CAN bus adaptive fuzzy test method and system based on large language model

Abstract

The invention discloses a CAN bus adaptive fuzzy test method and system based on a large language model. The method comprises the following steps: obtaining an initial CAN message seed and a fine tuning data set; according to the fine tuning data set and a large language model, analyzing current test context information to generate a variation strategy; generating a variation CAN frame according to the initial CAN message seed and the variation strategy; sending the variation CAN frame to a target CAN bus, generating a test log, and obtaining monitoring data of the electronic control unit; and integrating and evaluating the test log and the monitoring data to obtain feedback information. The method can improve the efficiency and accuracy of finding vulnerabilities, and can be widely applied to the technical field of fuzzy testing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of fuzz testing, and in particular to a CAN bus adaptive fuzz testing method and system based on a large language model. BACKGROUND

[0002] Controller Area Network (CAN bus) is a widely used serial communication protocol in the fields of automotive electronics, industrial automation, and avionics. Its main features include efficient data transmission mechanism, strong fault tolerance capability, and flexible communication mode without master-slave architecture. In automotive electronic systems, CAN bus is widely used for data exchange between electronic control units (ECUs) to realize engine management, transmission control, vehicle body control, and driving assistance functions. However, CAN bus mainly focuses on real-time performance and reliability at the design stage, and does not consider modern network security threats, so it is vulnerable to various attack methods, such as message tampering, denial-of-service attacks, bus flooding attacks, and message replay attacks. These attacks can cause automotive system failure and even endanger driving safety. Therefore, security testing and vulnerability detection for CAN bus have become an important research direction in the field of automotive information security in recent years.

[0003] Currently, the security testing methods for CAN bus mainly include static analysis and fuzz testing. Static analysis usually performs code review or protocol consistency checks based on ECU firmware or CAN database (DBC) files to find potential security vulnerabilities. However, static analysis is difficult to simulate real running environment and cannot effectively detect security risks in dynamic interaction process. In contrast, fuzz testing is a widely used dynamic testing method for protocol security testing, whose basic principle is to construct abnormal input data and send it to the target system to observe its abnormal behavior to find potential security vulnerabilities. Traditional CAN bus fuzz testing usually uses random variation or rule variation to perturb CAN messages and monitor the running state of ECU, such as whether it crashes or responds abnormally. However, traditional fuzz testing methods have some limitations. Traditional CAN bus fuzz testing relies on random variation or fixed rules and cannot optimize for the actual working state of ECU, resulting in a large number of redundant tests and low vulnerability discovery rate. Different manufacturers' ECUs use different CAN protocol implementation methods, and fixed rules are difficult to adapt to different environments, resulting in unstable test results and difficulty in achieving efficient and accurate fuzz testing. Existing methods cannot monitor ECU state in real time, and the test only focuses on CAN frame variation, lacking in-depth analysis of system behavior, resulting in test results that do not match the actual attack scenario. In addition, traditional fuzz testing tools require a lot of manual intervention, including parameter configuration and result screening, making it difficult to achieve fully automated testing and increasing testing cost and complexity. SUMMARY

[0004] Therefore, the embodiment of the present application mainly aims to provide a CAN bus adaptive fuzzing method and system based on a large language model, so as to solve at least one of the problems in the prior art, and improve the efficiency and accuracy of discovering vulnerabilities.

[0005] To achieve the above-mentioned purpose, one aspect of the embodiment of the present application provides a CAN bus adaptive fuzzing method based on a large language model, comprising:

[0006] obtaining an initial CAN message seed and a fine-tuning data set;

[0007] analyzing the current test context information according to the fine-tuning data set and the large language model, and generating a mutation strategy;

[0008] generating a mutated CAN frame according to the initial CAN message seed and the mutation strategy;

[0009] sending the mutated CAN frame to a target CAN bus, generating a test log, and obtaining monitoring data of an electronic control unit;

[0010] integrating and evaluating the test log and the monitoring data to obtain feedback information;

[0011] The test context information includes the monitoring data and the feedback information.

[0012] In some embodiments, the step of obtaining an initial CAN message seed and a fine-tuning data set comprises the following steps:

[0013] collecting CAN database files, CAN protocol standard documents, electronic control unit information, unified diagnostic service documents, and historical test data;

[0014] parsing the CAN database files to generate the initial CAN message seed;

[0015] preprocessing and format-unifying the CAN protocol standard documents, the electronic control unit information, the unified diagnostic service documents, and the historical test data to obtain the fine-tuning data set.

[0016] In some embodiments, the step of analyzing the current test context information according to the fine-tuning data set and the large language model to generate a mutation strategy comprises the following steps:

[0017] fine-tuning the large language model according to the fine-tuning data set;

[0018] fusing the current monitoring data and the historical feedback information to obtain the current test context information;

[0019] The test context information is analyzed by the fine-tuned large language model to obtain the mutation strategy.

[0020] In some embodiments, the generating a mutated CAN frame according to the initial CAN message seed and the mutation strategy comprises the following steps:

[0021] According to the initial CAN message seed, a basic CAN frame is selected;

[0022] The mutation strategy is applied to the basic CAN frame to generate the mutated CAN frame.

[0023] In some embodiments, the sending the mutated CAN frame to the target CAN bus, generating a test log, and obtaining monitoring data of an electronic control unit comprises the following steps:

[0024] The mutated CAN frame is sent to the target CAN bus, and all sent mutated CAN frames and corresponding sending timestamps are recorded to generate the test log;

[0025] Communication with the electronic control unit is established through a diagnostic protocol, and the electronic control unit is monitored to obtain the monitoring data.

[0026] In some embodiments, the establishing communication with the electronic control unit through a diagnostic protocol and monitoring the electronic control unit to obtain the monitoring data comprises the following steps:

[0027] A unified diagnostic service request is sent to the electronic control unit;

[0028] A response frame returned by the electronic control unit is received;

[0029] The response frame is parsed to obtain the monitoring data.

[0030] In some embodiments, the integrating and evaluating the test log and the monitoring data to obtain feedback information comprises the following steps:

[0031] The test log and the monitoring data are integrated to obtain integrated data;

[0032] Through data correlation technology, the abnormal behavior, triggered diagnostic fault codes, and corresponding triggered CAN frames in the integrated data are correlated to obtain correlation data;

[0033] According to the correlation data, the discovered vulnerabilities are analyzed, and the types and frequencies of the triggered diagnostic fault codes are analyzed to obtain the feedback information.

[0034] To achieve the above object, another aspect of the embodiment of the present application provides a CAN bus adaptive fuzzy test system based on a large language model, which comprises:

[0035] a data input module, configured to obtain an initial CAN message seed and a fine-tuning data set;

[0036] a first core processing module, configured to analyze current test context information according to the fine-tuning data set and a large language model, and generate a mutation strategy;

[0037] a second core processing module, configured to generate a mutated CAN frame according to the initial CAN message seed and the mutation strategy;

[0038] an execution module, configured to send the mutated CAN frame to a target CAN bus, generate a test log, and obtain monitoring data of an electronic control unit;

[0039] a result evaluation module, configured to integrate and evaluate the test log and the monitoring data to obtain feedback information;

[0040] The test context information comprises the monitoring data and the feedback information.

[0041] To achieve the above object, another aspect of the embodiment of the present application provides an electronic device, which comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the method described above when executing the computer program.

[0042] To achieve the above object, another aspect of the embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method described above.

[0043] To achieve the above object, another aspect of the embodiment of the present application provides a computer program product or a computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to make the computer device execute the method described above.

[0044] The embodiments of the present application at least have the following beneficial effects: the present application provides a CAN bus adaptive fuzzy test method and system based on a large language model, the scheme obtains an initial CAN message seed and a fine-tuning data set; according to the fine-tuning data set and the large language model, the current test context information is analyzed to generate a mutation strategy; according to the initial CAN message seed and the mutation strategy, a mutated CAN frame is generated; the mutated CAN frame is sent to the target CAN bus to generate a test log and obtain monitoring data of an electronic control unit; the test log and the monitoring data are integrated and evaluated to obtain feedback information, which significantly improves the efficiency and accuracy of discovering vulnerabilities. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0046] Figure 1 is a flowchart of the CAN bus adaptive fuzzy test method based on a large language model provided by the embodiments of the present application;

[0047] Figure 2 is a working flowchart of the data input module provided by the embodiments of the present application;

[0048] Figure 3 is a working flowchart of the core processing module provided by the embodiments of the present application;

[0049] Figure 4 is a working flowchart of the execution module provided by the embodiments of the present application;

[0050] Figure 5 is a working flowchart of the result evaluation module provided by the embodiments of the present application;

[0051] Figure 6 is a structural schematic diagram of the CAN bus adaptive fuzzy test system based on a large language model provided by the embodiments of the present application;

[0052] Figure 7 is a hardware structural schematic diagram of the electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0053] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application, but are only examples of devices and methods consistent with some aspects of the embodiments of the present application as described in the appended claims.

[0054] It should be noted that although the functional modules are divided in the system schematic diagram and the logical sequence is shown in the flowchart, in some cases, the steps shown or described can be performed in a manner different from the module division in the system or the sequence in the flowchart. The terms "first / S100", "second / S200" in the specification and claims and the above drawings can be used herein to describe various concepts, but unless specifically stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information, without departing from the scope of the embodiments of the present application. Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining".

[0055] The terms "at least one", "multiple", "each", "any" and the like used in the present application include one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0057] Before the embodiments of the present application are described in detail, first, some nouns and terms involved in the embodiments of the present application are described, and the nouns and terms involved in the embodiments of the present application are applicable to the following explanations.

[0058] Large language model (LLM) refers to a natural language processing model based on deep learning, which can learn and understand a large amount of text and code data, and has powerful semantic understanding, text generation, code generation, logical reasoning and other capabilities.

[0059] Controller Area Network (CAN) is a serial communication bus protocol standard designed for reliable and efficient communication between microcontrollers and devices in harsh environments, especially within vehicles. CAN protocol defines a standard data frame structure, including key parts such as arbitration field (ID), control field (data length code), data field (usually carrying 0-8 bytes of data, CAN FD supports longer), CRC check field, response field, etc. In addition, CAN protocol has built-in powerful error detection and fault containment mechanisms (such as bit error, stuffing error, CRC check, response error detection, error counter, bus off state, etc.), ensuring high communication reliability. However, it is worth noting that the original design of CAN protocol focuses on real-time and reliability, and does not contain inherent security measures such as identity verification or data encryption. This feature makes the system vulnerable to various network attacks such as message forgery, replay attacks, denial of service, etc. when CAN network can be accessed through physical interfaces (such as OBD-II), gateways or other ways.

[0060] Electronic Control Unit (ECU) refers to various controller modules in vehicles, such as engine controllers, brake controllers, body controllers, etc.

[0061] CAN Database File (DBC) is a standard file format that describes message formats, signal definitions, sending nodes, etc. in a specific CAN network.

[0062] Unified Diagnostic Services (UDS) is a widely used diagnostic communication protocol in the vehicle field (usually based on CAN bus transmission, such as ISO 15765-2).

[0063] Fuzzing is an automated software testing technique that inputs a large amount of malformed, unexpected or random data (in this invention, it is the mutated CAN frame) to the target system, and monitors its abnormal reactions (such as crash, error state, unexpected DTC) to find potential security vulnerabilities or software defects.

[0064] Adaptive mutation refers to the mutation method of test cases (CAN frames) in fuzzing, which is not fixed or purely random, but dynamically adjusts the generation strategy according to real-time feedback information (such as ECU state, coverage, historical crashes) during the test process.

[0065] Diagnostic Trouble Code (DTC) is generated and stored by ECU, used to indicate detected system faults or abnormal states.

[0066] Coverage, a measure of the extent of exploration of the target code, state, or message space during a fuzzing process.

[0067] In modern vehicle networking systems, the CAN (Controller Area Network) protocol serves as the core communication standard, widely used in data exchange between various electronic control units (ECUs) within vehicles, ensuring the coordination and efficient operation of vehicle functions. However, the CAN protocol was not initially designed with sufficient consideration for security, leading to a variety of security risks in the current highly interconnected vehicle networking environment. For example, attackers can inject malicious data packets through the bus, achieving illegal control over critical vehicle functions such as throttle, brake, or steering systems, posing a serious threat to road safety. In addition, the openness of the CAN bus and the shared communication medium make it vulnerable to various network attacks such as replay attacks and denial-of-service attacks. In view of the above risks, existing technologies introduce fuzzing to identify and reduce potential vulnerabilities in the CAN bus protocol. However, traditional fuzzing methods have low test efficiency, limited coverage, and lack of adaptive capabilities when applied to the CAN bus, making it difficult to meet the growing security needs in the vehicle networking environment.

[0068] Therefore, as shown in the Figure 1 The embodiments of the present application provide a CAN bus adaptive fuzzing method based on a large language model, which can include but is not limited to steps S100 to S500:

[0069] Step S100, obtaining an initial CAN message seed and a fine-tuning data set;

[0070] Step S200, analyzing the current test context information according to the fine-tuning data set and the large language model, and generating a mutation strategy;

[0071] Step S300, generating a mutated CAN frame according to the initial CAN message seed and the mutation strategy;

[0072] Step S400, sending the mutated CAN frame to the target CAN bus, generating a test log, and obtaining monitoring data of the electronic control unit;

[0073] Step S500, integrating and evaluating the test log and the monitoring data to obtain feedback information;

[0074] Wherein, the test context information includes the monitoring data and the feedback information.

[0075] In steps S100 to S500 of some embodiments, by collecting and integrating CAN protocol standard documents, CAN database files, electronic control unit (ECU) information, unified diagnostic services (UDS) documents, and historical test data, etc. Multi-source heterogeneous data, fine-tune the large language model (LLM) to enable the LLM to deeply understand the CAN communication context and ECU behavior logic. Compared with the prior art, the embodiments of the present application do not rely on simple random or rule variation, but use the fine-tuned LLM, combined with the ECU running state (such as working mode, DTC fault code, key parameter value) and historical test feedback information (such as coverage, crash information) obtained in real time from the vehicle diagnostic protocol (such as UDS), intelligently and adaptively generate and adjust CAN frame variation strategies (such as adjusting variation parameters, selecting variation types, determining variation target frames), continuously optimize the test process, and significantly improve the efficiency and accuracy of vulnerability discovery. At the same time, the test results are evaluated in multiple dimensions, including code / state / message coverage, the number and severity of discovered vulnerabilities, the type of triggered diagnostic codes, etc., and the effectiveness of the adaptive strategy is evaluated to further guide test optimization. Significantly improve the efficiency and accuracy of discovering deep security vulnerabilities in CAN bus and ECU implementation, enhance test coverage, and significantly reduce manual intervention, achieving a higher degree of automation, thereby improving the safety and reliability of vehicle electronic systems.

[0076] In some embodiments, step S100 can include but is not limited to steps S110 to S130:

[0077] Step S110, collecting CAN database files, CAN protocol standard documents, electronic control unit information, unified diagnostic service documents, and historical test data;

[0078] Step S120, parsing the CAN database file to generate the initial CAN message seed;

[0079] Step S130, preprocessing and format unification processing of the CAN protocol standard document, the electronic control unit information, the unified diagnostic service document, and the historical test data to obtain the fine-tuning data set.

[0080] In step S110 of some embodiments, as Figure 2As shown, collect and organize multi-source heterogeneous data, including CAN database (DBC) files describing specific network topology and message format, CAN protocol standard documents defining the basis of CAN communication (such as CAN2.0A / B, CAN FD), firmware or related code of target electronic control units, vehicle diagnostic protocol (optional UDS, such as ISO 14229) standards and service examples detailing diagnostic interaction processes, CAN bus application cases reflecting actual applications and potential risks, and known attack / vulnerability reports, historical fuzz testing data for learning and comparison, etc.

[0081] In step S120 of some embodiments, as shown, Figure 2 As shown, use DBC parsing tools to parse CAN database files, accurately extract key metadata such as message ID and signal layout, and generate a series of initial CAN message seeds conforming to the specification and representing normal communication based on the key metadata, which can be used when the fuzz testing loop is started.

[0082] In step S130 of some embodiments, as shown, Figure 2 As shown, the collected various unstructured (documents, cases) and semi-structured (code, logs) data are deeply processed, i.e., the CAN protocol standard documents, electronic control unit information, unified diagnostic service documents, and historical test data are preprocessed, including text parsing, key information extraction, rule induction, and structured conversion, and then these heterogeneous information is organized and converted into a unified format, so that it can be used as input data for fine-tuning a large language model. Optionally, the unified format can be in the following form:

[0083] 1) Instruction following samples: present in the form of instructions, let the model learn how to output correct results according to instructions;

[0084] 2) Question and answer pairs: organize data in the form of questions and answers, the model needs to learn how to generate correct answers according to questions;

[0085] 3) Data records that require model completion / classification: provide partial information, let the model complete the missing content or classify the data.

[0086] In some embodiments, step S200 can include but is not limited to steps S210 to S230:

[0087] Step S210, fine-tuning the large language model according to the fine-tuning data set;

[0088] Step S220, fuse the current monitoring data and the historical feedback information to obtain the current test context information;

[0089] Step S230, the current test context information is analyzed by the fine-tuned large language model to obtain the mutation strategy.

[0090] In step S210 of some embodiments, as shown, the large language model is fine-tuned according to the fine-tuning data set, so that the large language model accurately masters the CAN protocol details, ECU message processing logic, UDS diagnostic interaction mode, and common vehicle network security vulnerability features, and finally outputs a large language model deeply optimized for the test task. Figure 3

[0091] In step S220 of some embodiments, as shown, Figure 3 During test running, the current test context information is integrated, including historical feedback information (such as previously triggered crashes, triggered DTCs, coverage progress) and real-time acquired electronic control unit current monitoring data (such as working mode, specific sensor readings, error flags, etc.).

[0092] In step S230 of some embodiments, as shown, Figure 3 The current test context information is presented to the fine-tuned large language model, and the large language model analyzes the current test context information by virtue of its strong understanding and reasoning ability, and generates specific and highly targeted mutation strategies or instructions. Optionally, these strategies can be refined to preferred attack CAN IDs, signals, mutation techniques to be used (bit flipping, field randomization, sequence recombination, rule-based modification, etc.), and even specific parameter ranges or values.

[0093] In some embodiments, step S300 can include but is not limited to steps S310 to S320:

[0094] Step S310, selecting a basic CAN frame according to the initial CAN message seed;

[0095] Step S320, applying the mutation strategy to the basic CAN frame to generate the mutated CAN frame.

[0096] In steps S310 to S320 of some embodiments, as shown, Figure 3 According to the instructions of the large language model, a basic CAN frame is selected from the initial CAN message seed or valuable variants found in historical tests, and a specified mutation strategy is applied to the basic CAN frame to generate a new mutated CAN frame designed to efficiently explore potential vulnerabilities.

[0097] In some embodiments, step S400 can include but is not limited to steps S410 to S420:

[0098] ​Step S410, sending the mutated CAN frame to the target CAN bus, recording all the sent mutated CAN frames and corresponding sending time stamps, and generating the test log;

[0099] Step S420, establishing communication with the electronic control unit through a diagnostic protocol and monitoring the electronic control unit to obtain the monitoring data.

[0100] In step S410 of some embodiments, as shown in Figure 4 The physical connection and communication with the bus are realized through standard CAN interface hardware (such as Vector, PCAN, etc.) and its supporting driver and software library (such as python-can), ensuring that each mutated CAN frame is accurately injected into the target CAN bus according to the CAN protocol specification. At the same time, the sent CAN frames and their sending time stamps are recorded to generate a test log, which can also include monitoring of the basic health status of the bus (such as detecting and reporting the bus off state), providing a basis for subsequent data correlation analysis of result evaluation.

[0101] In step S420 of some embodiments, the vehicle diagnostic protocol (optional UDS) is used to continuously and periodically communicate with the target electronic control unit to obtain the deep running status of the electronic control unit, i.e., the monitoring data of the electronic control unit.

[0102] In some embodiments, step S420 can include but is not limited to steps S421 to S423:

[0103] Step S421, sending a unified diagnostic service request to the electronic control unit;

[0104] Step S422, receiving the response frame returned by the electronic control unit;

[0105] Step S423, parsing the response frame to obtain the monitoring data.

[0106] In steps S421 to S423 of some embodiments, as shown in Figure 4As shown, a valid diagnostic session is first established and maintained by sending a specific UDS service request (such as 0x10 Diagnostic Session Control). (This may require periodically sending 0x3ETester Present to maintain the connection). Then, a series of predefined diagnostic requests are periodically sent to the ECU, such as reading stored diagnostic fault codes (DTCs, using service 0x19), reading specific data identifiers (DIDs, using service 0x22 to obtain sensor values, operating modes, internal variables, etc.), and even performing an ECU reset when necessary (service 0x11). Next, the response frames returned by the ECU are received and parsed strictly according to the UDS protocol specification to extract structured, real-time ECU status information.

[0107] In some embodiments, step S500 may include, but is not limited to, steps S510 to S530:

[0108] Step S510: Integrate the test logs and the monitoring data to obtain integrated data;

[0109] Step S520: Using data association technology, the abnormal behavior, triggered diagnostic fault codes, and corresponding triggered CAN frames in the integrated data are associated to obtain associated data.

[0110] Step S530: Analyze the discovered vulnerability based on the associated data, and analyze the type and frequency of the triggered diagnostic fault codes to obtain the feedback information.

[0111] In some embodiments, steps S510 to S520, such as Figure 5 As shown, the system receives and integrates test logs and monitoring data from the electronic control unit. Through data association technology, it performs correlation analysis on abnormal behaviors in the integrated data with related diagnostic fault codes and the triggering CAN frames that trigger these diagnostic fault codes, thereby tracing the root cause of the abnormal behavior to the specific triggering CAN frame or sequence.

[0112] In step S530 of some embodiments, such as Figure 5As shown, the vulnerability is analyzed, potential security vulnerabilities such as system crashes and hangs are identified and recorded, the number of vulnerabilities is counted, a preliminary severity classification is made, and the types and frequencies of triggered diagnostic fault codes are analyzed. In addition, the effectiveness of the adaptive strategy can be evaluated by comparing the changes in vulnerability discovery efficiency and coverage rate growth before and after the variation strategy adjustment, evaluating the benefits of intelligent adjustment of the variation strategy, and outputting a strategy evaluation report. Then, feedback information is generated by summarizing and analyzing, and is returned to the step of generating the variation strategy, providing a basis for adjusting the next round of variation strategy, realizing continuous learning and self-optimization. Optionally, coverage rate can also be calculated based on associated data, which can include message coverage rate, state coverage rate based on UDS monitoring, and code coverage rate, but is not limited to this, and a coverage rate report is output to reflect the breadth and depth of testing. The feedback information, strategy evaluation report and coverage rate report output can be integrated to obtain an evaluation result.

[0113] The embodiment of the application also provides a CAN bus adaptive fuzzy test system based on a large language model, which can implement the above method, and the system comprises:

[0114] A data input module acquires an initial CAN message seed and a fine-tuning data set;

[0115] A first core processing module analyzes the current test context information according to the fine-tuning data set and a large language model, and generates a variation strategy;

[0116] A second core processing module generates a variation CAN frame according to the initial CAN message seed and the variation strategy;

[0117] An execution module sends the variation CAN frame to a target CAN bus, generates a test log, and acquires monitoring data of an electronic control unit;

[0118] A result evaluation module integrates and evaluates the test log and the monitoring data to obtain feedback information;

[0119] The test context information comprises the monitoring data and the feedback information.

[0120] Reference Figure 6 The CAN bus adaptive fuzzy test system based on a large language model comprises a data input module, a first core processing module, a second core processing module, an execution module and a result evaluation module. The modules work together to realize an intelligent and adaptive CAN bus safety test process. Exemplarily, the following collaborative working process is provided:

[0121] 1、Data input module is used to collect, systematize and pre-process all original information resources for driving the fine-tuning of large language model and starting the fuzzy test process.

[0122] 2、The first core processing module includes a monitoring feedback submodule, an LLM fine-tuning submodule, and an adaptive mutation generation submodule.

[0123] 2.1、The monitoring feedback submodule serves as an information hub, receiving raw data streams from the execution module (mainly UDS monitoring results) and the result evaluation module (coverage, vulnerability analysis, etc.), parsing, processing and integrating them into structured, LLM-easy-to-understand current test context information.

[0124] 2.2、The LLM fine-tuning submodule is used to fine-tune the LLM with professional data sets provided by the data input module to deeply understand CAN communication, ECU behavior and diagnostic protocols.

[0125] 2.3、During test running, the adaptive mutation generation submodule is used to receive the current test context information integrated by the monitoring feedback submodule, use the fine-tuned LLM for intelligent analysis and decision screening, and based on the understanding of the current test context, the LLM dynamically and adaptively generates and adjusts the mutation strategy of CAN frames.

[0126] 3、The second core processing module is used to guide the generation of specific mutation CAN frames that are highly targeted and designed to efficiently trigger vulnerabilities based on the generated mutation strategy, and send them to the execution module for execution, thereby driving the entire adaptive fuzzy test process.

[0127] 4、The execution module includes a fuzzy test execution engine and a diagnostic session reading and monitoring component.

[0128] 4.1、The fuzzy test execution engine is used to accurately and correctly send the mutation CAN frames generated by the second core processing module to the target CAN bus. At the same time, the fuzzy test execution engine is also used to record all sent CAN frames and their sending timestamps, providing basis for subsequent data correlation analysis of the result evaluation layer, and possibly containing monitoring of the basic health status of the bus.

[0129] 4.2、The diagnostic session reading and monitoring component is used to continuously and periodically interact with the target ECU using the vehicle diagnostic protocol to obtain the deep running state inside the ECU. This component receives and strictly parses the response frames returned by the ECU according to the UDS protocol specification, extracts structured and real-time ECU state information from them, and then passes these original diagnostic data to the monitoring feedback submodule of the first core processing layer, forming a key link of the feedback loop.

[0130] 5、The result evaluation module is used for integrating the logs and monitoring data (including crashes, DTC triggers, error states, etc.) of the execution module, tracing the observed abnormal behavior to specific trigger CAN frames or sequences through data association techniques. Secondly, the message, state, and code coverage is calculated and tracked in multiple dimensions to reflect the test breadth and depth. Thirdly, the vulnerabilities and abnormalities are evaluated, potential security vulnerabilities such as system crashes and hangs are identified and recorded, the number is counted, a preliminary severity classification is performed, and the DTC type and frequency triggered are analyzed. The result evaluation module is also used for evaluating the effectiveness of the adaptive strategy by comparing the changes in vulnerability discovery efficiency, coverage growth, etc. before and after the strategy adjustment, evaluating the benefits of intelligent adjustment. Finally, the result evaluation module summarizes the analysis results to generate a test report, and arranges the key insights (such as coverage blind spots, efficient variation patterns, specific DTC groups, strategy effectiveness ratings, etc.) most valuable for optimization into structured feedback information, which is returned to the first core processing module to provide a basis for the next round of strategy adjustment, realizing continuous learning and self-optimization.

[0131] It can be understood that the contents in the above method embodiments are all applicable to the present system embodiment, the present system embodiment specifically implements the functions same as those of the above method embodiments, and achieves the same beneficial effects as those of the above method embodiments.

[0132] The embodiment of the present application further provides an electronic device, which comprises a processor and a memory, the memory stores a computer program, and the processor realizes the method described above when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0133] It can be understood that the contents in the above method embodiments are all applicable to the present device embodiment, the present device embodiment specifically implements the functions same as those of the above method embodiments, and achieves the same beneficial effects as those of the above method embodiments.

[0134] Reference Figure 7 , Figure 7 The hardware structure of the electronic device of another embodiment is illustrated, and the electronic device comprises:

[0135] The processor 601 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., and is used to execute related programs to realize the technical solutions provided by the embodiments of the present application.

[0136] The memory 602 can be implemented in the form of read only memory (ROM), static storage device, dynamic storage device or random access memory (RAM), etc. The memory 602 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 602 and are called and executed by the processor 601 to execute the method of the embodiments of the present application;

[0137] The input / output interface 603 is used to realize information input and output;

[0138] The communication interface 604 is used to realize the communication interaction between the device and other devices, which can realize communication through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0139] The bus 605 transmits information between various components (such as the processor 601, the memory 602, the input / output interface 603 and the communication interface 604) of the device;

[0140] The processor 601, the memory 602, the input / output interface 603 and the communication interface 604 are connected with each other through the bus 605 for internal communication connection in the device.

[0141] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the above method.

[0142] It can be understood that the contents in the above method embodiments are all applicable to the present storage medium embodiment, the function specifically realized by the present storage medium embodiment is the same as that of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0143] The embodiment of the present application also provides a computer program product or computer program, which includes computer instructions stored in a computer readable storage medium. The processor of the computer device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to make the computer device execute the above method.

[0144] In summary, the CAN bus adaptive fuzzy test method and system based on a large language model according to the embodiments of the present application have the following advantages:

[0145] 1. Intelligent optimization mode testing, improving testing efficiency: Using large language models to deeply learn CAN protocols, understand ECU communication logic and vulnerability patterns. Combined with historical test data and real-time ECU state information, dynamically optimize fuzzy test data generation strategy, reduce redundant testing, and improve vulnerability discovery speed. Through intelligent screening, avoid invalid fuzzy test data, improve the utilization rate of test resources.

[0146] 2. Fuzzy test mutation based on real-time feedback enhances vulnerability triggering ability: Real-time access to ECU running status and diagnostic fault codes (DTC) through ECU diagnostic protocols (such as UDS). Combined with LLM analysis of the current ECU state, generate high-targeted fuzzy mutation data to improve vulnerability discovery rate. Use adaptive fuzzy mutation method to make fuzzy testing explore deeper security vulnerabilities.

[0147] 3. Real-time ECU state monitoring enhances the pertinence of fuzzy testing: Integrate UDS protocol, real-time monitor ECU state during fuzzy testing, including diagnostic session, DTC state, sensor data, etc. Combined with real-time feedback of ECU, optimize fuzzy test data to make testing more accurate and avoid invalid testing. For example, when detecting that the ECU enters a specific error state, LLM can automatically generate fuzzy test data to escape from this state to further verify the possibility of vulnerability exploitation.

[0148] 4. Highly automated fuzzy testing, reducing human intervention: Use adaptive feedback mechanism to automatically analyze Fuzz test results and optimize the next round of testing based on LLM; Fuzzy test data generation, mutation, execution and result analysis are all automated, greatly reducing the need for manual adjustment; Through intelligent Fuzz test management system, effective attack vectors can be automatically screened, reducing the cost of manual screening.

[0149] In some alternative embodiments, the functions / operations mentioned in the block diagrams can not occur in the order mentioned in the operation diagram. For example, depending on the functions / operations involved, two blocks shown in succession can actually be executed substantially simultaneously or the blocks can sometimes be executed in reverse order. In addition, the embodiments presented and described in the flowcharts of the present invention are provided by way of example, with the purpose of providing a more comprehensive understanding of the technology. The disclosed method is not limited to the operations and logical flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and in which sub-operations described as part of larger operations are independently executed.

[0150] Furthermore, although the present application is described in the context of functional modules, it is to be understood that one or more of the described functions and / or features can be integrated in a single physical device and / or software module, or one or more functions and / or features can be implemented in separate physical devices or software modules. It will also be appreciated that detailed discussion of the actual implementation of each module is not necessary to an understanding of the application. Rather, the actual implementation of the modules, in combination with their attributes, functions, and internal relationships, are to be understood within the context of the system disclosed herein. Thus, those skilled in the art with access to patents, scientific journals, and other public sources known by those skilled in the art, using ordinary skill can practice the application as set forth in the claims without undue experimentation. It is also to be understood that the specific concepts disclosed are merely illustrative and that the scope of the present application is to be determined by the entire scope of the claims, along with all equivalents of the claims, and that the claims are to be accorded their broadest interpretation under the patent statutes.

[0151] If the functions are implemented in software, the functions can be stored in or implemented as one or more computer program products, which can be incorporated into a computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor- containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. In the context of this document, a "computer-readable medium" can be any means that can store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium.

[0152] The logic and / or steps represented in the flowcharts and / or otherwise described herein, for example, can be embodied in non-transitory computer-readable media, which can be executed by an instruction execution system, apparatus, or device such as a computer-based system, processor- containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. In the context of this document, a "computer-readable medium" can be any means that can store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium.

[0153] More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can also be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example, via optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.

[0154] It should be understood that aspects of the application can be implemented in hardware, software, firmware or combinations thereof. In the embodiments described above, various steps or methods can be implemented, for example, by software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and in another embodiment, any of the following techniques can be used to implement the hardware used in the described embodiments: discrete logic circuitry having logic gates for implementing logic functions upon data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and so forth.

[0155] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means that the specific feature, structure, material or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the application. In the specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific feature, structure, material or characteristic described can be combined in any appropriate manner in one or more embodiments or examples.

[0156] Although embodiments of the application have been shown and described, it would be recognized by those of ordinary skill in the art that various changes, modifications, substitutions, and alterations can be made hereto without departing from the spirit and scope of the application, which is defined by the following claims and their equivalents.

[0157] The above is a specific description of the preferred embodiments of the present application, but the present application is not limited to the described embodiments, and those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present application, and these equivalent modifications or replacements are all included in the scope defined by the claims of the present application.

Claims

1. An adaptive fuzzy testing method for CAN bus based on a large language model, characterized in that, Includes the following steps: Obtain the initial CAN message seed and fine-tuning dataset; Based on the fine-tuned dataset and the large language model, the current test context information is analyzed to generate a mutation strategy; Generate a mutated CAN frame based on the initial CAN message seed and the mutation strategy; The mutated CAN frame is sent to the target CAN bus to generate a test log and obtain monitoring data from the electronic control unit. The test logs and monitoring data are integrated and evaluated to obtain feedback information. The test context information includes the monitoring data and the feedback information.

2. The method according to claim 1, characterized in that, The process of obtaining the initial CAN message seed and the fine-tuning dataset includes the following steps: Collect CAN database files, CAN protocol standard documents, electronic control unit information, unified diagnostic service documents, and historical test data; The CAN database file is parsed to generate the initial CAN message seed; The CAN protocol standard document, the electronic control unit information, the unified diagnostic service document, and the historical test data are preprocessed and format-unified to obtain the fine-tuning dataset.

3. The method according to claim 1, characterized in that, The step of analyzing the current test context information and generating a mutation strategy based on the fine-tuned dataset and the large language model includes the following steps: The large language model is fine-tuned based on the fine-tuning dataset; By integrating the current monitoring data and the historical feedback information, the current test context information is obtained; The mutation strategy is obtained by analyzing the current test context information through the fine-tuned large language model.

4. The method according to claim 1, characterized in that, The step of generating a mutated CAN frame based on the initial CAN message seed and the mutation strategy includes the following steps: Select the base CAN frame based on the initial CAN message seed; The mutation strategy is applied to the base CAN frame to generate the mutated CAN frame.

5. The method according to claim 1, characterized in that, The process of sending the mutated CAN frame to the target CAN bus, generating a test log, and acquiring monitoring data from the electronic control unit includes the following steps: The mutated CAN frame is sent to the target CAN bus, and all the mutated CAN frames sent and their corresponding sending timestamps are recorded to generate the test log. Communication with the electronic control unit is established through a diagnostic protocol, and the electronic control unit is monitored to obtain the monitoring data.

6. The method according to claim 5, characterized in that, The process of establishing communication with the electronic control unit (ECU) through a diagnostic protocol and monitoring the ECU to obtain the monitoring data includes the following steps: Send a unified diagnostic service request to the electronic control unit; Receive the response frame returned by the electronic control unit; The response frame is parsed to obtain the monitoring data.

7. The method according to claim 1, characterized in that, The process of integrating and evaluating the test logs and monitoring data to obtain feedback information includes the following steps: The test logs and monitoring data are integrated to obtain integrated data; By using data association technology, abnormal behaviors, triggered diagnostic fault codes, and corresponding triggered CAN frames in the integrated data are associated to obtain associated data; Based on the associated data, the discovered vulnerabilities are analyzed, and the types and frequencies of the triggered diagnostic fault codes are analyzed to obtain the feedback information.

8. An adaptive fuzzy testing system for CAN bus based on a large language model, characterized in that, include: The data input module acquires the initial CAN message seed and the fine-tuning dataset; The first core processing module analyzes the current test context information based on the fine-tuning dataset and the large language model, and generates a mutation strategy. The second core processing module generates mutated CAN frames based on the initial CAN message seed and the mutation strategy. The execution module sends the mutated CAN frame to the target CAN bus, generates a test log, and acquires monitoring data from the electronic control unit. The results evaluation module integrates and evaluates the test logs and monitoring data to obtain feedback information. The test context information includes the monitoring data and the feedback information.

9. An electronic device, characterized in that, Including the processor and memory; The memory is used to store programs; The processor executes the program to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a program that is executed by a processor to implement the method as described in any one of claims 1 to 7.

Images