Method, device, system, medium and program for detecting cross-border flow of vehicle data

Abstract

The application relates to the technical field of data security, and discloses a vehicle data cross-border flow detection method, device, system, medium and program, which comprises the following steps: controlling a measured vehicle to run each application program installed by the measured vehicle; obtaining network data packets generated by the measured vehicle in the running process of each application program; identifying the network data packets to obtain network layer data packets and domain name system data packets; after determining that the measured vehicle has data cross-border flow based on the home information of a first internet protocol address in the network layer data packets, obtaining cross-border flow information of the measured vehicle data according to the first internet protocol address and the domain name system data packets. The application can comprehensively detect the measured vehicle, is favorable for improving detection efficiency and accuracy, and can output detailed cross-border flow information after detecting that the measured vehicle has data cross-border flow, so that developers can check and quickly locate problems, thereby reducing the risk of data leakage.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to a vehicle data cross-border flow detection method, device, system, medium and program. BACKGROUND

[0002] The data generated by the Internet of Vehicles has the potential to create great economic value in the upgrading development process of the automobile industry. With the continuous expansion of the commercial scale of the Internet of Vehicles, if the transmission and use of related data are not effectively managed, and the data is allowed to flow disorderly, there is a great data security risk, which poses a significant threat to the personal information and privacy protection of vehicle users. The information security technology of the whole vehicle requires that the vehicle should not directly transmit data to overseas, in order to protect the data information.

[0003] At present, whether there is access to overseas IP is mainly determined by manually confirming network messages one by one online, but this manual testing method has low testing efficiency and the test results are prone to statistical errors. SUMMARY

[0004] Therefore, the present application provides a vehicle data cross-border flow detection method, device, system, medium and program to solve the problem of low efficiency and low accuracy of the traditional manual testing method.

[0005] In a first aspect, the present application provides a vehicle data cross-border flow detection method, which comprises:

[0006] Controlling the running of each application program installed by the vehicle to be tested;

[0007] In the running process of each application program, network data messages generated by the vehicle to be tested are obtained;

[0008] Based on the network data messages, network layer data packets and domain name system data packets are obtained;

[0009] After determining that the vehicle to be tested has data cross-border flow based on the home information of the first Internet protocol address in the network layer data packet, the cross-border flow information of the data of the vehicle to be tested is obtained according to the first Internet protocol address and the domain name system data packet.

[0010] Beneficial effects: the test equipment is used to control the running of each application program of the measured vehicle itself, ensures that the measured vehicle can be comprehensively detected, and the network data packets generated by the measured vehicle are identified during the running of each application program, the network layer data packet and the domain name system data packet are obtained, which is beneficial to improve the detection efficiency and accuracy. After determining that the measured vehicle has data cross-border flow based on the home information of the first internet protocol address in the network layer data packet, the cross-border flow information of the measured vehicle data is obtained according to the first internet protocol address and the domain name system data packet, which is convenient for developers to view and quickly locate problems, thereby reducing the risk of data leakage.

[0011] In an optional embodiment, the control of the running of each application program installed by the measured vehicle itself comprises:

[0012] Obtaining the application package name of all application programs installed by the measured vehicle itself;

[0013] Based on the application package name, a random event trigger instruction corresponding to each application program is generated;

[0014] The measured vehicle is controlled to dynamically run each application program installed by the measured vehicle itself based on the random event trigger instruction, so as to simulate the random operation of the user for each application program.

[0015] Beneficial effects: in the embodiment of the application, the random event trigger instruction is sent to the measured vehicle through the command line tool, so that the measured vehicle triggers various random events in the process of dynamically running all application programs, simulates various random operations of the user for different application programs, ensures that all application programs of the measured vehicle can generate as many different types of data as possible, and facilitates comprehensive detection of various data behaviors of the measured vehicle, improves the range and accuracy of data cross-border detection.

[0016] In an optional embodiment, based on the application package name, a random event trigger instruction corresponding to each application program is generated, comprising:

[0017] Determining the trigger interval time of the random event corresponding to each application program;

[0018] Calling the preset random operation test tool on the measured vehicle, and generating a random event trigger instruction corresponding to each application program according to the application package name and the trigger interval time corresponding to each application program.

[0019] Beneficial effects: the embodiment of the application sets the trigger interval time of the random event, generates a random event trigger instruction for all application programs of the measured vehicle, and dynamically runs all application programs on the measured vehicle, so as to facilitate the measured vehicle to generate various network data packets for the test equipment to detect.

[0020] In an optional implementation, the cross-border flow information of the vehicle data under test is obtained according to the first Internet Protocol address and the Domain Name System data packet, including:

[0021] The Domain Name System data packet is screened to obtain domain name data meeting preset conditions;

[0022] When it is detected that the second Internet Protocol address in the domain name data is a preset Internet Protocol version, and the second Internet Protocol address is consistent with the first Internet Protocol address, the overseas webpage address accessed by the vehicle under test is obtained according to a query domain name field in the domain name data;

[0023] The cross-border flow information of the vehicle data under test is obtained according to the first Internet Protocol address, the overseas webpage address, and the information of the place of origin of the first Internet Protocol address.

[0024] Beneficial effects: in the embodiment of the application, the Domain Name System data packet is first screened according to preset conditions to quickly obtain effective domain name data and improve detection efficiency, then when the second Internet Protocol address in the Domain Name System is consistent with the first Internet Protocol address, the overseas webpage address accessed by the vehicle under test is obtained according to the query domain name field in the domain name data, and the cross-border flow information containing the first Internet Protocol address, the overseas webpage address, and the information of the place of origin is output for developers to check and quickly locate problems, thereby reducing the risk of data leakage and facilitating the guarantee of vehicle data security.

[0025] In an optional implementation, the Domain Name System data packet is screened to obtain domain name data meeting preset conditions, including:

[0026] The response message in the Domain Name System data packet is screened according to preset conditions to obtain a target response message; wherein the preset conditions are set based on the number of problem queries recorded in the message query segment and the number of resource records recorded in the message response segment;

[0027] The domain name data is obtained according to the message query segment in the target response message.

[0028] Beneficial effects: in the embodiment of the application, the response message in the Domain Name System data packet is screened according to the number of problem queries recorded in the message query segment and the number of resource records recorded in the message response segment, which facilitates quick positioning of the target response message containing effective domain name data.

[0029] In an optional implementation, the existence of cross-border flow of vehicle data under test is determined based on the information of the place of origin of the first Internet Protocol address in the network layer data packet, including:

[0030] It is judged whether the information of the place of origin of the first Internet Protocol address in the network layer data packet is an overseas area;

[0031] If the home information of the first Internet protocol address is an overseas region, it is determined that the measured vehicle exists data cross-border flow.

[0032] Beneficial effects: in the embodiment of the application, by acquiring the home information of the first Internet protocol address in the network layer data packet, and detecting whether the home information is an overseas region, whether the measured vehicle exists data cross-border flow behavior is accurately determined.

[0033] In an optional implementation, before controlling the measured vehicle to run each application program installed by itself, the method further comprises:

[0034] Turning on the target network hotspot, and controlling the measured vehicle to connect to the target network hotspot.

[0035] Beneficial effects: in the embodiment of the application, the test device uses the wireless network card to turn on the network hotspot, and the measured vehicle connects to the network hotspot opened by the test device, so that the test device can directly capture the network data packet generated by the measured vehicle.

[0036] In a second aspect, the application provides a vehicle data cross-border flow detection device, which comprises:

[0037] A first processing module, configured to control the measured vehicle to run each application program installed by itself;

[0038] A second processing module, configured to acquire network data packet generated by the measured vehicle in the running process of each application program;

[0039] A third processing module, configured to identify based on the network data packet to obtain a network layer data packet and a domain name system data packet;

[0040] A fourth processing module, configured to, after determining that the measured vehicle exists data cross-border flow based on the home information of the first Internet protocol address in the network layer data packet, obtain cross-border flow information of the data of the measured vehicle according to the first Internet protocol address and the domain name system data packet.

[0041] In a third aspect, the application provides a vehicle data cross-border flow detection system, which comprises: a test device and a measured vehicle;

[0042] The test device comprises a memory and a processor, which are communicatively connected with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the vehicle data cross-border flow detection method of the first aspect or any of the corresponding embodiments thereof.

[0043] In a fourth aspect, the present application provides a computer readable storage medium, having stored thereon computer instructions for causing a computer to execute the vehicle data cross-border flow detection method of the first aspect or any of the corresponding embodiments thereof.

[0044] In a fifth aspect, the present application provides a computer program product comprising computer instructions for causing a computer to execute the vehicle data cross-border flow detection method of the first aspect or any of the corresponding embodiments thereof.

[0045] The present application has the following beneficial effects:

[0046] The test equipment is used to control the running of each application program of the vehicle under test, ensuring that the vehicle under test can be comprehensively detected, and the network data packets generated by the vehicle under test during the running of each application program are identified to obtain network layer data packets and domain name system data packets, which is beneficial to improve the detection efficiency and accuracy. After determining that the vehicle under test has data cross-border flow based on the location information of the first internet protocol address in the network layer data packet, the cross-border flow information of the vehicle under test data is obtained according to the first internet protocol address and the domain name system data packet, which is convenient for developers to view and quickly locate problems, thereby reducing the risk of data leakage. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0048] Figure 1 is a structural block diagram of a vehicle data cross-border flow detection system according to an embodiment of the present application;

[0049] Figure 2 is a flowchart of a vehicle data cross-border flow detection method according to an embodiment of the present application;

[0050] Figure 3 is a flowchart of another vehicle data cross-border flow detection method according to an embodiment of the present application;

[0051] Figure 4 is a test flowchart of an automatic test tool according to an embodiment of the present application;

[0052] Figure 5 is a flowchart of an automatic running of in-vehicle application according to an embodiment of the present application;

[0053] Figure 6 is a flow diagram of network data packet analysis according to an embodiment of the present application;

[0054] Figure 7 is a structural block diagram of a vehicle data cross-border flow detection device according to an embodiment of the present application;

[0055] Figure 8 is a hardware structure schematic diagram of a test device according to an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0057] With the continuous expansion of the commercial scale of the Internet of Vehicles, if the transmission and use of the Internet of Vehicles data are not effectively managed, and the data is allowed to flow disorderly, there is a great risk of data security, which obviously threatens the personal information and privacy protection of vehicle users. The automobile whole vehicle information security technology requires that the vehicle should not directly transmit data to overseas, and therefore, how to detect whether the vehicle has accessed an overseas Internet Protocol Address (IP) address and transmitted data to the overseas IP address is particularly important.

[0058] At present, manual testing needs to confirm whether the network packet is an overseas IP online one by one, and there are problems of original testing method, low testing efficiency and easy statistical error of testing results. In view of the deficiency of manual testing, the related technology detects whether an overseas IP is accessed by analyzing and detecting the host process, and discovers hidden processes by timing inspection, so as to improve the detection efficiency. However, during the running of the host, not all application programs will be frequently used by the user, and these application programs and certain random operations also have the risk of abnormal access to an overseas IP address, resulting in low accuracy of the detection result of the above method. In addition, the traditional method only focuses on the detection of overseas transmission, and cannot provide detailed overseas transmission information after detecting abnormal behavior, which is not conducive to the viewing of technical personnel.

[0059] Therefore, the embodiment of the present application provides a detection scheme for vehicle data cross-border flow, which can comprehensively capture network data messages sent by a vehicle to the outside and automatically analyze the network data messages to determine whether the vehicle accesses an overseas IP address, thereby improving detection efficiency, and when it is detected that the vehicle accesses an overseas IP, cross-border flow information of the data is output, so that a developer can quickly locate a problem.

[0060] According to the embodiment of the present application, a detection system for vehicle data cross-border flow is provided, as shown in the figure, the detection system for vehicle data cross-border flow comprises a test device 101 and a vehicle 102 to be tested, wherein the test device 101 and the vehicle 102 to be tested are connected. Figure 1

[0061] Specifically, the test device 101 controls the vehicle 102 to be tested to run each application program installed by itself, obtains network data messages generated by the vehicle 102 to be tested in the running process of each application program, and then identifies the network data messages based on the network data messages to obtain network layer data packets and domain name system data packets. After it is determined that the vehicle 102 to be tested has data cross-border flow based on the home information of the first Internet protocol address in the network layer data packets, the cross-border flow information of the data of the vehicle 102 to be tested is obtained according to the first Internet protocol address and the domain name system data packets.

[0062] The specific working principle and working process of the test device 101 and the vehicle 102 to be tested can be referred to the description of the method embodiment below, and will not be described here.

[0063] In some optional embodiments, the test device 101 can start a network hotspot of itself, so that the vehicle 102 to be tested is connected to the network hotspot, and the test device 101 can obtain the network data messages generated by the vehicle 102 to be tested. For example, the vehicle 102 to be tested uses WiFi to connect to the hotspot opened by the wireless network card of the test device 101, and the test device 101 can use the WireShark tool to capture the data flow of the wireless network card, so as to obtain the network data messages sent by the vehicle 102 to be tested. The test device 101 can be a computer, a computer or other electronic device, and the present application is not limited thereto.

[0064] According to the embodiment of the present application, a detection method for vehicle data cross-border flow is provided, and it should be noted that the steps shown in the flowchart of the drawing can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0065] In the present embodiment, a detection method for vehicle data cross-border flow is provided, which can be used in the detection system for vehicle data cross-border flow as shown in the figure. Figure 1 ​The test device 101 shown, such as a test device, a tablet computer, etc. Figure 2 is a flow chart of a detection method for vehicle data cross-border flow according to an embodiment of the present application, as shown, the flow comprises the following steps: Figure 2

[0066] Step S201, control the measured vehicle to run each application program installed by itself.

[0067] Specifically, after the test device is connected with the measured vehicle, a series of instructions can be sent to it to automatically run all application programs (APP) installed by the measured vehicle. Among them, a certain number of APPs can be selected to run in batches, or each APP can be run one by one, as long as all application programs installed by the measured vehicle are ensured to run, so as to comprehensively detect all APPs and avoid omission.

[0068] Step S202, in the running process of each application program, the network data packet generated by the measured vehicle is obtained.

[0069] Specifically, before detecting the measured vehicle, the test device can first start the target network hotspot and control the measured vehicle to connect to the target network hotspot, so that the test device can directly capture the network data packet generated by the measured vehicle.

[0070] In some optional embodiments, the test device uses a wireless network card to start a network hotspot, the measured vehicle connects to the network hotspot opened by the test device through WiFi, and the test device uses a network analysis tool WireShark to capture the network data packet of the network card of the network hotspot opened by the test device. In addition, a packet capturing tool such as Fiddler, Charles, etc. can also be used to obtain the network data packet.

[0071] Step S203, identifying based on the network data packet to obtain the network layer data packet and the domain name system data packet.

[0072] Specifically, the network data packet can be identified based on the protocol type of the data packet, and the network layer (i.e. IP layer) data packet and the domain name system (Domain Name System, DNS) data packet are screened out. Exemplarily, the haslayer() function in the scapy library of python language can be used for data packet screening.

[0073] In some optional embodiments, before identifying the network data packet, the network data packet can be saved as a.pcapng format file, and then the sniff function, haslayer() function, etc. of the scapy library of python language are used to analyze the.pcapng file.​

[0074] Step S204: After determining that the tested vehicle has cross-border data flow based on the location information of the first Internet Protocol address in the network layer data packet, cross-border data flow information of the tested vehicle is obtained according to the first Internet Protocol address and Domain Name System data packet.

[0075] Specifically, the first Internet Protocol (IP) address is extracted from the network layer data packets. The location information of this IP address is then queried to determine if it is located in a foreign region. If it is, it confirms that the tested vehicle is experiencing cross-border data flow. Then, based on the IP address and domain name data in the DNS data packets, cross-border flow information such as the web page addresses accessed by the tested vehicle is obtained. This facilitates developers' review and rapid problem localization, thereby reducing the risk of data leakage.

[0076] The method for detecting cross-border vehicle data flow provided in this embodiment utilizes testing equipment to control the various applications running on the vehicle under test, ensuring comprehensive detection of the vehicle. During the operation of each application, the method identifies the network data packets generated by the vehicle under test, obtaining network layer data packets and Domain Name System (DNS) data packets, which improves detection efficiency and accuracy. After determining that the vehicle under test is experiencing cross-border data flow based on the location information of the first Internet Protocol (IP) address in the network layer data packets, the cross-border data flow information of the vehicle under test is obtained based on the first IP address and DNS data packets. This facilitates developers' review and rapid problem localization, thereby reducing the risk of data leakage.

[0077] This embodiment provides a method for detecting cross-border flow of vehicle data, which can be used for, for example... Figure 1 The test device 101 shown may be a test device, a tablet computer, etc. Figure 3 This is a flowchart of a method for detecting cross-border flow of vehicle data according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0078] Step S301: Control the vehicle under test to run the various applications installed on it.

[0079] Specifically, step S301 includes:

[0080] Step S3011: Obtain the application package names of all applications installed on the vehicle under test.

[0081] Specifically, the testing equipment can issue a series of commands to the vehicle under test through a command-line tool to obtain the application package names of all applications of the vehicle under test.

[0082] In some optional embodiments, the test device can communicate with the vehicle machine of the vehicle under test through ADB (Android Debug Bridge) to execute "adb shell pm list package" to obtain the application package names of all APPs installed on the vehicle machine, such as APP1, APP2, and the like. It should be noted that the ADB tool is a multifunctional command line tool, which allows developers to communicate with Android devices and provides various ways to install and debug applications on the device, execute Shell commands, manage device status, and the like.

[0083] In step S3012, the random event triggering instruction corresponding to each application program is generated based on the application package name.

[0084] Specifically, the triggering interval time of the random event corresponding to each application program is determined, the random operation test tool pre-installed on the vehicle under test is called, and the random event triggering instruction corresponding to each application program is generated according to the application package name corresponding to each application program and the triggering interval time.

[0085] In some optional embodiments, the test device can use the random operation test tool to loop through all the application package names, and can also set the triggering interval time of the random event, trigger the random event of the APP, such as touch, gesture operation, two-finger zoom, track, rotation, keyboard event, system key, and the like, generate the corresponding random event triggering instruction, and dynamically run all application programs.

[0086] It should be noted that the random operation test tool can be the Monkey tool provided by the vehicle machine. The Monkey tool tests the program on the device by sending a pseudo-random user event stream (such as key input, touch screen input, sliding, gesture input, and the like) to the system to test the program, detect the long-time stability of the program, and how long the time will be abnormal.

[0087] In some optional embodiments, the application package name of each APP obtained by looping is called, and the Monkey tool provided by the vehicle machine is called, and the triggering interval time of the random event is set by the random value of the throttle parameter (after setting, the random event interval of this APP run is run according to this triggering interval time).

[0088] Taking the application package name com.autonavi.comapauto as an example, the corresponding instruction " / system / framework / monkey.jar" is generated to trigger the random click event of com.autonavi.comapauto to dynamically run, and the random click of com.autonavi.comapauto is triggered 10000 times, and the interval between each click is 1000 ms, and the corresponding instruction is "adb shell-p com.autonavi.comapauto 10000-throttle 1000".

[0089] The embodiment of the application sets the trigger interval time of the random event, generates the random event trigger instruction for all application programs of the vehicle under test, and dynamically runs all application programs on the vehicle under test, so that the vehicle under test generates various network data messages of different types for the test device to detect.

[0090] In step S3013, the vehicle under test dynamically runs each application program installed by itself based on the random event trigger instruction, to simulate the random operation of the user on each application program.

[0091] Specifically, the random event trigger instruction is sent to the vehicle under test through the command line tool, so that the vehicle under test triggers various random events in the process of dynamically running all application programs, simulates various random operations of the user on different application programs, ensures that all application programs of the vehicle under test can generate as many different types of data as possible, and facilitates comprehensive detection of various data behaviors of the vehicle under test, and improves the range and accuracy of data cross-border detection.

[0092] In some optional embodiments, the vehicle under test can also send the running result log of each application program to the test device to feed back whether the APP is successfully started. If the APP fails to start, "No activities found to run" is fed back to indicate that the APP fails to start, and no feedback indicates that the APP is successfully started. The test device will restart the APP that fails to start last time according to the running result log, and so on, to ensure that all in-vehicle APPs of the vehicle under test are run. When all APPs of the vehicle under test are clicked, "adb shell am force-stop {application package name}" is used to stop the running of the APP.

[0093] In step S302, network data messages generated by the vehicle under test are acquired in the running process of each application program. For details, refer to Figure 2 The step S202 of the embodiment shown in the figure is not described here.

[0094] Step S303, identifying based on the network data packet to obtain the network layer data packet and the domain name system data packet. For details, please refer to Figure 2 Step S203 of the embodiment shown, which will not be repeated here.

[0095] Step S304, after determining that the measured vehicle exists data cross-border flow based on the home information of the first internet protocol address in the network layer data packet, obtaining the cross-border flow information of the measured vehicle data according to the first internet protocol address and the domain name system data packet.

[0096] Specifically, the above step S304 includes:

[0097] Step S3041, determining whether the home information of the first internet protocol address in the network layer data packet is an overseas area.

[0098] Specifically, the destination IP address in the network layer data packet is extracted and duplicates are removed to obtain the first internet protocol address.

[0099] In some optional embodiments, the home information of the first internet protocol address can be obtained by calling the open source GeoIP2 database to realize offline query, and information such as country name (country_name), province name (province_name), city name (city_name), longitude (longtidude) and latitude (latidude) is obtained, so as to accurately determine whether the home information of the first internet protocol address is an overseas area according to the information such as country name (country_name).

[0100] Specifically, if the home information of the first internet protocol address is an overseas area, step S3042 and subsequent steps are executed; otherwise, it means that the measured vehicle does not exist data cross-border flow behavior.

[0101] Step S3042, if the home information of the first internet protocol address is an overseas area, it is determined that the measured vehicle exists data cross-border flow.

[0102] In the embodiments of the present application, the home information of the first internet protocol address in the network layer data packet is obtained, and it is detected whether the home information is an overseas area, so as to accurately determine whether the measured vehicle exists data cross-border flow behavior.

[0103] Step S3043, screening the domain name system data packet to obtain domain name data meeting the preset condition.

[0104] Specifically, the response message in the domain name system data packet is screened according to a preset condition to obtain a target response message, and domain name data is obtained according to a message query segment in the target response message. The preset condition is set based on a problem query quantity of a message query segment record and a resource record quantity of a message answer segment record.

[0105] In some optional embodiments, after it is determined that the home information of the first Internet protocol address is an overseas region, the resolved DNS data packet needs to be screened, and the preset condition for screening can be that the QR field of the message is 1 (indicating a response message), the problem query quantity QDCount of the message query segment record is greater than or equal to 1, and the resource record quantity ANCount of the message answer segment record is greater than or equal to 1. The above-mentioned preset condition is used to traverse all DNS data packets to obtain target response messages that meet the preset condition. Then, the QNAME (query domain name) field of the message query segment and the resource record data RDATA corresponding to the message query segment in the target response message are obtained to obtain domain name data.

[0106] In the embodiments of the present application, the response message in the domain name system data packet is screened according to the problem query quantity of the message query segment record and the resource record quantity of the message answer segment record, so that the target response message containing effective domain name data can be quickly located.

[0107] In step S3044, when it is detected that the second Internet protocol address in the domain name data is a preset Internet protocol version, and the second Internet protocol address is consistent with the first Internet protocol address, the query domain name field in the domain name data is used to obtain an overseas webpage address accessed by the vehicle under test.

[0108] Specifically, the second Internet protocol address recorded in the RDATA in the domain name data is extracted, and it is determined whether the second Internet protocol address is an IPv4 (Internet Protocol version 4) address. If yes, it is further determined whether the second Internet protocol address is consistent with the first Internet protocol address in the above-mentioned step. If yes, it is indicated that the URL (Uniform Resource Locator) address corresponding to the QNAME field in the domain name data is the overseas webpage address accessed by the vehicle under test.

[0109] In step S3045, the cross-border flow information of the vehicle under test is obtained according to the first Internet protocol address, the overseas webpage address, and the home information of the first Internet protocol address.

[0110] Specifically, the cross-border flow information containing the first Internet protocol address, the overseas webpage address, and the home information of the first Internet protocol address is outputted for the developer to view and quickly locate the problem.

[0111] In the embodiment of the present application, the domain name system data packet is first screened according to the preset condition, so as to quickly obtain valid domain name data and improve the detection efficiency. Then, when the second Internet protocol address and the first Internet protocol address in the domain name system are consistent, the overseas webpage address accessed by the vehicle under test is obtained according to the query domain name field in the domain name data, and the cross-border flow information containing the first Internet protocol address, the overseas webpage address and the place of origin information is outputted, so as to be viewed by the developer and the problem is quickly located, thereby reducing the risk of data leakage and being beneficial to guarantee the vehicle data security.

[0112] The vehicle data cross-border flow detection method provided in the embodiment sends a random event trigger instruction to the vehicle under test through a command line tool, so that the vehicle under test triggers various random events in the process of dynamically running all application programs, simulates various random operations of a user on different application programs, ensures that the vehicle under test can be comprehensively detected, and identifies the network data packets generated by the vehicle under test in the running process of each application program to obtain network layer data packets and domain name system data packets, which is beneficial to improve the detection efficiency and accuracy. After it is determined that the vehicle under test has data cross-border flow based on the place of origin information of the first Internet protocol address in the network layer data packet, the domain name system data packet is screened according to the preset condition, so as to quickly obtain valid domain name data and improve the detection efficiency. The overseas webpage address accessed by the vehicle under test is obtained according to the query domain name field in the domain name data, and the cross-border flow information containing the first Internet protocol address, the overseas webpage address and the place of origin information is outputted, so as to be viewed by the developer and the problem is quickly located, thereby reducing the risk of data leakage.

[0113] The vehicle data cross-border flow detection method of the present application will be described in detail below with a specific application example taking a test computer as a test device.

[0114] As shown in Figure 4 The detection method of the present application can be integrated into a test tool to run, and the test computer is connected with the vehicle under test through the test tool to realize the automatic test of the vehicle under test, which mainly includes the following steps:

[0115] Step one, automatically running all APPs in the vehicle.

[0116] The test computer is connected to the vehicle machine of the vehicle under test through the ADB tool, and the application package name of all APPs installed in the vehicle machine is obtained by executing "adb shell pm list package". The random click event of the Monkey ( / system / framework / monkey.jar) of the vehicle machine is triggered by calling each APP package name obtained by loop iteration, and the random event interval time is set by the random value of the throttle parameter.

[0117] As shown in Figure 5 , the vehicle under test can also send the running result log of each application to the test device to feedback whether the APP is successfully started. If the start fails, it will feedback "No activities found to run" to indicate that the APP start fails, and if there is no feedback, it means that the APP start succeeds. The test device will restart the APP that failed to start last time according to the running result log, and so on, to ensure that all in-vehicle APPs of the vehicle under test can run. When all the APPs of the vehicle under test are clicked, the running of the APP is stopped by using "adb shell am force-stop {application package name}".

[0118] Step two, capture the network data packets accessed by the vehicle under test.

[0119] The test computer uses a wireless network card to open a hotspot, and the vehicle under test is connected to the hotspot opened by the test computer through WiFi. The test computer uses the network analysis tool WireShark to capture the network data packets of the network card of the test computer's open hotspot.

[0120] Step three, network data packet analysis.

[0121] The network data packets captured by Wireshark are saved as.pcapng format files and imported into the test tool as shown in Figure 4 for analysis. The test tool uses the sniff function of the scapy library in python language to parse the.pcapng file, as shown in Figure 6 , and the parsing process is as follows:

[0122] First, the IP layer packet is filtered out by using the haslayer() function of the scapy library, and the target IP address in the packet is taken out to remove duplicates to obtain the first internet protocol address.

[0123] Secondly, the home information of the first internet protocol address is queried offline by calling the open source GeoIP2 database, including country name (country_name), province name (province_name), city name (city_name), longitude (longtidude) and latitude (latidude) and other information.

[0124] Then, whether the first internet protocol address belongs to an overseas IP is judged according to the country name (country_name). If it is judged as an overseas IP address, the DNS data packet in the parsed network data message needs to be screened again, and the screening conditions include QR field being 1, ANCount (the number of records in the specified answer part) being greater than or equal to 1, and QDCount (the number of questions in the specified query part) being greater than or equal to 1. All the response messages meeting the conditions are traversed, and whether the second internet protocol address in the RDATA (resource record data) field of the response message is IPv4 is judged.

[0125] Finally, if the second internet protocol address is IPv4, whether it is equal to the first internet protocol address is judged, and the URL address corresponding to the QNAME (query domain name) field in the response message is the overseas IP address accessed by the vehicle under test. The overseas IP address, the URL address and the IP location of the network data message to be analyzed are output by the test tool. That is, if the result output by the test tool is empty, it means that the test is passed, and if the result is not empty, it means that the vehicle under test has the problem of transmitting data to the overseas IP.

[0126] The application provides an automatic test tool and method. The tool can automatically identify overseas IP and corresponding URL by importing the network message accessed by the vehicle, which is convenient for developers to quickly locate problems. The problems of manual testing, such as the need to confirm whether the network message is an overseas IP online, the original testing method, the low testing efficiency and the statistical error of testing results, are solved.

[0127] In the embodiment, a vehicle data cross-border flow detection device is also provided, which is used to realize the above-mentioned embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that realizes a predetermined function. Although the device described in the following embodiments is preferably realized in software, hardware or a combination of software and hardware is also possible and is conceived.

[0128] The embodiment provides a vehicle data cross-border flow detection device, as shown in the figure, which includes: Figure 7

[0129] ​The first processing module 701 is configured to control the measured vehicle to run each application program installed by itself.

[0130] The second processing module 702 is configured to acquire network data packets generated by the measured vehicle during running of each application program.

[0131] The third processing module 703 is configured to identify the network data packets to obtain network layer data packets and domain name system data packets.

[0132] The fourth processing module 704 is configured to determine, after determining that the measured vehicle has data cross-border flow based on the home information of the first Internet protocol address in the network layer data packets, the cross-border flow information of the data of the measured vehicle according to the first Internet protocol address and the domain name system data packets.

[0133] In some optional embodiments, before the first processing module 701 controls the measured vehicle to run each application program installed by itself, the apparatus is further configured to:

[0134] start a target network hotspot, and control the measured vehicle to connect to the target network hotspot.

[0135] In some optional embodiments, the first processing module 701 is further configured to:

[0136] acquire application package names of all application programs installed by the measured vehicle;

[0137] generate random event trigger instructions corresponding to each application program based on the application package names;

[0138] control the measured vehicle to dynamically run each application program installed by itself based on the random event trigger instructions, so as to simulate random operations of a user on each application program.

[0139] In some optional embodiments, the first processing module 701 is further configured to:

[0140] determine trigger interval times of random events corresponding to each application program;

[0141] call a preset random operation test tool on the measured vehicle, and generate random event trigger instructions corresponding to each application program according to the application package names corresponding to each application program and the trigger interval times.

[0142] In some optional embodiments, the fourth processing module 704 is further configured to:

[0143] determine whether the home information of the first Internet protocol address in the network layer data packets is an overseas region;

[0144] If the first Internet Protocol address is in an overseas region, it is determined that the vehicle under test has data cross-border flow.

[0145] In some optional embodiments, the fourth processing module 704 is further configured to:

[0146] filtering the domain name system data packet to obtain domain name data meeting preset conditions;

[0147] When it is detected that the second Internet Protocol address in the domain name data is a preset Internet Protocol version, and the second Internet Protocol address is consistent with the first Internet Protocol address, obtaining an overseas webpage address accessed by the vehicle under test according to a query domain name field in the domain name data;

[0148] obtaining cross-border flow information of the vehicle under test according to the first Internet Protocol address, the overseas webpage address, and the home information of the first Internet Protocol address.

[0149] In some optional embodiments, the fourth processing module 704 is further configured to:

[0150] filtering the response message in the domain name system data packet according to preset conditions to obtain a target response message; wherein the preset conditions are set based on the number of problem queries in the message query segment record and the number of resource records in the message answer segment record;

[0151] obtaining domain name data according to the message query segment in the target response message.

[0152] Further function descriptions of the above-mentioned various modules and units are the same as those of the corresponding embodiments described above, and will not be repeated here.

[0153] The vehicle data cross-border flow detection device in the embodiment is in the form of a functional unit, and the unit herein refers to an ASIC (Application Specific Integrated Circuit, Application Specific Integrated Circuit) circuit, a processor and a memory executing one or more software or fixed programs, and / or other devices that can provide the above functions.

[0154] The embodiment of the application also provides a test device having the vehicle data cross-border flow detection device described above. Figure 7 as shown in the vehicle data cross-border flow detection device.

[0155] Please refer to Figure 8 , Figure 8 is a structural schematic diagram of a test device provided by an optional embodiment of the application, as Figure 8As shown, the test device includes one or more processors 10, memory 20, and interfaces 50 for connecting the various components, including high-speed interfaces and low-speed interfaces. The various components communicate over various buses and can be mounted on a common motherboard or in other manners as appropriate. The processor(s) can process instructions for execution within the test device, including instructions stored in the memory or on storage to implement routines, processes or programs, e.g., for displaying GUIs on external input / output devices, such as display devices coupled to the interfaces. In some optional implementations, multiple processors and / or multiple buses can be employed as appropriate, as well as multiple memories and types of memory. Also, various components can be connected by various interfaces, not just the bus. In some optional implementations, multiple devices can be connected, with each device providing portions of the necessary operations (e.g., as a server array, a group of blade servers, or a multi-processor system). Figure 8 The processor 10 is taken as an example in the embodiment.

[0156] The processor 10 can be a central processing unit, a network processing unit, or a combination thereof. The processor 10 can further include a hardware chip. The hardware chip can be an application specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device can be a complex programmable logic device, a field programmable logic device, a general array logic, or any combination thereof.

[0157] The memory 20 stores instructions executable by the at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiment.

[0158] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system, application programs required by at least one function; and the data storage area can store data created according to the use of the test device, etc. In addition, the memory 20 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some optional implementations, the memory 20 can optionally include a memory disposed remotely with respect to the processor 10, and these remote memories can be connected to the test device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0159] The memory 20 can include a volatile memory, such as a random access memory, and can also include a non-volatile memory, such as a flash memory, a hard disk, or a solid state disk, and can also include a combination of the above kinds of memories.

[0160] The test device further includes input devices 30 and output devices 40. The processor 10, the memory 20, the input devices 30, and the output devices 40 can be connected by a bus or other means,Figure 8 The bus connection is taken as an example.

[0161] The input device 30 can receive inputted digital or character information, and generate key signal inputs related to user settings and function controls of the testing apparatus, such as a touch screen, a keypad, a mouse, a trackpad, a touchpad, a pointing stick, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 can include a display device, an auxiliary lighting device (e.g., an LED), a tactile feedback device (e.g., a vibration motor), etc. The display device includes, but is not limited to, a liquid crystal display, a light emitting diode, a display, and a plasma display. In some alternative embodiments, the display device can be a touch screen.

[0162] The embodiments of the present application also provide a computer readable storage medium, the method according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or stored in a remote storage medium or a non-transitory machine readable storage medium and downloaded from a network and stored in a local storage medium, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special purpose hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk or a solid state disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that the computer, processor, microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, processor or hardware, the method shown in the above embodiments is implemented.

[0163] Part of the present application can be applied as a computer program product, for example, computer program instructions, when executed by a computer, the operation of the computer can invoke or provide the method and / or technical solutions according to the present application. Those skilled in the art should understand that the form of computer program instructions in computer readable medium includes but is not limited to source file, executable file, installation package file, etc., and accordingly, the way of computer program instructions executed by computer includes but is not limited to: the computer directly executes the instructions, or the computer compiles the instructions and then executes the corresponding compiled program, or the computer reads and executes the instructions, or the computer reads and installs the instructions and then executes the corresponding installed program. Here, the computer readable medium can be any available computer readable storage medium or communication medium accessible to the computer.

[0164] While embodiments of the application have been described in connection with the preferred embodiments of the various figures, those of ordinary skill in the art will appreciate that various modifications and changes can be made without departing from the spirit and scope of the application, and that such modifications and changes fall within the scope of the appended claims.

Claims

1. A method for detecting cross-border flow of vehicle data, characterized in that, The method comprises: controlling the measured vehicle to run each application program installed by itself; during the running of each application program, obtaining network data messages generated by the measured vehicle; based on the network data messages, obtaining network layer data packets and domain name system data packets; after determining that the measured vehicle has data cross-border flow based on the home information of the first Internet Protocol address in the network layer data packets, obtaining cross-border flow information of the measured vehicle data according to the first Internet Protocol address and the domain name system data packets; the cross-border flow information of the measured vehicle data obtained according to the first Internet Protocol address and the domain name system data packets comprises: screening the domain name system data packets to obtain domain name data meeting preset conditions; when it is detected that the second Internet Protocol address in the domain name data is a preset Internet Protocol version, and the second Internet Protocol address is consistent with the first Internet Protocol address, obtaining the overseas webpage address accessed by the measured vehicle according to the query domain name field in the domain name data; obtaining the cross-border flow information of the measured vehicle data according to the first Internet Protocol address, the overseas webpage address and the home information of the first Internet Protocol address.

2. The method of claim 1, wherein, controlling the measured vehicle to run each application program installed by itself comprises: obtaining the application package name of all application programs installed by the measured vehicle itself; based on the application package name, generating random event trigger instructions corresponding to each application program; controlling the measured vehicle to dynamically run each application program installed by itself based on the random event trigger instructions, so as to simulate random operations of the user for each application program.

3. The method of claim 2, wherein, determining the trigger interval time of the random event corresponding to each application program; calling the preset random operation test tool on the measured vehicle, and generating random event trigger instructions corresponding to each application program according to the application package name and the trigger interval time corresponding to each application program. screening the response messages in the domain name system data packets according to preset conditions to obtain target response messages; wherein the preset conditions are set based on the number of problem queries in the message query segment record and the number of resource records in the message response segment record; 4. The method of claim 1, wherein, obtaining domain name data according to the message query segment in the target response message. determining whether the home information of the first Internet Protocol address in the network layer data packets is an overseas area; if the home information of the first Internet Protocol address is an overseas area, it is determined that the measured vehicle has data cross-border flow.

5. The method according to claim 1 or 4, characterized in that, before the control of the measured vehicle to run each application program installed by itself, the method further comprises: starting a target network hotspot and controlling the measured vehicle to connect to the target network hotspot. ​ 6. The method according to any one of claims 1 to 4, characterized in that, ​ ​ 7. A detection device for vehicle data cross-border flow, characterized in that, The device comprises: A first processing module for controlling the measured vehicle to run each application program installed by itself; A second processing module for obtaining network data packets generated by the measured vehicle during the running of each application program; A third processing module for identifying based on the network data packets to obtain network layer packets and domain name system packets; A fourth processing module for determining that the measured vehicle has data cross-border flow based on the home information of a first Internet Protocol address in the network layer packets, and obtaining cross-border flow information of the measured vehicle data according to the first Internet Protocol address and the domain name system packets; The fourth processing module is further configured to: Filter the domain name system packets to obtain domain name data meeting preset conditions; When it is detected that a second Internet Protocol address in the domain name data is a preset Internet Protocol version, and the second Internet Protocol address is consistent with the first Internet Protocol address, obtain an overseas webpage address accessed by the measured vehicle according to a query domain name field in the domain name data; Obtain the cross-border flow information of the measured vehicle data according to the first Internet Protocol address, the overseas webpage address, and the home information of the first Internet Protocol address.

8. A system for detecting cross-border flow of vehicle data, characterized in that, Comprise: A test device and a measured vehicle; The test device comprises a memory and a processor, which are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the vehicle data cross-border flow detection method in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for making a computer execute the vehicle data cross-border flow detection method in any one of claims 1 to 6.

10. A computer program product, characterised in that, Comprise computer instructions for making a computer execute the vehicle data cross-border flow detection method in any one of claims 1 to 6.

Images