturer 1) may use cameras and machine learning algorithms to detect lane lines, while another ADAS (from manufacturer 2) may use lidar and rule-based methods. Despite the different detection methods, the output data will contain information such as the location and type (solid line, dashed line) of the lane lines. When fusion data is used, in order to ensure compatibility, the preset rules will only extract key information that can be provided by both, such as the location coordinates of the lane lines, without considering the differences in detection methods or additional attributes.

[0056] (2) Take obstacle recognition as an example: one ADAS (from manufacturer 1) may output the type of obstacle (such as pedestrians, vehicles, animals) and location, while another ADAS (from manufacturer 2) may only output the location. In this case, the preset rule chooses to use only the location data of the obstacle to make a decision to ensure data consistency.

[0057] S2, step 2, distribute standardized use cases to the initialized DUT and standard parts for multiple rounds of testing, obtain the test results of the DUT and standard parts in each round of testing, and obtain the judgment result of the DUT according to the judgment method and judgment basis after the test is completed; output feedback on the judgment result. The judgment result includes the preliminary location and description of the problem / abnormality, supporting the discovery and location of vulnerabilities / defects.

[0058] When distributing standardized test cases to initialized DUTs and standard parts for multiple rounds of testing, the standardized test cases are obtained from the test case library, and the same standardized test cases are distributed to the DUTs and standard parts in each round of testing, and multiple rounds of iterative testing are performed until all or a preset number of standardized test cases in the test case library are tested; the test case library includes several standardized test cases designed based on various international standards, national standards, and industry standards, and the standardized test cases include functional safety test items and network security test items;

[0059] Functional safety test items include perception function test items and decision function test items; the perception function test items include different types of obstacle recognition items and tracking ability test items in multiple test scenarios. Relevant test scenarios include: stationary scene, moving scene, stationary obstacle scene, moving obstacle scene, pedestrian collision warning scene, vehicle collision warning scene, straight lane departure scene, curved lane departure scene, etc. The types of obstacle recognition items include: pedestrians, cars, bicycles, motorcycles, etc. The tracking ability test items mainly refer to the ability of the autonomous driving system to continuously monitor and track obstacles after identifying them; including: (1) Tracking after obstacle identification: ensure that the system can continuously track the dynamic attributes of an obstacle (such as pedestrians, vehicles, obstacles) after identifying it. (2) Multi-target tracking: in complex scenarios, the system should be able to track multiple obstacles at the same time to ensure accurate grasp of the dynamic information of different targets. (3) Real-time and accuracy: Tracking should have high real-time and accuracy to ensure that in dynamically changing scenarios, the system can update and predict the position changes of obstacles in a timely manner. (4) Occlusion handling: When an obstacle is partially obscured or temporarily loses visibility, the system should be able to make reasonable estimates of the target and resume tracking.

[0060] Decision-making function test items include: decision-making warning functions such as intelligent braking (IBS), forward collision warning (FCW), pedestrian collision warning (PCW) and lane departure warning (LDW), as well as the consistency of their triggering timing and effects in relevant test scenarios.

[0061] Network security testing items include identity authentication testing, communication encryption testing, data integrity testing, intrusion detection and prevention testing, security patch management testing, physical access security testing, log and monitoring testing, error handling and recovery testing, privacy data protection testing, reverse engineering and cracking protection testing, etc.

[0062] Taking ADAS as an example, the ADAS function is defined in the design of standardized use cases according to the standard "GB / T 39263-2020 Road Vehicle Advanced Driver Assistance System (ADAS) Terms and Definitions". In addition, the test case library includes functional safety test items and network security test items, as shown in the formula , where , ,in, A collection of all test case libraries; is a set of functional safety test cases, and m ≥ 25; is a set of network security test cases, and n ≥ 15.

[0063] In the present invention, in view of the problem that the output data of the heterogeneous perception decision of the tested part and the standard part have uncertainty, instability and non-uniqueness due to the different software and hardware conditions, the present invention proposes a consistency decision basis based on dynamic threshold deviation, and the consistency decision basis based on dynamic threshold deviation includes the following contents:

[0064] On the one hand, by extending the judgment logic of consistency from "equal values" to "equivalent values ​​within the preset threshold range", and according to the diversity of the output data of the tested parts and standard parts, different judgment strategies are adopted for different types of output data. The judgment strategies include precise judgment and approximate judgment. The output data of the tested parts and standard parts are divided into two data types: Boolean and non-Boolean; precise judgment is used to process Boolean data types, that is, when output a is equal to output b, the two are judged to be consistent, otherwise, the two are judged to be inconsistent. Approximate judgment is used to process non-Boolean data types, that is, when output a and output b are approximately equal within the preset threshold range, that is, the difference between output a and output b is within the preset threshold range, the two are judged to be consistent; otherwise, the two are judged to be inconsistent. The output data of the tested parts and standard parts in different standardized case tests correspond to different preset thresholds. For example, if the two output results are 1.1 and 1.3 respectively, then the preset threshold may be set to a smaller floating range, such as a preset threshold value of 0.5; if the two output results are 105 and 108 respectively, then the preset threshold may be set to a larger floating range, such as a preset threshold value of 10; therefore, the preset threshold is set according to the actual situation.

[0065] On the other hand, the anomaly counting method based on the first-in-first-out queue avoids the normal noise faced by the device under test; the present invention designs an anomaly counting method based on the first-in-first-out queue to analyze the abnormal conditions of the device under test in the recent period of time, and makes full use of the continuous effect or the cumulative effect to distinguish whether the device under test is facing normal noise fluctuations or facing failures or network threats, so as to eliminate the interference caused by the instability of the data itself to the greatest extent. Ultimately, the false alarm rate of the decision is greatly reduced, and the robustness and reliability of the decision are improved. The anomaly counting method based on the first-in-first-out queue is to count the abnormal conditions in chronological order. For example, the result detected in the first second is labeled as 1, and the result detected in the second second is labeled as 2. The test results of the device under test recorded in chronological order can more conveniently determine whether the test results are normal noise or abnormal noise in chronological order.

[0066] The purpose of the consistency determination based on dynamic threshold deviation in the present invention is to determine two approximately equal data as equal, thereby solving the problem of uncertainty, instability and non-uniqueness of output data caused by differences in software and hardware conditions.

[0067] During the adjudication process, since the actual testing process may be subject to time efficiency and cost constraints, the use of more standard test components can achieve the testing purpose at one time. However, more standard test components may result in higher costs and waste of resources. Therefore, the present invention designs two adjudication methods based on the consistency adjudication basis of dynamic threshold deviation, namely, a time-constrained adjudication method and a cost-constrained adjudication method. The adjudication method can be adjusted according to needs during the actual testing process.

[0068] The time-bound adjudication method includes: after multiple rounds of testing, the test results of the tested piece and the standard parts in each round are obtained. If the test result of the tested piece is the same as the test results of all the standard parts, or the test result of the tested piece and the test results of half of the standard parts meet the consistency adjudication basis based on the dynamic threshold deviation, the adjudication is passed; if the test result of the tested piece and the test results of half of the standard parts do not meet the consistency adjudication basis based on the dynamic threshold deviation, the adjudication is not passed;

[0069] In the time-bound adjudication method, in order to improve the efficiency of adjudication, more standard parts are usually used for testing. Assume that there are n standard parts. (To ensure the reliability of the decision, n≥5), 1 DUT , only in the loop input test case library Under all completion conditions, the device under test and Elements in a collection The output results are the same as More than n / 2 element output results meet the consistency judgment basis of the dynamic threshold deviation, and can pass the judgment; if the input test case library The device under test appears during the process and Elements in a collection The output result does not meet the consistency decision basis of the dynamic threshold deviation, that is, the decision fails.

[0070] In the cost-constrained adjudication method, in order to reduce the cost of the adjudication process and avoid waste of resources, generally only four standard parts are used. and 1 DUT Make a ruling; the specific process is as follows:

[0071] First adopt and With the device under test Conduct initial testing, and As a backup decision component; loop into the test case library during the test process If all the conditions are met, , and the DUT The test results meet the consistency judgment basis of the dynamic threshold deviation and the judgment is passed;

[0072] Assumptions , and the DUT During the test cycle Test results and and the DUT If the test result does not meet the numerical equivalence within the preset threshold range, the replace If the output result after replacement meets the consistency judgment basis of the dynamic threshold deviation, it is considered There is an abnormality, the device under test Test passed; Test results and and the DUT The same applies when the test result does not meet the numerical equivalence within the preset threshold range;

[0073] Assumptions , and the DUT During the test cycle of the use case, the device under test Test results and and If the test result does not meet the consistency judgment basis of the dynamic threshold deviation, the Replace the DUT If the output result after replacement satisfies the numerical equivalence within the preset threshold range, the DUT is considered There is an abnormality, the device under test The test fails; if the replacement The output is and If the output results are still quite different, enable replace or One of them, if replaced The output result is the same as If the output result meets the consistency judgment basis of the dynamic threshold deviation, it is considered and If there is an abnormality, update the standard parts and test again. Update the standard parts by replacing and Then test again.

[0074] According to the above steps, the present invention can select a time-constrained arbitration method and a cost-constrained arbitration method. Both arbitration methods can effectively detect functional safety and network security failure problems caused by hardware design defects or backdoor vulnerability attacks on the test parts, and realize integrated protection of functional safety and network security of test components.

[0075] If the test case passes successfully, the next test case will be tested. If it fails, the positioning test case will be executed according to the plan to preliminarily determine the problem module. This process supports manual intervention, and the test case and standard comparison parts can be adjusted based on the results of the previous round. For example, the cost-constrained arbitration method describes the need to start spare parts and requires manual intervention and adjustment, including replacement of standard parts.

[0076] As attached Figure 2 and attached Figure 3 As shown, the present invention also discloses a threat perception test system for intelligent networked vehicles based on intrinsic safety, which is used to implement the above-mentioned threat perception test method for intelligent networked vehicles based on intrinsic safety. The system includes: a display and control terminal and a test bench, a test cabinet, and a display screen that are communicatively connected to the display and control terminal;

[0077] The test bench is used to place test equipment, which includes standard parts and tested parts. The tested parts are the components to be tested in actual needs, and the standard parts are heterogeneous devices of the components to be tested. Before the endogenous security threat perception test, a set of heterogeneous components must be built for each component as standard comparison components.

[0078] The test bench is equipped with corresponding power supplies and wiring harnesses, which are used to connect the components to be tested for power supply, display, and other operations (such as DP cables, power cables, HDMI cables, etc.). After the test equipment is placed on the test bench and connected to the power supply, it is convenient for subsequent testing of endogenous security threat perception.

[0079] Standard parts and tested parts need to be placed on the test bench. According to the actual test requirements, such as the number of standard parts required, multiple test benches can be set up to accommodate all standard parts and tested parts.

[0080] The test cabinet is deployed with a mimetic threat perception test server and switching tools, etc., and is connected to the test bench, display and control terminal, etc. The mimetic threat perception test server is the main platform for the deployment of the mimetic threat perception platform and the threat perception vulnerability discovery and positioning toolset, and is deployed on the Ubuntu server according to the tool support type. The mimetic threat perception test server is used to implement the above-mentioned intelligent connected vehicle threat perception test method based on intrinsic security. The mimetic threat perception test server includes a test case library and a decision module. The test case library includes several standardized use cases. The decision module is used to distribute standardized use cases to the initialized DUT and standard parts for multiple rounds of testing. Each round of testing obtains the test results of the DUT and standard parts, and the decision results of the DUT are obtained according to the decision method and decision basis; after the test is executed, all decision results of the DUT are summarized.

[0081] The display and control terminal deploys the mimic threat perception platform, which serves as the front-end interface of the mimic threat perception test server and is the device that testers directly operate during testing. The display screen provides the device with the video information required for testing, such as the type, quantity, test time, and test results (type of threat perception) of the component being tested.

[0082] Embodiment 1

[0083] In this embodiment, the focus is on ADAS construction and testing, see Figure 6 and Figure 7 , an endogenous security threat perception testing platform, comprising the following steps:

[0084] Step 1: Deploy the test bench, test cabinet, display and control terminal, and display screen.

[0085] Step 2: Deploy the components to be tested on the test bench, including the tested components and standard components. First, design a multi-executor serial transmission method. By using the decision-executor transmission technology, ensure the normal transmission of test cases, and then distribute unified standardized test cases.

[0086] Step 3: After conducting a round of testing, determine the next round of test cases based on the test results and the automated testing plan.

[0087] Step 4: Perform cyclic testing according to step 3 until all test cases are completed, summarize and analyze the test results, provide a preliminary location and description of the problem / anomaly, and support vulnerability / defect discovery and location.

[0088] The following is a complete description of the specific process of this embodiment:

[0089] (1) Deploy the test bench and set up the corresponding power supply, corresponding wiring harness, etc., and turn on the test cabinet, display terminal, display and other equipment.

[0090] (2) Deploy one ADAS under test and three non-homologous heterogeneous ADAS on the test bench. Then, based on the data alignment technology of multi-dimensional processing, the ADAS standard test case library is synchronously input according to the distance, speed and decision-making for each ADAS based on the distance, speed and decision-making. The ADAS endogenous safety threat test standardized case is defined according to the "GB / T 39263-2020 Road Vehicle Advanced Driving Assistance System (ADAS) Terminology and Definition" standard for ADAS functions. Combined with the endogenous safety dynamic heterogeneous redundancy characteristics, the common functions and common problems of ADAS are tested, and the obstacle and lane line perception function, braking decision function, FCW, PCW and LDW collision warning functions, CAN bus IDS intrusion detection function and UDS diagnostic service security of ADAS are tested from the perspectives of functional safety and network security. The detailed test items in the functional safety case library and network security case library in its standard test case library are as follows:

[0091] (2.1) Functional safety test cases include: front obstacle recognition, collision time monitoring, forward collision warning, lane departure, etc.

[0092] (2.2) Network security test cases include: fuzzy attacks, vehicle control command tampering, adversarial sample attacks and malicious message injection.

[0093] (3) We adjust the appropriate adjudication method according to existing conditions or test costs, and implement an intrinsic safety adjudication system to perform intrinsic safety adjudication on the outputs of standard parts and test parts based on consistency adjudication based on dynamic threshold deviation.

[0094] (3.1) If a time-binding adjudication method is chosen, the testing process is n (n≥5) ADAS standard components , 1 ADAS component to be tested , only in the loop input test case library All completed conditions, and Elements in a collection The output results are the same as or More than n / 2 element output results meet the consistency judgment basis of the dynamic threshold deviation, and can pass the judgment; if the input test case library Appear during the process and Elements in a collection The output result does not meet the consistency judgment basis of the dynamic threshold deviation, that is, the judgment fails. The tester can intervene in the scheduling process based on the intermediate results and replace the standard parts. Elements in, adjustments wait.

[0095] If the cost-constrained adjudication method is chosen, the test process uses only four standard ADAS components. and 1 test ADAS component Make a ruling.

[0096] (3.2.1) First, two standard ADAS components are used and Testing and testing ADAS components Conduct initial testing, and As a backup decision component. Cycle into the test case library during the test process If all the conditions are met, , and The test results meet the consistency decision criteria for dynamic threshold deviation and are approved.

[0097] (3.2.2) Assumptions , and During the test cycle Component test results and and If the test results of two ADAS components do not meet the consistency judgment basis of dynamic threshold deviation, the components will be started. replace If the output result after replacement meets the consistency judgment basis of the dynamic threshold deviation, it is considered There is an abnormality in the component. Component test passed; Component test results and and The same applies when the test results of two components do not satisfy numerical approximation or equivalence within a certain threshold range.

[0098] (3.2.3) Assumptions , and During the test cycle Component test results and and If the test results of two ADAS components do not meet the consistency judgment basis of dynamic threshold deviation, the components will be started. replace If the output result after replacement meets the consistency judgment basis of the dynamic threshold deviation, it is considered There is an abnormality in the component. Component test failed; if replaced Component output results and and If the component output is still inconsistent, enable Parts Replacement or If one of the parts is replaced The output of the component is The consistency judgment basis of the component output result meeting the dynamic threshold deviation is considered and If there is an abnormality in the component, update the standard component and test again.

[0099] (4) After the system completes all test items in the ADAS test case library, it generates a comprehensive test report for ADAS and realizes the discovery and location of ADAS vulnerabilities / defects.

[0100] Embodiment 2

[0101] In this embodiment, the construction and testing of TBOX are mainly carried out. This embodiment is basically the same as the first embodiment, except that:

[0102] In this embodiment, see Figure 8 and Fig. 9 ,The test case library mainly includes : configuration delivery, control instructions, door control, light control, fuzzy attack, denial of service attack and adversarial sample attack.

[0103] The present invention also discloses an electronic device, comprising: a memory for storing a computer program; and a processor for executing the computer program, so that the device executes the aforementioned intelligent connected vehicle threat perception testing method based on intrinsic security.

[0104] The present invention also provides a computer storage medium, on which a computer program is stored. When the computer program is executed, the device executing the computer program implements the aforementioned intelligent connected vehicle threat perception testing method based on intrinsic security.

[0105] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of the present application are only used as name identifiers and do not represent the first or second in order.

[0106] It can be known from the description of the above implementation mode that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, and the computer software product can be stored in a storage medium, and the memory can be various types of memory, which can be a random access memory, a read-only memory, a flash memory, etc., such as a read-only memory (English: read-only memory, ROM) / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0107] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same and similar parts between the various embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. The device embodiments described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0108] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A threat perception testing method for intelligent connected vehicles based on intrinsic security, characterized in that: The method comprises: According to the category of the DUT in the intelligent connected car, several standard parts with the same category as the DUT are constructed, and the DUT and standard parts are initialized; After the initialization, standardized test cases are distributed to the tested device and the standard parts for multiple rounds of testing. The test results of the tested device and the standard parts are obtained in each round of testing. After the test is completed, the judgment result of the tested device is obtained according to the judgment method and judgment basis for all test results; feedback is output on the judgment result; The basis for the decision is a consistent basis for decision based on dynamic threshold deviations, including: Expand the judgment logic of consensus from numerical equality to numerical equivalence within a preset threshold range, make precise judgments on Boolean data types, and make approximate judgments on non-Boolean data types; The abnormal counting method based on the first-in-first-out queue avoids the normal noise faced by the device under test; The adjudication methods include time-bound adjudication methods and cost-bound adjudication methods. The adjudication methods are adjusted according to needs during the actual testing process. The time-bound adjudication method includes: after multiple rounds of testing, the test results of the tested piece and the standard parts in each round are obtained. If the test result of the tested piece is the same as the test results of all the standard parts, or the test result of the tested piece and the test results of half of the standard parts meet the consistency adjudication basis based on the dynamic threshold deviation, the adjudication is passed; if the test result of the tested piece and the test results of half of the standard parts do not meet the consistency adjudication basis based on the dynamic threshold deviation, the adjudication is not passed; In the time-binding adjudication method, it is assumed that n Standard parts , n≥5, 1 DUT , only in the loop input test case library Under all completion conditions, the device under test and Elements in a collection The output results are the same as or More than n / 2 element output results meet the consistency judgment basis of the dynamic threshold deviation, that is, pass the judgment; if the input test case library The device under test appears during the process and Elements in a collection The output result does not meet the consistency decision basis of the dynamic threshold deviation, that is, the decision is not passed; In the cost-constrained adjudication method, four criteria are used: and 1 DUT Make a ruling; the specific process includes: First adopt and With the device under test Conduct initial testing, and As a backup decision component; loop into the test case library during the test process If all the conditions are met, , and The test results meet the consistency judgment basis of the dynamic threshold deviation and the judgment is passed; Assumptions , and the DUT During the test cycle Test results and and If the test result does not meet the numerical equivalence within the preset threshold range, the replace If the output result after replacement meets the consistency judgment basis of the dynamic threshold deviation, it is considered There is an abnormality, the device under test Test passed; Test results and and The same applies when the test results do not satisfy numerical approximation or equivalence within a certain threshold range; Assumptions , and the DUT During the test cycle of the use case, the device under test Test results and and If the test result does not meet the consistency judgment basis of the dynamic threshold deviation, the replace If the output result after replacement satisfies the numerical equivalence within the preset threshold range, the DUT is considered There is an abnormality, the device under test The test fails; if the replacement The output is and If the output results are still quite different, enable replace or One of them, if replaced The output of the file is The consistency judgment basis of the output result meeting the dynamic threshold deviation is considered and If there is an abnormality, update the standard parts and test again.

2. According to claim 1, a threat perception testing method for intelligent connected vehicles based on intrinsic security is characterized by: Initializing the tested part and the standard part includes: controlling the tested part and the standard part to meet the constraints of the same time, the same place, and the same content.

3. The method for testing threat perception of intelligent connected vehicles based on intrinsic security according to claim 2 is characterized in that: The same time, same place, same content constraints include: In the time dimension, on the one hand, the local time of each DUT and standard part is corrected through global timing to ensure that the system time inside each DUT and standard part is consistent; on the other hand, by building an output information buffer pool and using short-time prediction technology, the data involved in the decision are predicted to the same time, ensuring that the time of multiple information involved in the decision is the same; In the spatial position dimension, coordinate transformation is performed on the output data of the tested part and all standard parts to achieve mapping into the same Cartesian coordinate system, ensuring that the multi-channel output data involved in the adjudication have a unified spatial position reference coordinate system; In terms of the semantic content of the output data, the output data is selectively screened or equivalently replaced through preset rules to ensure that the data involved in the arbitration is at the intersection of the semantic content of the output data of each executor.

4. The method for testing threat perception of intelligent connected vehicles based on intrinsic security according to claim 3 is characterized by: To ensure that the multiple information channels involved in the decision-making process are time-consistent, the following steps are included: Timestamp standardization: In the information buffer pool, the timestamps of all the multiple information involved in the decision are standardized; Data compensation and interpolation: For data that is not synchronized in time, short-term prediction technology is used to compensate or interpolate the missing data; Synchronization point selection: Select a synchronization point as the time point for data arbitration.

5. The method for testing threat perception of intelligent connected vehicles based on intrinsic security according to claim 1, characterized in that: When distributing standardized test cases to initialized DUTs and standard parts for multiple rounds of testing, the standardized test cases are obtained from the test case library, and unified standardized test cases are distributed to DUTs and standard parts in each round of testing; the test case library includes several standardized test cases designed based on various international standards, national standards, and industry standards; Standardized use cases include functional safety test items and cybersecurity test items; Functional safety test items include perception function test items and decision-making function test items; The perception function test items include different types of obstacle recognition items and tracking ability test items in multiple test scenarios; the decision-making function test items include the decision-making warning function and its consistency in triggering timing and effect in relevant test scenarios; decision-making warnings include intelligent braking, forward collision warning, pedestrian collision warning and lane departure warning.

6. A threat perception test system for intelligent connected vehicles based on intrinsic security, characterized in that: The system includes: a display and control terminal and a test bench and a test cabinet connected to the display and control terminal; the test bench is used to place standard parts and tested parts and provide power for them; The test cabinet is deployed with a mimic threat perception test server, and the mimic threat perception test server is used to implement a threat perception test method for an intelligent connected vehicle based on intrinsic security as described in any one of claims 1-5; The display and control terminal deploys the mimicry threat perception platform as the front-end interface of the mimicry threat perception test server.

Images