Vehicle security technology detection method and system based on shielding tent

Abstract

The invention belongs to the technical field of security and secrecy, and particularly relates to a vehicle secrecy technology detection method and system based on a shielding tent. Constructing a signal isolation environment in the electromagnetic shielding tent; establishing a noise baseline model through spectral analysis; wireless terminal equipment detection is carried out through an all-standard terminal analyzer; a non-linear node detector, an infrared thermal imager, a near-field signal detector, a back scattering type X-ray machine and an endoscope are used for cooperatively scanning in different regions; and by combining algorithms such as big data and machine learning, positioning an overproof signal source, and if a suspicious device is found, disposing according to rules and obtaining evidence. According to the method, the problems of low standardization degree, high equipment false alarm rate, low implementation efficiency and low detection comprehensiveness when the vehicle is subjected to confidentiality technology detection in an open environment are solved. The method is suitable for eavesdropping, stealing and positioning device detection of secret-related vehicles.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of security and privacy technology, and particularly relates to a vehicle privacy technology detection method and system based on a shielding tent. BACKGROUND

[0002] With the improvement of the electronic and intelligent degree of vehicles, a large number of communication modules (such as 4G / 5G, Beidou / GPS, Bluetooth, and WiFi) and storage units are integrated into vehicle-mounted systems. While these modules realize the intelligent functions of vehicles, they also bring the risks of information leakage and electromagnetic interference. For example, sensitive information may be leaked through electromagnetic radiation during the operation of a vehicle, or problems such as communication interruption and data tampering may occur when the vehicle is subjected to external electromagnetic interference, which seriously threatens the information security and operation safety of the vehicle. Therefore, it is necessary to detect the security and privacy of vehicles, and to detect and find: 1) security and privacy vulnerabilities and leakage risks of the vehicle being tested; 2) technical spying devices that may be installed on the vehicle being tested to steal sound, image, positioning, and other data; and 3) behaviors and means of spying using various facilities and equipment in the vehicle being tested.

[0003] The existing vehicle privacy technology detection mainly adopts the following two ways: one is to use a portable detection device for detection in an open environment, which is prone to external electromagnetic interference, resulting in a high false positive rate of signal scanning devices and low accuracy of detection results; and the other is to detect in a fixed electromagnetic shielding room, but the signal emission behavior of suspicious devices is easy to be triggered and hidden externally, and there is no fusion of multiple technical means for the physical and electromagnetic characteristics of the spying device, resulting in a high rate of missed detection. SUMMARY

[0004] The application provides a vehicle privacy technology detection method and system based on a shielding tent, which is used to solve the technical problems that the existing technology cannot eliminate the influence of environmental electromagnetic interference on vehicle privacy technology detection and wireless terminal device detection, and that the multi-level detection task has a contradiction between the differentiated requirements for delay and the limited hardware resources, and cannot realize model optimization.

[0005] In order to achieve the above-mentioned purpose, the technical scheme adopted by the application is as follows: a vehicle privacy technology detection method based on an electromagnetic shielding tent, comprising the following steps: S1. Constructing a signal isolation environment: building an electromagnetic shielding tent at the detection site, and driving the vehicle to be tested into the tent and closing the tent door curtain; S2. Electromagnetic baseline calibration: using a spectrum analyzer to collect the background noise spectrum of the vehicle in the off / on state, and establishing a frequency spectrum baseline threshold model; S3. Wireless terminal device monitoring: starting a full-specification terminal analyzer, capturing the radio frequency communication signals within the vehicle range in the shielding environment, identifying and preliminarily positioning suspicious wireless terminal signals; S4. While the all-mode terminal analyzer is running, multi-modal collaborative detection and verification is carried out; S4.1 Multi-modal collaborative detection and verification: The temperature distribution of the whole vehicle is monitored by an infrared thermal imager; A nonlinear node detector is used to scan the vehicle area at a speed of ≤0.1 m / s; An endoscope is used to physically detect the parts of the whole vehicle that are difficult to directly observe; A backscatter X-ray machine is used to physically detect the doors and body of the vehicle through perspective; A near-field signal detector is used to perform fine field strength gradient scanning on the whole vehicle; S4.2 Compare the frequency spectrum baseline threshold model established in step S2 with the abnormal signals / hotspots / nodes found in steps S3 and S4.1 that have signal strengths exceeding -60 dBm or do not conform to normal characteristics, and mark them; S5. Suspicious device verification, positioning, and disposal: cross-verify the abnormal signals / hotspots / nodes marked in step S4.1 with the positioning results of the near-field signal detector, X-ray perspective images, endoscope video observation results, thermal imaging images, and semiconductor scanning results, determine the location of the suspicious device, and then implement physical disassembly or further X-ray perspective imaging inspection and evidence collection; S6. Detection conclusion: draw a detection conclusion based on the above detection process.

[0006] Further, the electromagnetic shielding tent in step S1 has a shielding effectiveness ≥75 @ 10 MHz-20 GHz (dB).

[0007] Further, the construction of the frequency spectrum baseline threshold model in step S2 includes: a) In the vehicle off state, perform full-band scanning on the 0.1-8 GHz frequency band, record the environmental background noise amplitude-frequency characteristics, and use them as baseline noise reference; b) In the vehicle start state, identify and record the inherent and stable electromagnetic radiation characteristics of the vehicle electronic system to form a characteristic frequency spectrum fingerprint library; c) Combine the baseline noise reference and the characteristic frequency spectrum fingerprint library to set a dynamic alarm threshold, and alarm abnormal spectrum components that exceed the baseline noise level or do not belong to the characteristic fingerprint library.

[0008] Further, the wireless terminal device monitoring preliminary screening in step S3 includes: turning on the all-mode terminal analyzer, transmitting a fundamental signal, trapping and analyzing the IMSI / identification information of the wireless terminal inside the shielding tent that responds to this signal, and displaying the classified information on the device interface in real time. For the signals identified as risk categories, mark them as "verification target".

[0009] Further, the method in step S4.1 includes: the near-field signal detector is used for spatial field strength gradient scanning on the suspicious signal area preliminarily positioned in step S3, realizing directional accurate positioning, and attention is paid to activating the terminal by the terminal detection analyzer in step S3, so that continuous tracking on the suspicious signal is realized; and the method in step S4.2 includes abnormal comparison and marking: the detection results of step S3 and step S4.1 are cross-compared with the spectrum baseline threshold model established in step S2 in real time or in a post-processing stage.

[0010] Further, a real-time processing layer, a medium-speed processing layer and an asynchronous analysis layer are further included, the real-time processing layer is deployed on an edge computing node in the electromagnetic shielding tent and is configured to perform the following in ≤10 ms delay: a. extracting electromagnetic signal features in the form of wavelet transform and frequency domain energy integration; b. key frame capture of thermal imaging video stream based on dynamic sampling of motion vectors; The medium-speed processing layer is deployed on a detection industrial computer and is configured to perform the following in ≤2 minutes delay: c. physical anomaly correlation analysis, using an Apriori algorithm to mine the space-time rules related to electromagnetic signal layer anomalies and physical layer anomalies; d. generating multi-device cooperative control instructions to trigger threshold calculation; The asynchronous analysis layer is deployed on a central server and is configured to perform the following in ≤5 minutes delay: e. history vehicle condition database matching based on improved cosine similarity-based anomaly pattern retrieval; f. adjusting feature split threshold according to false alarm feedback and dynamically updating random forest classifier node weights.

[0011] Further, the real-time processing layer is directly connected to a metal feed point of the electromagnetic shielding tent through a PCIe x4 interface, and the transmission impedance matching is 50 Ω±5%; the edge computing node uses FPGA to realize parallel computation of wavelet transform, and the processing bandwidth is 0.1-8 GHz, and the sampling rate is ≥1 GS / s.

[0012] Further, the dynamic update of the asynchronous analysis layer includes: according to historical false alarm cases, reducing the feature weight of a non-shielded environment, and the weight reduction ratio is ΔW=0.2x false alarm rate; when the number of newly added eavesdropping device samples is greater than 100, starting incremental training of the classifier based on an online gradient descent algorithm.

[0013] The system comprises an electromagnetic shielding tent and a full-mode terminal analyzer, wherein the electromagnetic shielding tent is provided with a signal coupling enhancement layer on the side wall, the shielding effectiveness is greater than or equal to 75 dB (10 MHz-20 GHz), and the electromagnetic shielding tent comprises a seven-layer composite structure and a detachable curtain; the full-mode terminal analyzer is provided with a resonant circuit matched with the signal coupling enhancement layer, supports 2G / 4G / 5G / WiFi / GPS multi-band signal scanning and SIM card type identification, and can perform sub-meter positioning, and comprises a multi-band scanning module and a signal trapping unit.

[0014] Further, the seven-layer composite structure is a double-sided symmetric plating layer structure, each side comprises, from the outside to the inside, a substrate, a first plating layer, a second plating layer and a third plating layer, and the other side has the same plating layer sequence and shares the substrate; the detachable curtain is provided with an electromagnetic sealing strip at the edge, and the shielding effectiveness is greater than or equal to 70 dB in the closed state.

[0015] Compared with the prior art, the present application has the following advantages: (1) The present application establishes a dynamic spectrum baseline threshold model containing environmental background noise and vehicle inherent electromagnetic characteristic fingerprint in vehicle security detection, which not only sets an amplitude threshold (-60 dBm), but also identifies "new spectrum components" and "characteristic fingerprint abnormal fluctuations", significantly improves the detection capability of disguised or low-power eavesdropping devices, and greatly reduces false positives caused by vehicle signals or environmental residual noise.

[0016] (2) The present application uses a multi-device multi-modal hierarchical collaborative verification mechanism to close the interference source for precision measurement after preliminary screening, and compares the detection results with the baseline model to solve the problems of low efficiency and conflicting results caused by simple stacking and independent work of multiple devices, especially to improve the positioning accuracy and verification reliability of intelligent concealed devices in complex vehicle structures.

[0017] (3) The present application reduces the technical threshold and experience threshold of vehicle security detection, improves the detection efficiency of vehicle security technology detection, combines the electromagnetic shielding tent with the full-mode terminal analyzer, and compared with the fixed shielding room, the electromagnetic shielding tent is convenient to deploy in various sites, combined with the above standardized process, greatly reduces the threshold and cost of implementing professional vehicle security technology detection, while ensuring the standardization and efficiency of detection.

[0018] (4) The present application uses a three-level processing architecture to clearly divide the system delay boundary. By using a PCIe x4 interface for direct connection, the high-frequency signal fidelity is improved (reflection loss <0.5 dB@5GHz); using an algorithm based on big data to reduce manual intervention and improve the accuracy and efficiency of detection; the incremental learning mechanism continuously reduces the false positive rate of the system. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 This is a flowchart of the detection method of the present invention; Figure 2 This is a flowchart illustrating the detection process for vehicle security technology within a shielded environment according to the present invention. Figure 3 This is a timing diagram of the multi-device collaborative detection logic of the present invention; Figure 4 This is a flowchart illustrating the implementation of wireless terminal detection in a shielded environment according to the present invention. Figure 5 This is a diagram of the layered processing architecture of the present invention. Detailed Implementation

[0020] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0021] Example 1 like Figures 1-3 As shown, a vehicle security technology detection method based on an electromagnetic shielding tent includes the following steps: S1. Constructing a Signal Isolation Environment: Erect an electromagnetic shielding tent in a flat, suitable testing area free from strong electromagnetic interference sources. The tent should be at least 8m × 4m × 3.5m in size and should achieve a shielding effectiveness of ≥75dB@10MHz-20GHz, with a grounding resistance ≤4Ω. After the vehicle enters, close the tent flap to create a closed testing environment.

[0022] S2. Electromagnetic baseline calibration: Performed using a wideband spectrum analyzer, frequency range 0.1-8GHz.

[0023] a) Background scan in engine-off state: The vehicle is turned off, and all external devices that may cause interference are shut down (including detection devices, leaving only the spectrum analyzer working); the spectrum analyzer (frequency range: 0.1-8GHz, resolution bandwidth RBW≤10kHz) is used to perform a slow full-band scan of the environment inside the shielded tent (scanning speed ≤100ms / point), and at least 3 stable spectra are collected, and the average is recorded as the environmental background noise reference spectrum.

[0024] b) Startup State Feature Extraction: From vehicle startup to idle, the spectrum analyzer performs repeated scans; it focuses on identifying and recording stable, repeatable narrowband or broadband radiation characteristics (such as specific frequency clock harmonics, ignition pulse characteristics, and CAN bus communication characteristics) generated by the engine ignition system, ECU, and in-vehicle entertainment system, forming a vehicle system feature spectrum fingerprint database. Its center frequency, bandwidth, and typical amplitude range are recorded.

[0025] c) Building baseline threshold model: integrating environmental background noise reference spectrum and vehicle system characteristic spectrum fingerprint library, setting dynamic alarm threshold as -60dBm. This model is mainly used for: i) distinguishing environmental noise from effective signal; ii) identifying newly added or abnormal spectrum components (even if its amplitude is lower than -60dBm, if it is a newly added feature, it will also be alarmed); iii) alarming abnormal amplitude fluctuations (such as exceeding ±3dB) of known vehicle characteristic spectrum.

[0026] S3. Wireless terminal device monitoring: turn on the full-mode terminal analyzer to capture the radio frequency communication signals within the vehicle range in the shielding environment, identify and preliminarily locate suspicious wireless terminal signals; The full-mode terminal analyzer supports 5G NSA / SA, 4G TDD / FDD). The device transmits specific mode fundamental signals (such as analog base station signals) to trap and analyze the IMSI / identification information of wireless terminals (mobile phones, GPS, WiFi / Bluetooth modules) responding to these signals within the shielding tent. The device interface displays in real time (operator SIM card, Internet of Things card, overseas card, unknown signal). For the identified 'unknown signals' or signals of specific risk categories (such as overseas Internet of Things cards), the device can provide preliminary field strength indication and approximate direction, marked as 'to be verified target'.

[0027] S4. While the full-mode terminal analyzer is running, multi-modal collaborative detection and verification is carried out; S4.1 Multi-modal collaborative detection: Firstly, the infrared thermal imager (resolution ≥640*480): scan the whole vehicle outer surface (engine compartment cover, doors, tire vicinity), interior panels, and electronic device concentration area (center console, trunk power supply), and mark the 'hot spots' (ΔT≥5℃) that are significantly higher in temperature than the environment or adjacent areas.

[0028] Secondly, nonlinear node detector: implement semiconductor detection on the interior of the whole vehicle, seats, trunk, etc. to detect whether there are abnormal semiconductor devices in the above structures.

[0029] Thirdly, endoscope for endoscopic exploration and video recording of difficult-to-observe parts (behind the instrument panel, under the seat gap, ceiling interior gap, trunk recess).

[0030] Fourthly, hand-held backscatter X-ray machine (tube voltage 90kV, dose ≤2μSv) for perspective imaging of key parts of the vehicle (doors, seat skeleton, roof lining, front and rear bumpers, chassis key nodes) to detect whether there are abnormal foreign objects, cables, circuit boards between metal layers or inside the structure.

[0031] Finally, near-field signal detector: fine field strength gradient scanning (step speed ≤ 0.1 m / s) is performed on the whole vehicle. Before this process, please turn off or move away from devices that may interfere (such as full-mode analyzers) to avoid signal interference. Detect whether there are suspicious signal transmission signs on the whole vehicle.

[0032] S4.2 Compare the spectrum baseline threshold model established in step S2 with the signal intensity found in steps S3, S4.1, S4.1, and mark abnormal signals / hotspots / nodes that exceed -60 dBm or do not conform to normal characteristics; Compare the detection results of steps 3 and 4.1 with the spectrum baseline threshold model established in step 2 in real time or post-processing stage: If a signal is detected at the location found in steps 3 / 4.1, and the signal belongs to the "new / abnormal spectrum component" defined in step 2 or the amplitude exceeds -60 dBm, it is marked as a "high confidence abnormal target".

[0033] If a signal is detected at the location found in steps 3 / 4.1, but the signal belongs to the vehicle system characteristic fingerprint and the amplitude is normal, it is excluded.

[0034] Abnormal hotspots, X-ray abnormal structures, and video suspicious objects found in step 4.1, whether accompanied by signal abnormalities or not, need to be manually reviewed and judged in combination with location and nature. If it cannot be reasonably explained (not a vehicle original design or normal functional component), it is also marked as a "to-be-verified target".

[0035] S5. Verification, positioning, and disposal of suspicious devices: cross-verify the abnormal targets marked in step S4.1 with the positioning results of the near-field signal detector, X-ray perspective images, endoscopic video observation results, thermal imaging images, and semiconductor scanning results. After determining the location of the suspicious device, implement physical disassembly or further X-ray perspective imaging inspection and evidence collection; Based on the new marked results, the "high confidence abnormal target" and "to-be-verified target" marked in step 4.1: Prioritize the "high confidence abnormal target" location and cross-verify it with the positioning results of the near-field signal detector, X-ray perspective images (if applicable), and endoscopic video observation recordings to determine the final physical location; Perform detailed inspection (visual, tactile) on the target location. If necessary, use a backscatter X-ray machine to perform perspective imaging from multiple angles to confirm the internal structure; After confirming the existence of suspicious devices, physically disassemble them according to safety specifications or preserve evidence (photographs, videos, and records of characteristics), and record them. When the vehicle enters the shielding tent environment, close the door curtain with detection personnel on both the inside and outside, coordinate with each other, and ensure that the magic tape is tightly attached to ensure effective electromagnetic shielding.

[0036] The wireless terminal device monitoring is specifically: the full-mode terminal analyzer is turned on, the signal in the shielding environment is detected, and after the preset program is judged and recognized, the measured signal is classified and displayed to the device screen, in turn, the signals of each major operator, 2 / 4 / 5G Internet of Things card, overseas card, unknown, etc. Click to activate suspicious signals to start positioning; for example, the online signal of the device is an unknown target label, and instant voice broadcast reminds the detection personnel that the signal has been online and needs to be handled as soon as possible. After the detection personnel click to activate the positioning button label, the device displays the field strength value feedback graph, and then the mobile device is used for positioning and searching. In addition, when the signal positioning is unclear or cannot be accurately positioned, the near-field signal detector can be used with the positioning antenna to scan the specific position of the electromagnetic signal to achieve accurate positioning.

[0037] Regarding the placement position of the full-mode terminal analyzer, attention should be paid to: When the detection starts, the full-mode terminal analyzer is placed in the vehicle near the geometric center; During the detection, the full-mode terminal analyzer or other devices may interfere with each other. When multiple devices are operated together, they should be closed or placed far away according to the actual situation; When the device detects abnormal signals and starts to activate positioning, if the positioning is not accurate enough, the full-mode terminal analyzer can be moved outside the vehicle and the near-field signal detector can be used for accurate positioning; The shielding tent works as follows: the shielding material of the tent contains special substances that can reflect and absorb electromagnetic signals. When electromagnetic signals encounter shielding materials, part of them is reflected back, and the other part is absorbed by the material and converted into heat energy, which is consumed, thereby greatly weakening the electromagnetic signal strength through the shielding material, achieving electromagnetic shielding function. After the tent is built, a simple method to verify the success of the shielding environment is to bring a dual-SIM dual-standby mobile phone. If the shielding effect meets the standard, the phone will display no service or signal indication at the lowest level.

[0038] Further detection of the full-mode terminal analyzer when it finds abnormal signals: after finding abnormal signals, the terminal activation function should be turned on, and the approximate position is located according to the feedback signal strength. After finding the approximate area, keep the terminal activation state, and use the near-field signal detector for fine positioning. This process can refer to the above content. At this time, the endoscope, infrared thermal imager, and backscatter X-ray machine can be used as auxiliary tools until the terminal is found. Note that when using the near-field signal detector, the full-mode terminal analyzer should be kept away to avoid signal interference between devices.

[0039] Further inspection when an abnormal heat source is detected by an infrared thermal imager: If the heat source is an object, its function and purpose should be determined, and if necessary, it should be subjected to X-ray inspection. If the heat source is a part of a vehicle, that part should be disassembled or subjected to X-ray inspection as necessary. Note that thermal traces from inspectors may cause interference; therefore, inspectors should avoid direct contact between their bodies and the equipment with the vehicle before and during this inspection.

[0040] Further testing when a nonlinear node detector detects anomalies: Due to the technical principle of nonlinear node detectors, the device has a probability of triggering alarms for metal contact points and metal oxides, but scanning electronic products is not a reliable indicator. Therefore, it is particularly important to distinguish between false alarms. Specifically, when an alarm occurs while scanning items inside a vehicle, the structure and components of the items should be carefully examined. If necessary, X-ray inspection should be performed. If no abnormal structure is found after careful inspection, the alarm can be considered a false alarm. When an alarm occurs while scanning the interior structure of a vehicle, the structure should be carefully examined for any suspicious devices. Endoscopes, infrared thermal imagers, and backscatter X-ray machines can be used as auxiliary tools. If no abnormal device is found after careful inspection, the alarm can be considered a false alarm.

[0041] Further testing when an abnormal signal is detected by the near-field signal detector: After detecting an abnormal signal, replace the positioning antenna of the near-field signal detector to improve positioning accuracy and perform further signal localization. Based on the antenna's receiving sector, testing should be conducted from different directions to determine the approximate area of ​​the signal source. If obstructed by vehicle structures, endoscopes, backscatter X-ray machines, and infrared thermal imagers can be used as auxiliary detection tools until the signal source is located. Note that when using the near-field signal detector, the full-system terminal analyzer should be turned off, or at least not placed in the antenna receiving path of the near-field signal detector, to avoid inter-device interference.

[0042] S6. Test Conclusion: The test conclusion is drawn based on the above test process.

[0043] Example 2 like Figure 4 As shown, the detection method for wireless terminal devices based on electromagnetic shielding tents includes the following specific steps: S1. Signal Isolation Environment Construction: Construct an electromagnetic shielding tent in a flat, suitable testing site free from strong electromagnetic interference sources. The tent should be at least 8m × 4m × 3.5m in size and should achieve a shielding effectiveness of ≥75dB@10MHz-20GHz, with a grounding resistance ≤4Ω. After placing the device under test inside, close the tent flap to create a closed testing environment.

[0044] S2. Wireless Terminal Analyzer Power On: Place the full-standard terminal analyzer in the center of the tent or vehicle, power on the device, and wait for the motherboard to be ready. Once the motherboard is ready, you can begin testing.

[0045] S3. Start continuous monitoring: long-time monitoring of signals in the area, paying attention to whether the equipment alarms during the detection process, and if an alarm signal is found, the alarm signal is promptly investigated. In this monitoring state, if the device under test is an electronic device or contains electronic components, it should be properly debugged to be in different states such as on / off, moving / static, working / standby, etc. Different states are monitored respectively, and each state is monitored for no less than 30 minutes. By changing the state, the detection of suspicious devices activated by specific working states can be avoided.

[0046] S4. Disposal of suspicious devices: When a suspicious signal source with a signal strength > -60dBm or other abnormal points is detected, first use the full-mode terminal analyzer activation function to make the suspicious device in a continuous emission state, and move the full-mode terminal analyzer to locate and find the signal strength. When the signal strength is maximum, carefully investigate the part of the signal strength of the object under test, and if necessary, use the near-field signal detector for accurate spatial positioning. If the suspicious device is found, it should be processed according to the relevant provisions.

[0047] S5. Draw detection conclusions: When the vehicle enters the shielding tent environment, the door curtain needs to be closed with detection personnel inside and outside, and the magic tape should be pasted tightly without gaps to ensure effective electromagnetic shielding.

[0048] Wireless terminal device monitoring is as follows: After the full-mode terminal analyzer is turned on and the signal in the shielding environment is detected, the measured signal will be classified and displayed on the device screen through the preset program judgment and recognition, which is in turn for each major operator signal, 2 / 4 / 5G Internet of Things card signal, foreign number card, unknown category, etc. Click on the suspicious signal to start positioning; for example, if the online signal of the device is an unknown target label, an instant voice broadcast will remind the detection personnel that the signal has been online and needs to be handled as soon as possible. After the detection personnel click the activation positioning button label, the device appears a field strength value feedback graph, and then the device is moved to locate and find. In addition, when the signal positioning is unclear or cannot be accurately positioned, the near-field signal detector can be used to assemble a positioning antenna to scan the specific position of the electromagnetic signal to achieve accurate positioning.

[0049] Example 3 As shown in Figure 5 , the security technology detection method further includes a real-time processing layer, a medium-speed processing layer, and an asynchronous analysis layer. The real-time processing layer is deployed on the edge computing node in the electromagnetic shielding tent and is configured to execute with a delay of ≤10ms.

[0050] S1. Multi-source data synchronous acquisition: In the shielding tent (shielding effectiveness ≥ 75 dB @ 1 GHz), the edge node acquires the original spectrum through direct connection, and real-time 0.1-8 GHz spectrum data are acquired at a sampling rate of 1 GS / s with a delay of ≤ 8 ms; an infrared thermal imager (resolution 640x480) captures the temperature distribution of the whole vehicle at 30 fps with a sensitivity of 0.05℃; a backscatter X-ray machine (tube voltage 90 kV, dose rate ≤ 2 μSv / h) performs perspective imaging on the door interlayer.

[0051] S2. Real-time processing of the edge layer: The electromagnetic feature extraction uses a parallel wavelet transform algorithm implemented by FPGA, the frequency band range is 2.4-5.8 GHz, the output feature is the spatial coordinates of the burst pulse signal (pulse width ≤ 2 μs, intensity > -60 dBm), the positioning error is ≤ 0.1 m, and the wavelet base energy integral value is calculated in the following manner .

[0052] The industrial computer identifies the technology based on the thermal imaging map, detects a hot spot with ΔT≥ 7.2℃, and correlates it with the electromagnetic anomaly in space and time, and if the correlation reaches the preset signal interval, an alarm is triggered, at which time the target area is scanned by the near-field detector, the backscatter X-ray machine, the endoscope, and the nonlinear node detector.

[0053] S3. Collaborative analysis of the medium-speed layer: Multi-modal correlation rules are mined, the Apriori algorithm is used to analyze the spatio-temporal correlation, and detection suggestions are output, such as: the backscatter X-ray machine performs multi-layer slice scanning (layer thickness 0.5 mm) on the correlated area; dynamic baseline calibration should be performed under the vehicle start state, the ECU communication characteristics (electromagnetic fingerprint under the CAN bus 125 kbps rate) are recorded, and a frequency domain baseline model is established.

[0054] S4. Decision and feedback of the asynchronous layer: The historical database is matched, the improved cosine similarity algorithm is used to compare the vehicle feature library, the similarity is calculated, the threshold is set to 0.85, and if it is higher than or equal to the threshold, a high-risk label is output; incremental training is performed through the random forest model, learning is developed using the AdaBoost algorithm as the sample increases, and the feature weight ΔW=0.2x false positive rate and the learning rate η=0.01 are adjusted, thereby improving the detection effect.

[0055] The specific embodiments of the present application are described above. It should be understood that the present application is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essential content of the present application. In the case of no conflict, the embodiments of the present application and the features in the embodiments can be arbitrarily combined with each other.

Claims

1. A method for detecting vehicle security technology based on a shielded tent, characterized in that, Includes the following steps: S1. Construct a signal isolation environment: Set up an electromagnetic shielding tent at the testing site, drive the vehicle to be tested into the tent and close the tent door curtain; S2. Electromagnetic baseline calibration: Use a spectrum analyzer to collect the background noise spectrum of the vehicle in the off / start state, and establish a spectrum baseline threshold model; S3. Wireless Terminal Equipment Monitoring: Activate the full-standard terminal analyzer to capture radio frequency communication signals within the vehicle range of the shielded environment, identify and initially locate suspicious wireless terminal signals; S4. While the full-standard terminal analyzer is running, multi-modal collaborative detection and verification are carried out; S4.1 Multimodal Collaborative Detection and Verification: The temperature distribution of the entire vehicle is monitored using an infrared thermal imager; A nonlinear node detector is used to scan the vehicle area at a speed of ≤0.1m / s; Using an endoscope, physical inspections are conducted through video observation of areas of the vehicle that are difficult to observe directly. Using a backscatter X-ray machine to perform physical inspections of car doors and bodies through X-ray transmission; Using a near-field signal detector: perform a detailed field strength gradient scan of the entire vehicle; S4.2 Compare the spectrum baseline threshold model established in step S2, and mark the abnormal signals / hot spots / nodes with signal strengths exceeding -60dBm or not conforming to normal characteristics found in steps S3 and S4.1 during detection; S5. Verification, location and handling of suspicious devices: For the abnormal signals / hot spots / nodes marked in step S4.2, cross-verify them with the location results of the near-field signal detector, X-ray fluoroscopic images, endoscopic video observation results, thermal imaging images and semiconductor scanning results. After determining the location of the suspicious device, carry out physical disassembly or further X-ray fluoroscopic imaging inspection and evidence collection. S6. Test Conclusion: The test conclusion is drawn based on the above test process.

2. The vehicle security technology detection method based on a shielded tent according to claim 1, characterized in that, Step S1 includes an electromagnetic shielding tent, wherein the shielding effectiveness of the electromagnetic shielding tent is greater than or equal to 75dB in the 10MHz~20GHz frequency band.

3. The vehicle security technology detection method based on a shielded tent according to claim 1, characterized in that, The step S2 of constructing the spectral baseline threshold model includes: a) With the vehicle off, perform a full-band scan of the 0.1-8GHz frequency band and record the amplitude-frequency characteristics of the ambient background noise as a baseline noise reference; b) When the vehicle is running, identify and record the inherent and stable electromagnetic radiation characteristics of the vehicle's electronic system to form a characteristic spectrum fingerprint database; c) Combining the baseline noise reference and the feature spectral fingerprint database, set a dynamic alarm threshold to issue an alarm for abnormal spectral components that exceed the baseline noise level or do not belong to the feature fingerprint database.

4. The vehicle security technology detection method based on a shielded tent according to claim 1, characterized in that, The initial screening of wireless terminal equipment monitoring in step S3 includes: turning on the full-standard terminal analyzer, transmitting a fundamental wave signal, capturing and parsing the IMSI / identification information of wireless terminals responding to this signal inside the shielded tent, displaying the information in real time on the device interface, and marking the identified risk-category signals as "targets to be verified".

5. The vehicle security technology detection method based on a shielded tent according to claim 1, characterized in that, The method described in step S4.1 includes: the near-field signal detector is used to perform spatial field strength gradient scanning on the suspicious signal area initially located in step S3 to achieve precise directional positioning; note that the terminal detection analyzer in step S3 is used to activate the terminal to achieve continuous tracking of the suspicious signal; the method described in step S4.2 includes anomaly comparison and marking: the detection results of steps S3 and S4.2 are cross-compared with the spectrum baseline threshold model established in step S2 in real time or post-processing stage.

6. The vehicle security technology detection method based on a shielded tent according to claim 1, characterized in that, It also includes a real-time processing layer, a medium-speed processing layer, and an asynchronous analysis layer. The real-time processing layer is deployed on edge computing nodes within the electromagnetic shielding tent and configured to execute with a delay of ≤10ms. a. Extracting electromagnetic signal features using wavelet transform and frequency domain energy integration; b. Keyframe capture of thermal imaging video streams based on dynamic sampling of motion vectors; The medium-speed processing layer is deployed on the industrial control computer for testing and configured to execute with a delay of ≤2 minutes. c. Physical anomaly correlation analysis: using the Apriori algorithm to mine the spatiotemporal rules that correlate electromagnetic signal layer anomalies with physical layer anomalies; d. Generate multi-device collaborative control commands and trigger threshold calculations; The asynchronous analysis layer is deployed on the central server and configured to execute with a delay of ≤5 minutes. e. Historical vehicle condition database matching based on anomaly pattern retrieval using improved cosine similarity; f. Adjust the feature splitting threshold based on false alarm feedback and dynamically update the node weights of the random forest classifier.

7. The vehicle security technology detection method based on a shielded tent according to claim 6, characterized in that, The real-time processing layer is directly connected to the metal feed point of the electromagnetic shielding tent via a PCIe×4 interface, with a transmission impedance matching of 50Ω±5%; the edge computing node uses FPGA to implement parallel wavelet transform calculation, with a processing bandwidth of 0.1-8GHz and a sampling rate of ≥1GS / s.

8. The vehicle security technology detection method based on a shielded tent according to claim 6, characterized in that, The dynamic update of the asynchronous analysis layer includes: reducing the weight of unshielded environment features based on historical false alarm cases, with a weight reduction ratio of ΔW = 0.2 × false alarm rate; and starting incremental training of the classifier based on the online gradient descent algorithm when more than 100 new eavesdropping device samples are added.

9. A system for implementing the vehicle security technology detection method based on a shielded tent as described in any one of claims 1-8, characterized in that, The electromagnetic shielding tent and the multi-mode terminal analyzer are described. The electromagnetic shielding tent has a signal coupling enhancement layer integrated on its side wall, with a shielding effectiveness of greater than or equal to 75dB in the 10MHz to 20GHz frequency band. It includes a seven-layer composite structure and a detachable door curtain. The multi-mode terminal analyzer has a built-in resonant circuit that matches the impedance of the signal coupling enhancement layer. It supports 2G / 4G / 5G / WiFi / GPS multi-band signal scanning and SIM card type identification, and can perform sub-meter level positioning. It includes a multi-band scanning module and a signal trapping unit.

10. The system for a vehicle security technology detection method based on a shielded tent according to claim 9, characterized in that, The seven-layer composite structure is a double-sided symmetrical coating structure. Each side consists of a substrate, a first coating, a second coating, and a third coating from the outside to the inside. The other side has the same coating sequence and shares the same substrate. The detachable door curtain is equipped with an electromagnetic sealing strip at the edge, and the shielding effectiveness is ≥70dB when closed.

Images