A remote drill attack and defense method and system based on networked vehicles

Abstract

The present invention provides a remote drill attack and defense method and system based on networked vehicles, wherein players access a virtualized environment on a player-side platform, and the attacking player performs vulnerability mining and attacks on the virtualized environment on the player-side platform; the defending player configures a defense mechanism on the player-side platform for the vulnerability mining and attacks performed by the attacking player, and the system feeds back the results of the vulnerability mining and attacks and the defense results. The present invention realizes the construction of a virtualized environment for networked vehicles and improves the efficiency and accuracy of attack and defense drills.

Description

Technical Field

[0001] The present invention relates to the technical field of virtual simulation of networked vehicles, and in particular to a remote attack and defense method and system based on networked vehicles. Background Art

[0002] Intelligent networking is the development trend of the current automotive industry. It combines traditional cars with advanced technologies such as the Internet and artificial intelligence to provide drivers and passengers with a safer and smarter travel experience. However, with the widespread application of intelligent connected vehicles, vehicle network security issues have become increasingly prominent and have become one of the important factors restricting its development.

[0003] In traditional vehicle cybersecurity testing, physical vehicles are usually required for testing, and personnel need to be in close contact with the vehicles. This method is not only costly, but also may cause safety risks to the actual vehicles and drivers. In addition, due to the limited number of physical vehicles, it is difficult to meet the needs of large-scale drills, and it is also difficult to simulate various complex attack scenarios.

[0004] To solve this problem, existing technologies and methods often use safety testing methods based on physical vehicles. Although this method can simulate the real vehicle environment, it is costly, resource-limited, and has certain safety risks. In addition, due to the limitation of the number of physical vehicles, it is difficult to implement large-scale safety drills.

[0005] Therefore, it is particularly important to develop a security drill and attack and defense platform for intelligent connected vehicles based on virtualization technology. This platform can simulate the real vehicle network environment through virtualization technology, allowing contestants to conduct vulnerability mining, attack simulation and defense practice through remote access, thereby reducing the cost and risk of security testing, while also improving the effect of the drill and the participation of contestants. Summary of the invention

[0006] In view of the above problems, the present invention proposes a remote attack and defense method and system based on a networked vehicle, wherein the method specifically includes the following steps:

[0007] S1. Players log in to the player platform;

[0008] The players include: attackers and defenders;

[0009] S2. After obtaining the player information, the player-side platform verifies the player's identity information. After the verification is passed, the player is allowed to access the virtualized environment through the VPN dedicated line;

[0010] The contestant identity information includes: the contestant's user name, password, and fingerprint characteristics;

[0011] The virtualized environment is a connected vehicle virtualization platform;

[0012] S3. The attacking player conducts vulnerability mining and attacks on the virtualized environment on the player-side platform; the defending player configures a defense mechanism on the player-side platform against the vulnerability mining and attacks conducted by the attacking player;

[0013] S4. Feedback the vulnerability discovery and attack results to the attacking players through the player-side platform, and feedback the defense results to the defending players through the player-side platform;

[0014] S5. Switch to the virtualization environment and repeat steps S3 to S5 until the drill is completed.

[0015] Furthermore, the step S2 specifically includes the following steps:

[0016] S21. The player-side platform obtains the username, password, and fingerprint characteristics of the attacking player or the defending player;

[0017] S22. The player-side platform verifies the user name, password, and fingerprint features. If the verification is successful, step S23 is executed; otherwise, the current player is prohibited from logging into the player-side platform;

[0018] S23. When the player type corresponding to the user name, password, and fingerprint feature is an attacking player, the player-side platform marks the player as an attacking player and allows the player to access the virtualized environment via a VPN dedicated line;

[0019] When the player type corresponding to the user name, password, and fingerprint feature is a defending player, the player-side platform marks the player as a defending player and allows the player to access the virtualized environment through a VPN dedicated line.

[0020] Furthermore, before step S1, the method further includes: constructing a virtualized environment;

[0021] The construction of the virtualized environment specifically includes the following steps:

[0022] S01. Connecting vehicle components to the virtual environment using a first connection method;

[0023] The first connection mode includes: one of Bluetooth, WiFi, radio frequency signal, and V2X;

[0024] S02. Using the QEMU method to simulate and run the firmware of the vehicle's in-vehicle infotainment system, in-vehicle communication system, and in-vehicle gateway system;

[0025] S03. Use the SDN method to topologically connect multiple vehicle components and multiple firmware to form a virtualized environment.

[0026] Furthermore, the step S3 specifically includes the following steps:

[0027] S31. The attacker first uses an automatic vulnerability scanning tool to discover vulnerabilities in the virtualized environment, and then launches an attack on the virtualized environment based on the vulnerability discovery results;

[0028] S32. The defending player first uses an automatic vulnerability scanning tool to discover vulnerabilities in the virtualized environment, and then defends the virtualized environment based on the vulnerability discovery results and the attack behavior of the attacking player.

[0029] The present invention also proposes a remote drill attack and defense system based on a networked vehicle, the system comprising: a player-end platform, a remote access module, a virtualized environment module, a vulnerability mining and attack module, a defense practice module, and a real-time feedback and reporting module;

[0030] Among them, the players log in to the player-side platform;

[0031] The players include: attackers and defenders;

[0032] After obtaining the player information, the player-side platform verifies the player's identity information. After the verification is passed, the player is allowed to access the virtualization environment module through the VPN dedicated line;

[0033] The contestant identity information includes: the contestant's user name, password, and fingerprint characteristics;

[0034] The virtualized environment module is a connected vehicle virtualization platform;

[0035] Vulnerability mining and attack module, the attacking player uses the vulnerability mining and attack module to mine and attack the virtualization environment module through the player platform;

[0036] A defense practice module, in which the defending player uses the defense practice module through the player-side platform to defend against the vulnerability mining and attack configuration defense mechanism conducted by the attacking player;

[0037] The real-time feedback and reporting module feeds back the results of vulnerability discovery and attack to the attacking players through the player-side platform, and feeds back the defense results to the defending players through the player-side platform.

[0038] Furthermore, the virtualized environment module also includes a vehicle physical access module, a firmware simulation module, and an SDN network topology module;

[0039] The vehicle physical access module connects the vehicle components to the virtual environment module using a first connection method;

[0040] The first connection mode includes: one of Bluetooth, WiFi, radio frequency signal, and V2X;

[0041] The firmware simulation module uses the QEMU method to simulate the firmware of the vehicle's in-vehicle infotainment system, in-vehicle communication system, and in-vehicle gateway system;

[0042] The SDN network topology module uses the SDN method to topologically connect multiple vehicle components and multiple firmware to form a virtualized environment.

[0043] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above description and other purposes, features and advantages of the present invention more obvious and easy to understand, the preferred embodiments are specifically cited and described in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0045] Figure 1 This is a structural diagram of a remote attack and defense system based on networked vehicles. DETAILED DESCRIPTION

[0046] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0047] In the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be connected, detachably connected, or integrated; it can be mechanically connected or electrically connected; it can be directly connected or indirectly connected through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0048] Embodiment 1

[0049] The present invention proposes a remote drill attack and defense method based on a networked vehicle, and the method specifically comprises the following steps:

[0050] S1. Players log in to the player platform;

[0051] The players include: attackers and defenders;

[0052] S2. After obtaining the player information, the player-side platform verifies the player's identity information. After the verification is passed, the player is allowed to access the virtualized environment through the VPN dedicated line;

[0053] The contestant identity information includes: the contestant's user name, password, and fingerprint characteristics;

[0054] The virtualized environment is a connected vehicle virtualization platform;

[0055] S3. The attacking player conducts vulnerability mining and attacks on the virtualized environment on the player-side platform; the defending player configures a defense mechanism on the player-side platform against the vulnerability mining and attacks conducted by the attacking player;

[0056] S4. Feedback the vulnerability discovery and attack results to the attacking players through the player-side platform, and feedback the defense results to the defending players through the player-side platform;

[0057] S5. Switch to the virtualization environment and repeat steps S3 to S5 until the drill is completed.

[0058] Furthermore, the step S2 specifically includes the following steps:

[0059] S21. The player-side platform obtains the username, password, and fingerprint characteristics of the attacking player or the defending player;

[0060] S22. The player-side platform verifies the user name, password, and fingerprint features. If the verification is successful, step S23 is executed; otherwise, the current player is prohibited from logging into the player-side platform;

[0061] S23. When the player type corresponding to the user name, password, and fingerprint feature is an attacking player, the player-side platform marks the player as an attacking player and allows the player to access the virtualized environment via a VPN dedicated line;

[0062] When the player type corresponding to the user name, password, and fingerprint feature is a defending player, the player-side platform marks the player as a defending player and allows the player to access the virtualized environment through a VPN dedicated line.

[0063] Furthermore, before step S1, the method further includes: constructing a virtualized environment;

[0064] The construction of the virtualized environment specifically includes the following steps:

[0065] S01. Connecting vehicle components to the virtual environment using a first connection method;

[0066] The first connection mode includes: one of Bluetooth, WiFi, radio frequency signal, and V2X;

[0067] S02. Using the QEMU method to simulate and run the firmware of the vehicle's in-vehicle infotainment system, in-vehicle communication system, and in-vehicle gateway system;

[0068] S03. Use the SDN method to topologically connect multiple vehicle components and multiple firmware to form a virtualized environment.

[0069] Furthermore, the step S3 specifically includes the following steps:

[0070] S31. The attacker first uses an automatic vulnerability scanning tool to discover vulnerabilities in the virtualized environment, and then launches an attack on the virtualized environment based on the vulnerability discovery results;

[0071] S32. The defending player first uses an automatic vulnerability scanning tool to discover vulnerabilities in the virtualized environment, and then defends the virtualized environment based on the vulnerability discovery results and the attack behavior of the attacking player.

[0072] Furthermore, the step S5 specifically includes the following steps:

[0073] S51. When the attacking and defending players complete the attack and defense drill for the current virtualized environment, if the attack and defense drill for all virtualized environments is not completed, execute step S52; otherwise, the attack and defense drill ends;

[0074] Among them, each attack and defense drill is conducted on one or more virtualized environments;

[0075] After the attacker and defender complete the attack and defense drill in the current virtual environment, the connected vehicle attacker drill management platform records the attack and defense drill log into the attack and defense drill log collection;

[0076] The attack and defense drill log includes: virtualization environment configuration information, virtualization environment vulnerabilities, attacker attack paths and attack results, defender defense operation behavior and defense results;

[0077] The attack results include: success, failure;

[0078] The defense results include: successful, unsuccessful;

[0079] The virtualization environment configuration information includes: the name of the virtualization environment, the model information of the vehicle parts connected to the virtualization environment, the model information of the firmware in the virtualization environment, and the topological connection structure of multiple vehicle parts and multiple firmware in the virtualization environment;

[0080] The attack path of the attacker includes: vehicle component model information and firmware model information involved in the attack path arranged in chronological order of the attack behavior;

[0081] S52. Switch the virtualization environment;

[0082] S53. Repeat steps S3 to S5 until the drill is completed.

[0083] Furthermore, the step S52 specifically includes the following steps:

[0084] S521. Obtain model information of the vehicle parts or firmware to be switched, and obtain model information of new vehicle parts or firmware;

[0085] The model information includes the name, manufacturer, and version of the vehicle parts or firmware;

[0086] S522. Obtaining an unadapted set corresponding to a new vehicle component or firmware;

[0087] The unmatched set includes model information of vehicle parts and firmware that cannot be matched by the vehicle parts or firmware;

[0088] S523. Determine whether there are vehicle parts or firmware in the current virtualization environment other than the vehicle parts or firmware to be switched, which have the same model information as the vehicle parts or firmware in the unadapted set;

[0089] If it exists, execute step S524; if it does not exist, execute step S525;

[0090] S524. When there is a vehicle component in the other vehicle components that has the same model information as the vehicle component in the unmatched set When the first user directly transfers the vehicle parts Replace with vehicle parts that are compatible with the new vehicle parts or firmware described in step S521;

[0091] Wherein, n is the total number of components in the other vehicle components that have the same model information as the components in the unmatched set; The nth component among the other vehicle components having the same model information as the component in the unmatched set; n≥1;

[0092] The first user is the organizer;

[0093] When there is a firmware with the same model information as the firmware in the unadapted set in the other firmwares, }, determine whether the ratio of m to the total number of firmware in the current virtualization environment is greater than 50%. If so, the first user replaces all firmware in the current virtualization environment as a whole, and replaces the vehicle parts to be switched with new vehicle parts to form a new virtualization environment, and executes step S526; otherwise, the virtualization environment automatically replaces the firmware { } replaced with firmware that is compatible with the new vehicle parts or firmware described in step S521;

[0094] Wherein, m is the total number of firmwares in the other firmwares having the same model information as the firmware in the unadapted set; The mth firmware among the other firmwares having the same model information as the firmware in the unadapted set; m≥1;

[0095] Execute step S525;

[0096] S525. Replace the vehicle parts or firmware to be switched with new vehicle parts or firmware to form a new virtualized environment;

[0097] S526. Feedback the vulnerability results, attack paths, and defense operation behaviors corresponding to the new virtualized environment described in step S525 to the attacking player and the defending player.

[0098] Furthermore, the step S526 specifically includes the following steps:

[0099] S5261. Obtain vehicle component model information and firmware model information connected to the new virtualized environment;

[0100] S5262. Compare the first similarity r between the virtualized environment in each attack and defense exercise log in the attack and defense exercise log set and the new virtualized environment;

[0101] The first similarity r= ;

[0102] Where p is equal to the total number of vehicle parts and firmware with the same model information between the new virtualized environment and the virtualized environment in the attack and defense exercise log;

[0103] Q equals the total number of vehicle components and firmware in the new virtualized environment;

[0104] When the first similarity r is greater than 60%, executing step S5263; otherwise, stopping feeding back the vulnerability results, attack paths, and defense configuration information corresponding to the new virtualized environment to the attacking player and the defending player;

[0105] S5263. Extract multiple attack and defense drill logs corresponding to virtualized environments whose first similarity r with the new virtualized environment is greater than 60% from the attack and defense drill log set, and obtain the virtualized environment names, multiple vehicle component model information, and multiple firmware model information in the multiple attack and defense drill logs to form a similarity set {( ), ( ),…, ( )};

[0106] Wherein, k is the total number of attack and defense drill logs corresponding to virtualized environments whose first similarity r with the new virtualized environment is greater than 60% in the attack and defense drill log set; The virtualization environment name, multiple vehicle parts model information, and multiple firmware model information extracted from the attack and defense drill log corresponding to the kth virtualization environment in the attack and defense drill log set having a first similarity r greater than 60% with the new virtualization environment;

[0107] S5264. Obtain the attack paths of the attackers whose attack results are successful in multiple attack and defense exercise logs in the attack and defense exercise log set; and count the number of times each vehicle component and firmware involved in the obtained attack path of the attacker;

[0108] S5265. According to the number of times of each vehicle component and the number of firmware in step S5264, the vehicle components and firmware are uniformly sorted in descending order;

[0109] S5266. Weights are assigned to vehicle parts and firmware in descending order, wherein in the sorting result of step S5265, the first ranked vehicle part or firmware obtains the highest weight; the last ranked vehicle part or firmware obtains the lowest weight;

[0110] The weight allocation is performed according to a first weight allocation table;

[0111] Wherein, the first weight allocation table stores a plurality of different weights in descending order of weight;

[0112] Among them, the maximum value in the first weight allocation table is 0.9 and the minimum value is 0.3;

[0113] S5267. Calculate the new virtualization environment and {( ), ( ),…, ( )};

[0114] Among them, the second similarity h= ;

[0115] Wherein, t1 is the number of vehicle components connected to the new virtualized environment; t2 is the number of firmware in the new virtualized environment; The weight corresponding to the i-th vehicle component connected to the new virtual environment; The weight corresponding to the jth firmware connected to the new virtualization environment;

[0116] Among them, when the new virtualization environment is ), ( ),…, ( )} When performing the second similarity calculation:

[0117] When the new virtual environment connects the vehicle parts model information with When the model information of a connected vehicle component is the same and the vehicle component connected to the new virtual environment exists in the vehicle components that have been assigned weights in step S5266, the weight assigned to the vehicle component connected to the new virtual environment in step S5266 is used as the weight corresponding to the vehicle component when calculating the second similarity;

[0118] When the new virtual environment connects the vehicle parts model information with When the model information of a connected vehicle component is the same and the vehicle component connected to the new virtual environment does not exist in the vehicle components that have been assigned weights in step S5266, the weight corresponding to the vehicle component in the second similarity calculation is set to 0.1;

[0119] When the new virtual environment connects the vehicle parts model information with When the model information of any connected vehicle parts is different, the weight corresponding to the vehicle parts connected to the new virtualized environment during the second similarity calculation is set to 0;

[0120] S5268. Connect the new virtualization environment to {( ), ( ),…, ( )}, and sorting the multiple second similarities h calculated for each virtualization environment in order from large to small; obtaining the attack and defense drill logs corresponding to the top three virtualization environments, and feeding back the vulnerabilities of the virtualization environments, the attack paths of the attackers, and the attack results in the attack and defense drill logs to the attackers, and feeding back the defense operation behaviors and defense results in the attack and defense drill logs to the defenders.

[0121] Embodiment 2

[0122] The present invention also proposes a remote drill attack and defense system based on a networked vehicle, wherein the system comprises: a player-side platform, a remote access module, a virtualized environment module, a vulnerability mining and attack module, a defense practice module, and a real-time feedback and reporting module;

[0123] Among them, the players log in to the player-side platform;

[0124] The players include: attackers and defenders;

[0125] After obtaining the player information, the player-side platform verifies the player's identity information. After the verification is passed, the player is allowed to access the virtualization environment module through the VPN dedicated line;

[0126] The contestant identity information includes: the contestant's user name, password, and fingerprint characteristics;

[0127] The virtualized environment module is a connected vehicle virtualization platform;

[0128] Vulnerability mining and attack module, the attacking player uses the vulnerability mining and attack module to mine and attack the virtualization environment module through the player platform;

[0129] A defense practice module, in which the defending player uses the defense practice module through the player-side platform to defend against the vulnerability mining and attack configuration defense mechanism conducted by the attacking player;

[0130] The real-time feedback and reporting module feeds back the results of vulnerability discovery and attack to the attacking players through the player-side platform, and feeds back the defense results to the defending players through the player-side platform.

[0131] Furthermore, the virtualized environment module also includes a vehicle physical access module, a firmware simulation module, and an SDN network topology module;

[0132] The vehicle physical access module connects the vehicle components to the virtual environment module using a first connection method;

[0133] The first connection mode includes: one of Bluetooth, WiFi, radio frequency signal, and V2X;

[0134] The firmware simulation module uses the QEMU method to simulate the firmware of the vehicle's in-vehicle infotainment system, in-vehicle communication system, and in-vehicle gateway system;

[0135] The SDN network topology module uses the SDN method to topologically connect multiple vehicle components and multiple firmware to form a virtualized environment.

[0136] The beneficial effects of the present invention are as follows:

[0137] 1. The present invention establishes a virtualized environment for connected vehicles to enable players to conduct attack and defense drills on connected vehicles, and can switch the virtualized environment in real time, thereby improving the efficiency of attack and defense drills for connected vehicles and greatly reducing costs;

[0138] 2. The present invention realizes the effective connection between vehicle components and firmware through network topology, realizes the construction of physical components and virtual information system environment by constructing a virtualized environment, truly restores the vehicle system environment, and improves the accuracy of attack and defense drills;

[0139] 3. The present invention can realize the switching of virtualized environments, and provide attack paths and defense information to the attacker and defender when switching vehicle components and firmware, thereby improving the efficiency of attack and defense drills.

[0140] 4. When switching the virtualized environment, the present invention first dynamically adjusts the model information of other vehicle parts and firmware to be switched through the adaptation set, and at the same time determines the virtualized environment that best matches the new virtualized environment through two similarity calculations and weight adjustments, and feeds back the attack path and defense information to the attacker and defender, thereby improving the overall efficiency of the attack and defense drills.

[0141] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A remote attack and defense method based on a networked vehicle, characterized in that: The method specifically comprises the following steps: S1. Players log in to the player platform; The players include: attackers and defenders; S2. After obtaining the player information, the player-side platform verifies the player's identity information. After the verification is passed, the player is allowed to access the virtualized environment through the VPN dedicated line; The contestant identity information includes: the contestant's user name, password, and fingerprint characteristics; The virtualized environment is a connected vehicle virtualization platform; S3. The attacking player conducts vulnerability mining and attacks on the virtualized environment on the player-side platform; the defending player configures a defense mechanism on the player-side platform against the vulnerability mining and attacks conducted by the attacking player; S4. Feedback the vulnerability discovery and attack results to the attacking players through the player-side platform, and feedback the defense results to the defending players through the player-side platform; S5. Switch the virtualization environment and repeat steps S3 to S5 until the drill is completed; Step S5 specifically includes the following steps: S51. When the attacking and defending players complete the attack and defense drill for the current virtualized environment, if the attack and defense drill for all virtualized environments is not completed, execute step S52; otherwise, the attack and defense drill ends; Among them, each attack and defense drill is conducted on one or more virtualized environments; After the attacker and defender complete the attack and defense drill in the current virtual environment, the connected vehicle attacker drill management platform records the attack and defense drill log into the attack and defense drill log collection; The attack and defense drill log includes: virtualization environment configuration information, virtualization environment vulnerabilities, attacker attack paths and attack results, defender defense operation behavior and defense results; The attack results include: success, failure; The defense results include: successful, unsuccessful; The virtualization environment configuration information includes: the name of the virtualization environment, the model information of the vehicle parts connected to the virtualization environment, the model information of the firmware in the virtualization environment, and the topological connection structure of multiple vehicle parts and multiple firmware in the virtualization environment; The attack path of the attacker includes: vehicle component model information and firmware model information involved in the attack path arranged in chronological order of the attack behavior; S52. Switching the virtualized environment; wherein the new virtualized environment is: replacing the vehicle parts or firmware to be switched with new vehicle parts or firmware; S53. Repeat steps S3 to S5 until the drill is completed.

2. A remote drill attack and defense method based on a networked vehicle according to claim 1, characterized in that: Step S2 specifically includes the following steps: S21. The player-side platform obtains the username, password, and fingerprint characteristics of the attacking player or the defending player; S22. The player-side platform verifies the user name, password, and fingerprint features. If the verification is successful, step S23 is executed; otherwise, the current player is prohibited from logging into the player-side platform; S23. When the player type corresponding to the user name, password, and fingerprint feature is an attacking player, the player-side platform marks the player as an attacking player and allows the player to access the virtualized environment via a VPN dedicated line; When the player type corresponding to the user name, password, and fingerprint feature is a defending player, the player-side platform marks the player as a defending player and allows the player to access the virtualized environment through a VPN dedicated line.

3. A remote drill attack and defense method based on a networked vehicle according to claim 2, characterized in that: Before step S1, the method further includes: constructing a virtualized environment; The construction of the virtualized environment specifically includes the following steps: S01. Connecting vehicle components to the virtual environment using a first connection method; The first connection mode includes: one of Bluetooth, WiFi, radio frequency signal, and V2X; S02. Using the QEMU method to simulate and run the firmware of the vehicle's in-vehicle infotainment system, in-vehicle communication system, and in-vehicle gateway system; S03. Use the SDN method to topologically connect multiple vehicle components and multiple firmware to form a virtualized environment.

4. A remote drill attack and defense method based on a networked vehicle according to claim 1, characterized in that: Step S3 specifically includes the following steps: S31. The attacker first uses an automatic vulnerability scanning tool to discover vulnerabilities in the virtualized environment, and then launches an attack on the virtualized environment based on the vulnerability discovery results; S32. The defending player first uses an automatic vulnerability scanning tool to discover vulnerabilities in the virtualized environment, and then defends the virtualized environment based on the vulnerability discovery results and the attack behavior of the attacking player.

5. A remote attack and defense method based on a networked vehicle according to claim 4, characterized in that: Step S52 specifically includes the following steps: S521. Obtain model information of the vehicle parts or firmware to be switched, and obtain model information of new vehicle parts or firmware; The model information includes the name, manufacturer, and version of the vehicle parts or firmware; S522. Obtaining an unadapted set corresponding to a new vehicle component or firmware; The unmatched set includes model information of vehicle parts and firmware that cannot be matched by the vehicle parts or firmware; S523. Determine whether there are vehicle parts or firmware in the current virtualization environment other than the vehicle parts or firmware to be switched, which have the same model information as the vehicle parts or firmware in the unadapted set; If it exists, execute step S524; if it does not exist, execute step S525; S524. When there is a vehicle component in the other vehicle components that has the same model information as the vehicle component in the unmatched set When the first user directly transfers the vehicle parts Replace with vehicle parts that are compatible with the new vehicle parts or firmware described in step S521; Wherein, n is the total number of components in the other vehicle components that have the same model information as the components in the unmatched set; The nth component among the other vehicle components having the same model information as the component in the unmatched set; n≥1; The first user is the organizer; When there is a firmware with the same model information as the firmware in the unadapted set in the other firmwares, }, determine whether the ratio of m to the total number of firmware in the current virtualization environment is greater than 50%. If so, the first user replaces all firmware in the current virtualization environment as a whole, and replaces the vehicle parts to be switched with new vehicle parts to form a new virtualization environment, and executes step S526; otherwise, the virtualization environment automatically replaces the firmware { } replaced with firmware that is compatible with the new vehicle parts or firmware described in step S521; Wherein, m is the total number of firmwares in the other firmwares having the same model information as the firmware in the unadapted set; The mth firmware among the other firmwares having the same model information as the firmware in the unadapted set; m≥1; Execute step S525; S525. Replace the vehicle parts or firmware to be switched with new vehicle parts or firmware to form a new virtualized environment; S526. Feedback the vulnerability results, attack paths, and defense operation behaviors corresponding to the new virtualization environment to the attacking player and the defending player.

6. A remote attack and defense method based on a networked vehicle according to claim 5, characterized in that: Step S526 specifically includes the following steps: S5261. Obtain vehicle component model information and firmware model information connected to the new virtualized environment; S5262. Compare the first similarity r between the virtualized environment in each attack and defense exercise log in the attack and defense exercise log set and the new virtualized environment; The first similarity r= ; Where p is equal to the total number of vehicle parts and firmware with the same model information between the new virtualized environment and the virtualized environment in the attack and defense exercise log; Q equals the total number of vehicle components and firmware in the new virtualized environment; When the first similarity r is greater than 60%, executing step S5263; otherwise, stopping feeding back the vulnerability results, attack paths, and defense configuration information corresponding to the new virtualized environment to the attacking player and the defending player; S5263. Extract multiple attack and defense drill logs corresponding to virtualized environments whose first similarity r with the new virtualized environment is greater than 60% from the attack and defense drill log set, and obtain the virtualized environment names, multiple vehicle component model information, and multiple firmware model information in the multiple attack and defense drill logs to form a similarity set {( ), ( ),…, ( )}; Wherein, k is the total number of attack and defense drill logs corresponding to virtualized environments whose first similarity r with the new virtualized environment is greater than 60% in the attack and defense drill log set; The virtualization environment name, multiple vehicle parts model information, and multiple firmware model information extracted from the attack and defense drill log corresponding to the kth virtualization environment in the attack and defense drill log set having a first similarity r greater than 60% with the new virtualization environment; S5264. Obtain the attack paths of the attackers whose attack results are successful in multiple attack and defense exercise logs in the attack and defense exercise log set; and count the number of times each vehicle component and firmware involved in the obtained attack path of the attacker; S5265. According to the number of times of each vehicle component and the number of firmware in step S5264, the vehicle components and firmware are uniformly sorted in descending order; S5266. Weights are assigned to vehicle parts and firmware in descending order, wherein in the sorting result of step S5265, the first ranked vehicle part or firmware obtains the highest weight; the last ranked vehicle part or firmware obtains the lowest weight; The weight allocation is performed according to a first weight allocation table; Wherein, the first weight allocation table stores a plurality of different weights in descending order of weight; Among them, the maximum value in the first weight allocation table is 0.9 and the minimum value is 0.3; S5267. Calculate the new virtualization environment and {( ), ( ),…, ( )}; Among them, the second similarity h= ; Wherein, t1 is the number of vehicle components connected to the new virtualized environment; t2 is the number of firmware in the new virtualized environment; The weight corresponding to the i-th vehicle component connected to the new virtual environment; The weight corresponding to the jth firmware connected to the new virtualization environment; Among them, when the new virtualization environment is ), ( ),…, ( )} When performing the second similarity calculation: When the new virtual environment connects the vehicle parts model information with When the model information of a connected vehicle component is the same and the vehicle component connected to the new virtual environment exists in the vehicle components that have been assigned weights in step S5266, the weight assigned to the vehicle component connected to the new virtual environment in step S5266 is used as the weight corresponding to the vehicle component when calculating the second similarity; When the new virtual environment connects the vehicle parts model information with When the model information of a connected vehicle component is the same and the vehicle component connected to the new virtual environment does not exist in the vehicle components that have been assigned weights in step S5266, the weight corresponding to the vehicle component in the second similarity calculation is set to 0.1; When the new virtual environment connects the vehicle parts model information with When the model information of any connected vehicle parts is different, the weight corresponding to the vehicle parts connected to the new virtualized environment during the second similarity calculation is set to 0; S5268. Connect the new virtualization environment to {( ), ( ),…, ( )}, and sorting the multiple second similarities h calculated for each virtualization environment in order from large to small; obtaining the attack and defense drill logs corresponding to the top three virtualization environments, and feeding back the vulnerabilities of the virtualization environments, the attack paths of the attackers, and the attack results in the attack and defense drill logs to the attackers, and feeding back the defense operation behaviors and defense results in the attack and defense drill logs to the defenders.

7. A remote attack and defense drill system based on networked vehicles, characterized in that: The system includes: a player-side platform, a remote access module, a virtualized environment module, a vulnerability mining and attack module, a defense practice module, and a real-time feedback and reporting module; Among them, the players log in to the player-side platform; The players include: attackers and defenders; After obtaining the player information, the player-side platform verifies the player's identity information. After the verification is passed, the player is allowed to access the virtualization environment module through the VPN dedicated line; The contestant identity information includes: the contestant's user name, password, and fingerprint characteristics; The virtualized environment module is a connected vehicle virtualization platform; Vulnerability mining and attack module, the attacking player uses the vulnerability mining and attack module to mine and attack the virtualization environment module through the player platform; A defense practice module, in which the defending player uses the defense practice module through the player-side platform to defend against the vulnerability mining and attack configuration defense mechanism conducted by the attacking player; The real-time feedback and reporting module feeds back the results of vulnerability discovery and attack to the attacking players through the player-side platform, and feeds back the defense results to the defending players through the player-side platform.

8. A remote attack and defense drill system based on networked vehicles according to claim 7, characterized in that: The virtualized environment module also includes a vehicle physical access module, a firmware simulation module, and an SDN network topology module; The vehicle physical access module connects the vehicle components to the virtual environment module using a first connection method; The first connection mode includes: one of Bluetooth, WiFi, radio frequency signal, and V2X; The firmware simulation module uses the QEMU method to simulate the firmware of the vehicle's in-vehicle infotainment system, in-vehicle communication system, and in-vehicle gateway system; The SDN network topology module uses the SDN method to topologically connect multiple vehicle components and multiple firmware to form a virtualized environment.

Images