Vehicle data cross-border flow detection method, device, system, medium and program

Abstract

The invention relates to the technical field of data security, and discloses a vehicle data cross-border flow detection method, device and system, a medium and a program, and the method comprises the steps: controlling a detected vehicle to run each application program installed in the vehicle; in the running process of each application program, obtaining a network data message generated by the tested vehicle; identifying based on the network data message to obtain a network layer data packet and a domain name system data packet; and after determining that the tested vehicle has data cross-border flow based on the attribution information of the first internet protocol address in the network layer data packet, obtaining cross-border flow information of the tested vehicle data according to the first internet protocol address and the domain name system data packet. According to the invention, it is ensured that the detected vehicle can be comprehensively detected, the detection efficiency and accuracy can be improved, detailed cross-border flow information can be output after it is detected that data cross-border flow exists in the vehicle, a developer can conveniently check and rapidly position the problem, and the risk of data leakage is reduced.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and specifically to a detection method, device, system, medium and program for cross-border flow of vehicle data. Background Art

[0002] The data generated by the Internet of Vehicles has the potential to create huge economic value in the process of upgrading and developing the automotive industry. As the commercial scale of the Internet of Vehicles continues to expand, if the transmission and use of relevant data are not effectively managed and the data is allowed to flow in an unorderly manner, there will be great data security risks, posing a clear threat to the personal information and privacy protection of vehicle users. The vehicle information security technology requires that vehicles should not directly transmit data overseas in order to protect data information.

[0003] Currently, the main method is to manually confirm the network messages one by one online to determine whether there is any access to overseas IP addresses. However, this manual testing method has low testing efficiency and the test results are prone to statistical errors. Summary of the invention

[0004] In view of this, the present invention provides a method, device, system, medium and program for detecting cross-border flow of vehicle data to solve the problems of low efficiency and low accuracy of test results of traditional manual testing methods.

[0005] In a first aspect, the present invention provides a method for detecting cross-border flow of vehicle data, the method comprising:

[0006] Control the tested vehicle to run various applications installed on it;

[0007] During the operation of each application, the network data packets generated by the tested vehicle are obtained;

[0008] Based on the network data message, identification is performed to obtain network layer data packets and domain name system data packets;

[0009] After determining that cross-border data flow exists for the vehicle under test based on the location information of the first Internet Protocol address in the network layer data packet, cross-border flow information of the vehicle under test data is obtained based on the first Internet Protocol address and the domain name system data packet.

[0010] Beneficial effects: The test equipment is used to control the various applications of the tested vehicle to ensure that the tested vehicle can be fully tested, and the network data packets generated by the tested vehicle are identified during the operation of each application to obtain network layer data packets and domain name system data packets, which is conducive to improving the detection efficiency and accuracy. After determining that the tested vehicle has cross-border data flow based on the location information of the first Internet Protocol address in the network layer data packet, the cross-border flow information of the tested vehicle data is obtained based on the first Internet Protocol address and the domain name system data packet, which is convenient for developers to view and quickly locate problems, thereby reducing the risk of data leakage.

[0011] In an optional implementation, controlling the tested vehicle to run various applications installed on the vehicle includes:

[0012] Get the application package names of all applications installed on the tested vehicle;

[0013] Generate random event trigger instructions corresponding to each application based on the application package name;

[0014] The vehicle under test is controlled to dynamically run various applications installed on it based on random event trigger instructions to simulate the user's random operations on various applications.

[0015] Beneficial effect: In the embodiment of the present invention, a random event trigger instruction is sent to the vehicle under test through a command line tool, so that the vehicle under test triggers various random events in the process of dynamically running all applications, simulating various random operations of users on different applications, ensuring that all applications of the vehicle under test can generate as much different types of data as possible, facilitating comprehensive detection of various data behaviors of the vehicle under test, and improving the scope and accuracy of cross-border data detection.

[0016] In an optional implementation, generating a random event trigger instruction corresponding to each application program based on the application package name includes:

[0017] Determine the triggering interval of the random event corresponding to each application;

[0018] The random operation test tool preset on the tested vehicle is called, and the random event trigger instructions corresponding to each application are generated according to the application package name and trigger interval time corresponding to each application.

[0019] Beneficial effect: The embodiment of the present application sets the trigger interval time of random events and generates random event trigger instructions for all applications of the vehicle under test to dynamically run all applications on the vehicle under test, so that the vehicle under test can generate a variety of different types of network data packets for detection by the test equipment.

[0020] In an optional implementation, obtaining cross-border flow information of the measured vehicle data according to the first Internet Protocol address and the domain name system data packet includes:

[0021] Screening domain name system data packets to obtain domain name data that meets preset conditions;

[0022] When it is detected that the second Internet Protocol address in the domain name data is a preset Internet Protocol version, and the second Internet Protocol address is consistent with the first Internet Protocol address, the overseas webpage address accessed by the tested vehicle is obtained according to the query domain name field in the domain name data;

[0023] Based on the first Internet Protocol address, the overseas web page address and the location information of the first Internet Protocol address, the cross-border flow information of the measured vehicle data is obtained.

[0024] Beneficial effect: In the embodiment of the present application, the domain name system data packet is first screened according to preset conditions to quickly obtain valid domain name data and improve detection efficiency. Then, when the second Internet Protocol address and the first Internet Protocol address in the domain name system are consistent, the overseas web page address visited by the tested vehicle is obtained according to the query domain name field in the domain name data, and cross-border flow information containing the first Internet Protocol address, the overseas web page address and the place of ownership information is output for developers to view and quickly locate problems, thereby reducing the risk of data leakage and ensuring vehicle data security.

[0025] In an optional implementation, the domain name system data packet is screened to obtain domain name data that meets the preset conditions, including:

[0026] Filtering the response message in the domain name system data packet according to a preset condition to obtain a target response message; wherein the preset condition is set based on the number of question queries recorded in the message query segment and the number of resource records recorded in the message answer segment;

[0027] The domain name data is obtained according to the message query segment in the target response message.

[0028] Beneficial effect: In an embodiment of the present application, the response message in the domain name system data packet is screened according to the number of question queries recorded in the message query segment and the number of resource records recorded in the message reply segment, so as to quickly locate the target response message containing valid domain name data.

[0029] In an optional implementation, determining that cross-border data flow exists in the tested vehicle based on the home location information of the first Internet Protocol address in the network layer data packet includes:

[0030] Determining whether the location information of the first Internet Protocol address in the network layer data packet is an overseas area;

[0031] If the location information of the first Internet Protocol address is an overseas area, it is determined that there is cross-border data flow in the tested vehicle.

[0032] Beneficial effect: In the embodiment of the present application, by obtaining the location information of the first Internet Protocol address in the network layer data packet and detecting whether the location information is an overseas area, it is possible to accurately determine whether the vehicle under test has cross-border data flow behavior.

[0033] In an optional implementation, before controlling the tested vehicle to run each application installed in the vehicle, the method further includes:

[0034] Turn on the target network hotspot and control the vehicle under test to connect to the target network hotspot.

[0035] Beneficial effect: In an embodiment of the present invention, the test equipment uses a wireless network card to open a network hotspot, and the vehicle under test is connected to the network hotspot opened by the test equipment, so that the test equipment can directly capture the network data packets generated by the vehicle under test.

[0036] In a second aspect, the present invention provides a device for detecting cross-border flow of vehicle data, the device comprising:

[0037] The first processing module is used to control the tested vehicle to run various applications installed on the vehicle;

[0038] The second processing module is used to obtain the network data message generated by the tested vehicle during the operation of each application program;

[0039] A third processing module is used to identify based on the network data message to obtain a network layer data packet and a domain name system data packet;

[0040] The fourth processing module is used to obtain cross-border flow information of the data of the vehicle under test based on the first Internet Protocol address and the domain name system data packet after determining that there is cross-border data flow of the vehicle under test based on the location information of the first Internet Protocol address in the network layer data packet.

[0041] In a third aspect, the present invention provides a system for detecting cross-border flow of vehicle data, comprising: a test device and a vehicle under test;

[0042] The test equipment includes a memory and a processor, and the memory and the processor are communicatively connected to each other. Computer instructions are stored in the memory, and the processor executes the method for detecting cross-border flow of vehicle data of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0043] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for detecting cross-border flow of vehicle data of the above-mentioned first aspect or any corresponding embodiment thereof.

[0044] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the method for detecting cross-border flow of vehicle data of the above-mentioned first aspect or any corresponding embodiment thereof.

[0045] The beneficial effects of the present invention are:

[0046] The test equipment is used to control the various applications of the tested vehicle to ensure that the tested vehicle can be fully tested. During the operation of each application, the network data packets generated by the tested vehicle are identified to obtain network layer data packets and domain name system data packets, which is conducive to improving the detection efficiency and accuracy. After determining that the tested vehicle has cross-border data flow based on the location information of the first Internet Protocol address in the network layer data packet, the cross-border flow information of the tested vehicle data is obtained based on the first Internet Protocol address and the domain name system data packet, which is convenient for developers to view and quickly locate problems, thereby reducing the risk of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 is a structural block diagram of a system for detecting cross-border flow of vehicle data according to an embodiment of the present invention;

[0049] Figure 2 is a flow chart of a method for detecting cross-border flow of vehicle data according to an embodiment of the present invention;

[0050] Figure 3 is a flow chart of another method for detecting cross-border flow of vehicle data according to an embodiment of the present invention;

[0051] Figure 4 is a test flow diagram of an automated testing tool according to an embodiment of the present invention;

[0052] Figure 5 is a schematic diagram of a process of automatically running an in-vehicle application according to an embodiment of the present invention;

[0053] Figure 6 It is a schematic diagram of a flow chart of network data message analysis according to an embodiment of the present invention;

[0054] Figure 7 is a structural block diagram of a device for detecting cross-border flow of vehicle data according to an embodiment of the present invention;

[0055] Figure 8 It is a schematic diagram of the hardware structure of the testing device according to the embodiment of the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0057] As the commercial scale of the Internet of Vehicles continues to expand, if the transmission and use of Internet of Vehicles data is not effectively managed and the data is allowed to flow in an unordered manner, there will be great data security risks, posing a clear threat to the personal information and privacy protection of vehicle users. The vehicle information security technology requires that vehicles should not directly transmit data overseas, so it is particularly important to detect whether the vehicle has accessed an overseas Internet Protocol Address (IP) address and transmitted data to an overseas IP address.

[0058] At present, manual testing requires online confirmation of network messages one by one to determine whether they are overseas IP addresses. There are problems such as primitive testing methods, low testing efficiency, and easy statistical errors in test results. In response to the shortcomings of manual testing, related technologies analyze and detect host processes to determine whether overseas IP addresses are accessed, and discover hidden processes through regular inspections to improve detection efficiency. However, during the operation of the host, not all applications are frequently used by users. These applications and certain random operations also have the risk of abnormal access to overseas IP addresses, resulting in low accuracy of the detection results of the above methods. In addition, traditional methods only focus on the detection of overseas transmissions, and cannot provide detailed overseas transmission information after detecting abnormal behavior, which is not conducive to technical personnel to view.

[0059] Therefore, an embodiment of the present invention provides a detection solution for the cross-border flow of vehicle data, which can comprehensively capture the network data packets sent by the vehicle and perform automatic analysis on them to determine whether the vehicle accesses overseas IP addresses, thereby improving detection efficiency. When it is detected that the vehicle accesses an overseas IP, it will also output cross-border flow information of data, which is convenient for developers to quickly locate problems.

[0060] According to an embodiment of the present invention, a system for detecting cross-border flow of vehicle data is provided, such as Figure 1 As shown, the vehicle data cross-border flow detection system includes a test device 101 and a tested vehicle 102, wherein the test device 101 and the tested vehicle 102 are connected.

[0061] Specifically, the test device 101 controls the tested vehicle 102 to run various applications installed on it, and during the running process of each application, obtains the network data message generated by the tested vehicle 102, and then identifies based on the network data message to obtain the network layer data packet and the domain name system data packet. After determining that the tested vehicle 102 has cross-border data flow based on the home location information of the first Internet Protocol address in the network layer data packet, the cross-border flow information of the tested vehicle 102 data is obtained based on the first Internet Protocol address and the domain name system data packet.

[0062] The specific working principles and workflows of the test device 101 and the tested vehicle 102 may be found in the description of the method embodiment below, which will not be described in detail here.

[0063] In some optional implementations, the test device 101 can open its own network hotspot to connect the vehicle under test 102 to the network hotspot, so that the test device 101 can obtain the network data packets generated by the vehicle under test 102. Exemplarily, the vehicle under test 102 uses WiFi to connect to the hotspot opened by the test device 101 using a wireless network card, and the test device 101 can use the WireShark tool to capture the data traffic of the wireless network card, thereby obtaining the network data packets sent by the vehicle under test 102. Among them, the test device 101 can be an electronic device such as a computer, and the present invention is not limited thereto.

[0064] According to an embodiment of the present invention, an embodiment of a method for detecting cross-border flow of vehicle data is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0065] In this embodiment, a method for detecting cross-border flow of vehicle data is provided, which can be used for example Figure 1The test device 101 shown, such as a test device, a tablet computer, etc., Figure 2 is a flow chart of a method for detecting cross-border flow of vehicle data according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0066] Step S201, controlling the tested vehicle to run various application programs installed on the vehicle.

[0067] Specifically, after the test equipment is connected to the vehicle under test, a series of instructions can be sent to it to automatically run all the applications (Application, APP) installed in the vehicle under test. Among them, you can choose to run a certain number of APPs in batches, or you can run each APP one by one, as long as all the applications installed in the vehicle under test are ensured to be run, so as to conduct a comprehensive test of all APPs to avoid omissions.

[0068] Step S202, during the running process of each application, obtaining the network data message generated by the tested vehicle.

[0069] Specifically, before testing the vehicle under test, the test equipment can first turn on the target network hotspot and control the vehicle under test to connect to the target network hotspot, so that the test equipment can directly capture the network data packets generated by the vehicle under test.

[0070] In some optional implementations, the test device uses a wireless network card to open a network hotspot, the tested vehicle is connected to the network hotspot opened by the test device via WiFi, and the test device uses the network analysis tool WireShark to capture the network data packets of the network card of the network hotspot opened by the test device. In addition, packet capture tools such as Fiddler, Charles, etc. can also be used to obtain network data packets.

[0071] Step S203, performing identification based on the network data message to obtain a network layer data packet and a domain name system data packet.

[0072] Specifically, based on the protocol type of the data packet, the network data packet can be identified to filter out the network layer (i.e., IP layer) data packets and the Domain Name System (DNS) data packets. Exemplarily, the haslayer() function in the scapy library of the python language can be used to filter the data packets.

[0073] In some optional implementations, before identifying the network data packet, the network data packet can be saved as a .pcapng format file, and then the .pcapng file can be parsed using the sniff function, haslayer() function, etc. of the scapy library of the Python language.

[0074] Step S204, after determining that there is cross-border data flow of the vehicle under test based on the location information of the first Internet Protocol address in the network layer data packet, obtain the cross-border flow information of the vehicle under test data based on the first Internet Protocol address and the domain name system data packet.

[0075] Specifically, the first Internet Protocol address is extracted from the network layer data packet, the location information of the first Internet Protocol address is queried to determine whether it is an overseas area. If it is an overseas area, it is determined that the tested vehicle has cross-border data flow. Then, based on the first Internet Protocol address and the domain name data information in the DNS data packet, the cross-border flow information such as the web page address visited by the tested vehicle is obtained, which is convenient for developers to view and quickly locate problems, thereby reducing the risk of data leakage.

[0076] The detection method for cross-border flow of vehicle data provided in this embodiment uses test equipment to control the various applications of the tested vehicle to run itself, ensuring that the tested vehicle can be fully detected, and in the process of running each application, the network data message generated by the tested vehicle is identified to obtain network layer data packets and domain name system data packets, which is conducive to improving detection efficiency and accuracy. After determining that there is cross-border flow of data of the tested vehicle based on the location information of the first Internet Protocol address in the network layer data packet, the cross-border flow information of the tested vehicle data is obtained based on the first Internet Protocol address and the domain name system data packet, which is convenient for developers to view and quickly locate problems, thereby reducing the risk of data leakage.

[0077] In this embodiment, a method for detecting cross-border flow of vehicle data is provided, which can be used for example Figure 1 The test device 101 shown, such as a test device, a tablet computer, etc., Figure 3 is a flow chart of a method for detecting cross-border flow of vehicle data according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0078] Step S301, controlling the vehicle under test to run various application programs installed on the vehicle.

[0079] Specifically, the above step S301 includes:

[0080] Step S3011, obtaining the application package names of all application programs installed on the tested vehicle itself.

[0081] Specifically, the test device can issue a series of instructions to the vehicle under test through a command line tool to obtain the application package names of all application programs of the vehicle under test.

[0082] In some optional implementations, the test device can communicate with the vehicle computer of the tested vehicle through ADB (Android Debug Bridge), and execute "adb shell pm list package" to obtain the application package names of all APPs installed on the vehicle computer, such as APP1, APP2, etc. It should be noted that the ADB tool is a multi-functional command line tool that allows developers to communicate with Android devices and provides multiple functions such as installing and debugging applications on the device, executing Shell commands, and managing device status.

[0083] Step S3012: Generate a random event trigger instruction corresponding to each application program based on the application package name.

[0084] Specifically, the triggering interval time of the random event corresponding to each application is determined, the random operation test tool preset on the tested vehicle is called, and the random event triggering instruction corresponding to each application is generated according to the application package name and the triggering interval time corresponding to each application.

[0085] In some optional implementations, the test device can use a random operation test tool to loop through all application package names, and can also set the trigger interval of random events to trigger random events of the APP such as touch, gesture operation, two-finger zoom, trajectory, rotation, keyboard events, system buttons, etc., and generate corresponding random event trigger instructions to dynamically run all applications.

[0086] It should be noted that the random operation test tool can be the Monkey tool that comes with the car computer. The Monkey tool tests the program on the device by sending a pseudo-random user event stream (such as key input, touch screen input, sliding, gesture input, etc.) to the system to detect the long-term stability of the program and how long it will take for anomalies to occur.

[0087] In some optional implementations, by looping through the application package name of each APP obtained and calling the Monkey tool that comes with the vehicle computer, the triggering interval of the random event is set by the random value of the throttle parameter (after setting, the random event interval of this APP running will run according to this triggering interval).

[0088] Taking the application package name com.autonavi.comapauto as an example, generate its corresponding instruction " / system / framework / monkey.jar" random click event to trigger the dynamic operation of com.autonavi.comapauto, and randomly click com.autonavi.comapauto 10000 times, with an interval of 1000ms between each click. The corresponding instruction is "adb shell-pcom.autonavi.comapauto 10000-throttle 1000".

[0089] The embodiment of the present application sets the trigger interval of random events and generates random event trigger instructions for all applications of the vehicle under test to dynamically run all applications on the vehicle under test, so that the vehicle under test can generate a variety of different types of network data packets for detection by the test equipment.

[0090] Step S3013, controlling the vehicle under test to dynamically run various applications installed in the vehicle based on random event triggering instructions, so as to simulate the user's random operations on various applications.

[0091] Specifically, random event trigger instructions are sent to the vehicle under test through the command line tool, so that various random events are triggered in the process of dynamically running all applications of the vehicle under test, simulating various random operations of users on different applications, ensuring that all applications of the vehicle under test can generate as much different types of data as possible, facilitating comprehensive detection of various data behaviors of the vehicle under test, and improving the scope and accuracy of cross-border data detection.

[0092] In some optional implementations, the vehicle under test can also send the running result log of each application to the test device to feedback whether the APP is successfully started. If the startup fails, the feedback "No activities found to run" indicates that the APP startup failed, and no feedback indicates that the APP startup is successful. The test device will restart the APP that failed to start last time according to the running result log, and so on, to ensure that all the in-vehicle APPs of the vehicle under test are running. After all the APPs of the vehicle under test have been clicked, use "adb shell am force-stop {application package name}" to stop the running of the APP.

[0093] Step S302: During the operation of each application, obtain the network data message generated by the tested vehicle. Figure 2 Step S202 of the illustrated embodiment will not be described in detail here.

[0094] Step S303: Identify based on the network data message to obtain the network layer data packet and the domain name system data packet. Figure 2 Step S203 of the illustrated embodiment will not be described in detail here.

[0095] Step S304, after determining that there is cross-border data flow of the vehicle under test based on the location information of the first Internet Protocol address in the network layer data packet, obtain the cross-border flow information of the vehicle under test data based on the first Internet Protocol address and the domain name system data packet.

[0096] Specifically, the above step S304 includes:

[0097] Step S3041, determining whether the location information of the first Internet Protocol address in the network layer data packet is an overseas area.

[0098] Specifically, the destination IP address in the network layer data packet is extracted and duplicate items are removed to obtain the first Internet Protocol address.

[0099] In some optional implementations, the location information of the first Internet Protocol address can be queried offline by calling the open source GeoIP2 database to obtain information such as the country name (country_name), province name (province_name), city name (city_name), longitude (longtidude) and latitude (latidude), so as to accurately determine whether the location information of the first Internet Protocol address is an overseas area based on the information such as the country name (country_name).

[0100] Specifically, if the location information of the first Internet Protocol address is an overseas area, step S3042 and subsequent steps are executed; otherwise, it means that there is no cross-border data flow in the tested vehicle.

[0101] Step S3042: If the location information of the first Internet Protocol address is an overseas area, it is determined that cross-border data flow exists in the tested vehicle.

[0102] In an embodiment of the present application, by obtaining the location information of the first Internet Protocol address in the network layer data packet and detecting whether the location information is an overseas area, it is possible to accurately determine whether the vehicle under test has cross-border data flow behavior.

[0103] Step S3043, filtering the domain name system data packet to obtain domain name data that meets preset conditions.

[0104] Specifically, the response message in the domain name system data packet is screened according to the preset conditions to obtain the target response message, and the domain name data is obtained according to the message query segment in the target response message. The preset conditions are set based on the number of question queries recorded in the message query segment and the number of resource records recorded in the message answer segment;

[0105] In some optional implementations, after determining that the location information of the first Internet Protocol address is an overseas area, it is necessary to screen the resolved DNS data packets, and the preset conditions for screening can be: the message QR field is 1 (indicating a response message), the number of question queries QDCount recorded in the message query segment is greater than or equal to 1, and the number of resource records ANCount recorded in the message answer segment is greater than or equal to 1. According to the above preset conditions, all DNS data packets are traversed to obtain the target response message that meets the preset conditions. Then, the QNAME (query domain name) field of the message query segment and the resource record data RDATA corresponding to the message query segment in the target response message are obtained to obtain the domain name data.

[0106] In an embodiment of the present application, the response message in the domain name system data packet is screened according to the number of question queries recorded in the message query segment and the number of resource records recorded in the message reply segment, so as to quickly locate the target response message containing valid domain name data.

[0107] Step S3044, when it is detected that the second Internet Protocol address in the domain name data is a preset Internet Protocol version, and the second Internet Protocol address is consistent with the first Internet Protocol address, the overseas web page address accessed by the tested vehicle is obtained according to the query domain name field in the domain name data.

[0108] Specifically, extract the second Internet Protocol address recorded in RDATA in the domain name data, and determine whether the second Internet Protocol address is an IPv4 (Internet Protocol version 4) address. If so, continue to determine whether the second Internet Protocol address is consistent with the first Internet Protocol address in the above step. If they are consistent, it means that the URL (Uniform Resource Locator) address corresponding to the QNAME field in the domain name data is the overseas web page address visited by the vehicle under test.

[0109] Step S3045, obtaining cross-border flow information of the measured vehicle data according to the first Internet Protocol address, the overseas web page address and the location information of the first Internet Protocol address.

[0110] Specifically, cross-border flow information containing the first Internet Protocol address, the overseas web page address, and the location information of the first Internet Protocol address is output for developers to view and quickly locate problems.

[0111] In an embodiment of the present application, the domain name system data packet is first screened according to preset conditions to quickly obtain valid domain name data and improve detection efficiency. Then, when the second Internet Protocol address and the first Internet Protocol address in the domain name system are consistent, the overseas web page address visited by the tested vehicle is obtained according to the query domain name field in the domain name data, and cross-border flow information containing the first Internet Protocol address, the overseas web page address and the place of ownership information is output for developers to view and quickly locate problems, thereby reducing the risk of data leakage and ensuring vehicle data security.

[0112] The detection method for cross-border flow of vehicle data provided in this embodiment sends a random event trigger instruction to the tested vehicle through a command line tool, so that the tested vehicle triggers various random events in the process of dynamically running all applications, simulating various random operations of users on different applications, ensuring that the tested vehicle can be fully detected, and in the process of running each application, the network data message generated by the tested vehicle is identified to obtain network layer data packets and domain name system data packets, which is conducive to improving detection efficiency and accuracy. After determining that there is cross-border flow of data for the tested vehicle based on the attribution information of the first Internet Protocol address in the network layer data packet, the domain name system data packet is screened according to preset conditions to quickly obtain valid domain name data and improve detection efficiency. According to the query domain name field in the domain name data, the overseas web page address visited by the tested vehicle is obtained, and the cross-border flow information containing the first Internet Protocol address, the overseas web page address and the attribution information is output, which is convenient for developers to view and quickly locate problems, thereby reducing the risk of data leakage.

[0113] The following takes the test device as a test computer as an example, and combines with a specific application example to explain in detail the method for detecting cross-border flow of vehicle data of the present invention.

[0114] like Figure 4 As shown, the detection method of this application example can be integrated into a test tool to run, and the test computer is connected to the vehicle under test through the test tool to realize the automated test of the vehicle under test, which mainly includes the following steps:

[0115] Step 1: Automatically run all apps in the car.

[0116] The test computer is connected to the vehicle computer of the tested vehicle through the ADB tool, and "adb shell pm listpackage" is executed to obtain the application package names of all APPs installed on the vehicle computer. Each APP package name is obtained by looping and calling the Monkey ( / system / framework / monkey.jar) random click event that comes with the vehicle computer to trigger the dynamic operation of the APP, and the random event interval is set by the random value of the throttle parameter.

[0117] like Figure 5 As shown in the figure, the vehicle under test can also send the running result log of each application to the test device to feedback whether the APP is successfully started. If the startup fails, the feedback "No activities found to run" indicates that the APP startup failed, and no feedback indicates that the APP startup is successful. The test device will restart the APP that failed to start last time according to the running result log, and so on, to ensure that all the in-vehicle APPs of the vehicle under test can be run. After all the APPs of the vehicle under test have been clicked, use "adb shell am force-stop {application package name}" to stop the running of the APP.

[0118] Step 2: Capture the network data packets accessed by the tested vehicle.

[0119] The test computer uses a wireless network card to open a hotspot, and the vehicle under test is connected to the hotspot opened by the test computer via WiFi. The test computer uses the network analysis tool WireShark to capture the network data packets of the network card of the test computer's open hotspot.

[0120] Step 3: Analyze network data packets.

[0121] Save the network data packets captured by Wireshark as .pcapng format files and import them into Figure 4 The test tool uses the sniff function of the scapy library in the Python language to parse the .pcapng file, as shown in Figure 6 As shown, the parsing process is as follows:

[0122] First, use the haslayer() function of the scapy library to filter out the IP layer data packets, take out the target IP address in the data packet, remove the duplicates, and get the first Internet Protocol address.

[0123] Secondly, the location information of the first Internet Protocol address is queried offline by calling the open source GeoIP2 database, including information such as country name (country_name), province name (province_name), city name (city_name), longitude (longtidude) and latitude (latidude).

[0124] Then, determine whether the first Internet Protocol address belongs to an overseas IP address based on the country name (country_name). If it is determined to be an overseas IP address, it is necessary to filter the DNS data packets in the resolved network data message again, and the screening conditions include the QR field is 1, ANCount (the number of records in the specified answer part) is greater than or equal to 1, and QDCount (the number of questions in the specified query part) is greater than or equal to 1. Traverse all qualified response messages and determine whether the second Internet Protocol address in the RDATA (resource record data) field in the response message is IPv4.

[0125] Finally, if the second Internet Protocol address is IPv4, it is determined whether it is equal to the first Internet Protocol address. The URL address corresponding to the QNAME (query domain name) field in the response message is the overseas IP address accessed by the tested vehicle, and the test tool outputs the overseas IP address, URL address and IP location of the network data message to be analyzed. In other words, if the result output by the test tool is empty, it means the test has passed. If the result is not empty, it means that the tested vehicle has a problem transmitting data to an overseas IP.

[0126] The present invention provides an automated testing tool and method. The tool can automatically identify overseas IP addresses and corresponding URLs by importing captured network messages of vehicles accessing externally, which is convenient for developers to quickly locate problems and solves the problem that manual testing requires online confirmation of whether network messages are overseas IP addresses one by one, which results in primitive testing methods, low testing efficiency, and easy statistical errors in test results.

[0127] In this embodiment, a detection device for cross-border flow of vehicle data is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0128] This embodiment provides a detection device for cross-border flow of vehicle data, such as Figure 7 As shown, including:

[0129] The first processing module 701 is used to control the tested vehicle to run various applications installed in the vehicle;

[0130] The second processing module 702 is used to obtain the network data message generated by the tested vehicle during the operation of each application program;

[0131] The third processing module 703 is used to identify based on the network data message to obtain a network layer data packet and a domain name system data packet;

[0132] The fourth processing module 704 is used to obtain cross-border flow information of the data of the vehicle under test based on the first Internet Protocol address and the domain name system data packet after determining that there is cross-border data flow of the vehicle under test based on the location information of the first Internet Protocol address in the network layer data packet.

[0133] In some optional implementations, before controlling the tested vehicle to run each application installed in the vehicle, the device is further used to:

[0134] Turn on the target network hotspot and control the vehicle under test to connect to the target network hotspot.

[0135] In some optional implementations, the first processing module 701 is further configured to:

[0136] Get the application package names of all applications installed on the tested vehicle;

[0137] Generate random event trigger instructions corresponding to each application based on the application package name;

[0138] The vehicle under test is controlled to dynamically run various applications installed on it based on random event trigger instructions to simulate the user's random operations on various applications.

[0139] In some optional implementations, the first processing module 701 is further configured to:

[0140] Determine the triggering interval of the random event corresponding to each application;

[0141] The random operation test tool preset on the tested vehicle is called, and the random event trigger instructions corresponding to each application are generated according to the application package name and trigger interval time corresponding to each application.

[0142] In some optional implementations, the fourth processing module 704 is further configured to:

[0143] Determining whether the location information of the first Internet Protocol address in the network layer data packet is an overseas area;

[0144] If the location information of the first Internet Protocol address is an overseas area, it is determined that there is cross-border data flow in the tested vehicle.

[0145] In some optional implementations, the fourth processing module 704 is further configured to:

[0146] Screening domain name system data packets to obtain domain name data that meets preset conditions;

[0147] When it is detected that the second Internet Protocol address in the domain name data is a preset Internet Protocol version, and the second Internet Protocol address is consistent with the first Internet Protocol address, the overseas webpage address accessed by the tested vehicle is obtained according to the query domain name field in the domain name data;

[0148] Based on the first Internet Protocol address, the overseas web page address and the location information of the first Internet Protocol address, the cross-border flow information of the measured vehicle data is obtained.

[0149] In some optional implementations, the fourth processing module 704 is further configured to:

[0150] Filtering the response message in the domain name system data packet according to a preset condition to obtain a target response message; wherein the preset condition is set based on the number of question queries recorded in the message query segment and the number of resource records recorded in the message answer segment;

[0151] The domain name data is obtained according to the message query segment in the target response message.

[0152] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0153] The detection device for cross-border flow of vehicle data in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0154] The embodiment of the present invention also provides a testing device having the above Figure 7 The device for detecting cross-border flow of vehicle data is shown.

[0155] See also Figure 8 , Figure 8 is a schematic diagram of a structure of a test device provided by an optional embodiment of the present invention, such as Figure 8As shown, the test equipment includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Each component utilizes different buses to communicate with each other, and can be installed on a common mainboard or installed in other ways as required. The processor can process the instructions executed in the test equipment, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 8 A processor 10 is taken as an example.

[0156] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0157] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0158] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created according to the use of the test device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the test device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0159] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0160] The test device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 8 The example of connecting through bus is taken in the following.

[0161] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the test device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0162] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0163] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0164] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for detecting cross-border flow of vehicle data, characterized in that: The method comprises: Control the tested vehicle to run various applications installed on it; During the operation of each application, obtaining network data messages generated by the vehicle under test; Identify based on the network data message to obtain a network layer data packet and a domain name system data packet; After determining that cross-border data flow exists for the vehicle under test based on the location information of the first Internet Protocol address in the network layer data packet, cross-border flow information of the vehicle under test data is obtained based on the first Internet Protocol address and the domain name system data packet.

2. The method according to claim 1, characterized in that The control of the tested vehicle to run various applications installed on the vehicle includes: Obtain the application package names of all application programs installed on the tested vehicle itself; Based on the application package name, generating a random event trigger instruction corresponding to each application program; The tested vehicle is controlled to dynamically run various applications installed in the vehicle based on the random event trigger instruction, so as to simulate the random operations of the user on various applications.

3. The method according to claim 2, characterized in that The generating of the random event triggering instruction corresponding to each application program based on the application package name includes: Determine the triggering interval time of the random event corresponding to each of the applications; The random operation test tool preset on the tested vehicle is called, and the random event trigger instruction corresponding to each application is generated according to the application package name and trigger interval time corresponding to each application.

4. The method according to claim 1, characterized in that: The step of obtaining cross-border flow information of the tested vehicle data according to the first Internet Protocol address and the domain name system data packet includes: Screening the domain name system data packet to obtain domain name data that meets preset conditions; When it is detected that the second Internet Protocol address in the domain name data is a preset Internet Protocol version, and the second Internet Protocol address is consistent with the first Internet Protocol address, obtaining the overseas webpage address accessed by the tested vehicle according to the query domain name field in the domain name data; The cross-border flow information of the measured vehicle data is obtained based on the first Internet Protocol address, the overseas web page address and the location information of the first Internet Protocol address.

5. The method according to claim 4, characterized in that The step of screening the domain name system data packet to obtain domain name data that meets preset conditions includes: Filtering the response message in the domain name system data packet according to a preset condition to obtain a target response message; wherein the preset condition is set based on the number of question queries recorded in the message query segment and the number of resource records recorded in the message reply segment; The domain name data is obtained according to the message query segment in the target response message.

6. The method according to claim 4 or 5, characterized in that: The determining that there is cross-border data flow in the tested vehicle based on the home location information of the first Internet Protocol address in the network layer data packet includes: Determining whether the location information of the first Internet Protocol address in the network layer data packet is an overseas area; If the location information of the first Internet Protocol address is an overseas area, it is determined that cross-border data flow exists in the tested vehicle.

7. The method according to any one of claims 1 to 5, characterized in that Before controlling the tested vehicle to run each application installed in the vehicle, the method further includes: Turn on the target network hotspot and control the vehicle under test to connect to the target network hotspot.

8. A detection device for cross-border flow of vehicle data, characterized in that: The device comprises: The first processing module is used to control the tested vehicle to run various applications installed on the vehicle; A second processing module is used to obtain the network data message generated by the tested vehicle during the operation of each application program; A third processing module, configured to perform identification based on the network data message to obtain a network layer data packet and a domain name system data packet; The fourth processing module is used to obtain cross-border flow information of the vehicle under test data based on the first Internet Protocol address and the domain name system data packet after determining that there is cross-border data flow of the vehicle under test based on the location information of the first Internet Protocol address in the network layer data packet.

9. A vehicle data cross-border flow detection system, characterized in that: include: Test equipment and vehicles under test; The test equipment includes a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for detecting cross-border flow of vehicle data as described in any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for detecting cross-border flow of vehicle data as described in any one of claims 1 to 7.

11. A computer program product, characterized in that It comprises computer instructions, which are used to enable a computer to execute the method for detecting cross-border flow of vehicle data as described in any one of claims 1 to 7.

Images