A method and system for detecting vehicle privacy technology based on a shielding tent

Abstract

The present application belongs to the field of security and privacy technology, and particularly relates to a vehicle privacy technology detection method and system based on a shielding tent. A signal isolation environment is constructed in an electromagnetic shielding tent; a noise baseline model is established through frequency spectrum analysis; wireless terminal equipment detection is performed through a full-standard terminal analyzer; a non-linear node detector, an infrared thermal imager, a near-field signal detector, a backscatter X-ray machine, and an endoscope are used to perform regional collaborative scanning; combined with big data and machine learning algorithms, an over-standard signal source is located, and if a suspicious device is found, it is disposed in accordance with the rules and evidence is collected. The present application solves the problems of low standardization, high false alarm rate, low implementation efficiency, and low detection comprehensiveness of vehicle privacy technology detection in an open environment. It is suitable for detection of eavesdropping, peeping, and positioning devices of classified vehicles.

Description

Technical Field

[0001] This invention belongs to the field of security and confidentiality technology, specifically relating to a vehicle confidentiality technology detection method and system based on a shielded tent. Background Technology

[0002] With the increasing electrification and intelligence of vehicles, in-vehicle systems integrate numerous communication modules (such as 4G / 5G, Beidou / GPS, Bluetooth, and WiFi) and storage units. While these modules enable intelligent vehicle functions, they also bring risks of information leakage and electromagnetic interference. For example, during operation, vehicles may leak sensitive information through electromagnetic radiation, or experience communication interruptions and data tampering when subjected to external electromagnetic interference, seriously threatening vehicle information security and operational safety. Therefore, vehicle security technology testing is essential, requiring the detection and discovery of: 1) security vulnerabilities and potential leaks in the tested vehicle; 2) technical espionage devices that may be installed in the tested vehicle to steal sound, images, location data, and other data; and 3) espionage activities and methods utilizing various facilities and equipment within the tested vehicle.

[0003] The existing vehicle security technology detection mainly adopts the following two methods: one is to use portable detection equipment in an open environment. This method is susceptible to external electromagnetic interference, resulting in a high false alarm rate for signal scanning equipment and low accuracy of detection results; the other is to conduct detection in a fixed electromagnetic shielding room. However, the signal transmission behavior of suspicious devices is easily concealed by external triggers, and there is no integration of multiple technical means targeting the physical and electromagnetic characteristics of espionage devices, resulting in a high rate of missed detection. Summary of the Invention

[0004] This invention provides a vehicle security technology detection method and system based on a shielded tent, which solves the technical problems of existing methods that cannot eliminate the impact of environmental electromagnetic interference on vehicle security technology detection and wireless terminal equipment detection, and the contradiction between the differentiated latency requirements of multi-level detection tasks and limited hardware resources, making model optimization impossible.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A vehicle security technology detection method based on an electromagnetic shielding tent, comprising the following steps:

[0006] S1. Construct a signal isolation environment: Set up an electromagnetic shielding tent at the testing site, drive the vehicle to be tested into the tent and close the tent door curtain;

[0007] S2. Electromagnetic baseline calibration: Use a spectrum analyzer to collect the background noise spectrum of the vehicle in the off / start state, and establish a spectrum baseline threshold model;

[0008] S3. Wireless Terminal Equipment Monitoring: Activate the full-standard terminal analyzer to capture radio frequency communication signals within the vehicle range of the shielded environment, identify and initially locate suspicious wireless terminal signals;

[0009] S4. While the full-standard terminal analyzer is running, multi-modal collaborative detection and verification are carried out;

[0010] S4.1 Multimodal Collaborative Detection and Verification:

[0011] The temperature distribution of the entire vehicle is monitored using an infrared thermal imager;

[0012] A nonlinear node detector is used to scan the vehicle area at a speed of ≤0.1m / s;

[0013] Using an endoscope, physical inspections are conducted through video observation of areas of the vehicle that are difficult to observe directly.

[0014] Using a backscatter X-ray machine to perform physical inspections of car doors and bodies through X-ray transmission;

[0015] Using a near-field signal detector: perform a detailed field strength gradient scan of the entire vehicle;

[0016] S4.2 Compare the spectrum baseline threshold model established in step S2, and mark the abnormal signals / hot spots / nodes whose signal strength exceeds -60dBm or does not conform to normal characteristics found in steps S3 and S4.1;

[0017] S5. Verification, location and handling of suspicious devices: For the abnormal signals / hot spots / nodes marked in step S4.2, cross-verify them with the location results of the near-field signal detector, X-ray fluoroscopic images, endoscopic video observation results, thermal imaging images and semiconductor scanning results. After determining the location of the suspicious device, carry out physical disassembly or further X-ray fluoroscopic imaging inspection and evidence collection.

[0018] S6. Test Conclusion: The test conclusion is drawn based on the above test process;

[0019] It also includes a real-time processing layer, a medium-speed processing layer, and an asynchronous analysis layer. The real-time processing layer is deployed on edge computing nodes within the electromagnetic shielding tent and configured to execute with a delay of ≤10ms.

[0020] Electromagnetic signal features are extracted using wavelet transform and frequency domain energy integration.

[0021] Keyframe capture of thermal imaging video streams based on dynamic sampling of motion vectors;

[0022] The medium-speed processing layer is deployed on the industrial control computer for testing and configured to execute with a delay of ≤2 minutes.

[0023] Physical anomaly correlation analysis uses the Apriori algorithm to mine spatiotemporal rules that correlate electromagnetic signal layer anomalies with physical layer anomalies. Among them, electromagnetic signal layer anomalies specifically refer to electromagnetic signal strengths exceeding -60dBm that do not belong to the vehicle's inherent electromagnetic characteristic spectral fingerprint database; physical layer anomalies refer to hot spots with ΔT≥5℃ detected by infrared thermal imagers, semiconductor anomalous nodes detected by nonlinear node detectors, foreign objects in the vehicle body structure detected by backscatter X-ray machines, and suspicious physical structures detected by endoscopes.

[0024] Generate multi-device collaborative control commands to trigger threshold calculation; where multi-device refers to industrial control computer, near-field detector, backscatter X-ray machine, endoscope, and nonlinear node detector; the object of threshold calculation is the anomaly judgment threshold, and the main body of calculation is industrial control computer;

[0025] The asynchronous analysis layer is deployed on the central server and configured to execute with a delay of ≤5 minutes.

[0026] Match the historical database, use the improved cosine similarity algorithm to compare the vehicle feature library, calculate the similarity, and set the threshold to 0.85. If the similarity is higher than or equal to the threshold, output a high-risk label.

[0027] The threshold is adjusted based on false alarm feedback, and the node weights of the random forest classifier are dynamically updated. Incremental training is performed using the random forest model, and the AdaBoost algorithm is used for learning. The feature weights ΔW = 0.2 × false alarm rate and the learning rate η = 0.01 are adjusted to improve the detection effect.

[0028] The real-time processing layer is directly connected to the metal feed point of the electromagnetic shielding tent via a PCIe×4 interface, with a transmission impedance matching of 50Ω±5%; the edge computing node uses FPGA to implement parallel wavelet transform calculation, with a processing bandwidth of 0.1-8GHz and a sampling rate of ≥1GS / s.

[0029] The dynamic update of the asynchronous analysis layer includes: reducing the weight of unshielded environment features based on historical false alarm cases, with a weight reduction ratio of ΔW = 0.2 × false alarm rate; and starting incremental training of the classifier based on the online gradient descent algorithm when more than 100 new eavesdropping device samples are added.

[0030] Furthermore, step S1 includes an electromagnetic shielding tent, wherein the shielding effectiveness of the electromagnetic shielding tent is greater than or equal to 75dB in the 10MHz~20GHz frequency band.

[0031] Further, the construction of the spectral baseline threshold model in step S2 includes:

[0032] a) With the vehicle off, perform a full-band scan of the 0.1-8GHz frequency band and record the amplitude-frequency characteristics of the ambient background noise as a baseline noise reference;

[0033] b) When the vehicle is running, identify and record the inherent and stable electromagnetic radiation characteristics of the vehicle's electronic system to form a characteristic spectrum fingerprint database;

[0034] c) Combining the baseline noise reference and the feature spectral fingerprint database, set a dynamic alarm threshold to issue an alarm for abnormal spectral components that exceed the baseline noise level or do not belong to the feature fingerprint database.

[0035] Furthermore, the initial screening of wireless terminal equipment monitoring in step S3 includes: turning on the full-standard terminal analyzer, transmitting a fundamental wave signal, capturing and parsing the IMSI / identification information of wireless terminals responding to this signal inside the shielded tent, displaying the classification on the device interface in real time, and marking the identified risk category signals as "targets to be verified".

[0036] Further, the method described in step S4.1 includes: the near-field signal detector is used to perform spatial field strength gradient scanning on the suspicious signal area initially located in step S3 to achieve precise directional positioning; note that the terminal detection analyzer in step S3 is used to activate the terminal to achieve continuous tracking of the suspicious signal; the method described in step S4.2 includes anomaly comparison and marking: the detection results of steps S3 and S4.1 are cross-compared with the spectrum baseline threshold model established in step S2 in real time or post-processing stage.

[0037] A system comprising a vehicle security technology detection method based on an electromagnetic shielding tent includes: an electromagnetic shielding tent and a multi-mode terminal analyzer. The electromagnetic shielding tent has a signal coupling enhancement layer integrated on its sidewall, with a shielding effectiveness greater than or equal to 75dB in the 10MHz~20GHz frequency band, and includes a seven-layer composite structure and a detachable door curtain. The multi-mode terminal analyzer has a built-in resonant circuit that matches the impedance of the signal coupling enhancement layer, supports 2G / 4G / 5G / WiFi / GPS multi-band signal scanning and SIM card type identification, and can perform sub-meter level positioning. It includes a multi-band scanning module and a signal trapping unit.

[0038] Furthermore, the seven-layer composite structure is a double-sided symmetrical coating structure, with each side consisting of a substrate, a first coating, a second coating, and a third coating from the outside to the inside. The other side has the same coating sequence and shares the same substrate. The detachable door curtain is equipped with an electromagnetic sealing strip at its edge, and its shielding effectiveness is ≥70dB when closed.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] (1) In the vehicle security detection, the present invention establishes a dynamic spectrum baseline threshold model that includes environmental background noise and vehicle inherent electromagnetic fingerprint. This model not only sets an amplitude threshold (-60dBm), but also identifies “new spectrum components” and “abnormal fluctuations in feature fingerprints”, which significantly improves the detection capability of disguised or low-power espionage devices and greatly reduces false alarms caused by vehicle signals or residual environmental noise.

[0041] (2) The present invention uses a multi-modal hierarchical collaborative verification mechanism with multiple devices. After the initial screening, the interference source is turned off for fine measurement. The detection results are fed back to the baseline model for comparison, which solves the problems of low efficiency and conflicting results caused by simple stacking of multiple devices and independent operation. In particular, it improves the positioning accuracy and verification reliability of intelligent concealed devices in complex vehicle structures.

[0042] (3) This invention lowers the technical and experience thresholds for implementing vehicle security testing and improves the testing efficiency of vehicle security technology testing; by combining the electromagnetic shielding tent with the full-standard terminal analyzer, compared with the fixed shielding room, the electromagnetic shielding tent is easy to deploy quickly in various venues. Combined with the above-mentioned standardized process, it greatly reduces the threshold and cost of implementing professional-grade vehicle security technology testing, while ensuring the standardization and efficiency of testing.

[0043] (4) This invention utilizes a three-level processing architecture to clearly define the system latency boundary. By using a direct connection via a PCIe×4 interface, the high-frequency signal fidelity is improved (reflection loss is less than 0.5dB in the 5GHz band); the use of big data-based algorithms reduces manual intervention and improves the accuracy and efficiency of detection; the incremental learning mechanism continuously reduces the system's false alarm rate. Attached Figure Description

[0044] Figure 1 This is a flowchart of the detection method of the present invention;

[0045] Figure 2 This is a flowchart illustrating the detection process for vehicle security technology within a shielded environment according to the present invention.

[0046] Figure 3 This is a timing diagram of the multi-device collaborative detection logic of the present invention;

[0047] Figure 4 This is a flowchart illustrating the implementation of wireless terminal detection in a shielded environment according to the present invention.

[0048] Figure 5 This is a diagram of the layered processing architecture of the present invention. Detailed Implementation

[0049] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0050] Example 1

[0051] like Figure 1-3 As shown, a vehicle security technology detection method based on an electromagnetic shielding tent includes the following steps:

[0052] S1. Constructing a Signal Isolation Environment: Erect an electromagnetic shielding tent in a flat, suitable testing area free from strong electromagnetic interference sources. The tent should be at least 8m × 4m × 3.5m in size and achieve a shielding effectiveness of ≥75dB in the 10MHz~20GHz frequency band. The tent's grounding resistance should be ≤4Ω. After the vehicle enters, close the tent flap to create a closed testing environment.

[0053] S2. Electromagnetic baseline calibration: Performed using a wideband spectrum analyzer, frequency range 0.1-8GHz.

[0054] a) Background scan in engine-off state: The vehicle is turned off, and all external devices that may cause interference are shut down (including detection devices, leaving only the spectrum analyzer working); the spectrum analyzer (frequency range: 0.1-8GHz, resolution bandwidth RBW≤10kHz) is used to perform a slow full-band scan of the environment inside the shielded tent (scanning speed ≤100ms / point), and at least 3 stable spectra are collected, and the average is recorded as the environmental background noise reference spectrum.

[0055] b) Startup State Feature Extraction: From vehicle startup to idle, the spectrum analyzer performs repeated scans; it focuses on identifying and recording stable, repeatable narrowband or broadband radiation characteristics (such as specific frequency clock harmonics, ignition pulse characteristics, and CAN bus communication characteristics) generated by the engine ignition system, ECU, and in-vehicle entertainment system, forming a vehicle system feature spectrum fingerprint database. Its center frequency, bandwidth, and typical amplitude range are recorded.

[0056] c) Constructing a baseline threshold model: Combining the ambient background noise reference spectrum and the vehicle system characteristic spectrum fingerprint database, a dynamic alarm threshold is set at -60dBm. This model is mainly used to: i) distinguish between ambient noise and valid signals; ii) identify new or abnormal spectral components beyond the vehicle's inherent electromagnetic characteristics (even if their amplitude is below -60dBm, an alarm will still be triggered if it is a new feature); iii) trigger an alarm for abnormal amplitude fluctuations (such as exceeding ±3dB) in the known vehicle characteristic spectrum.

[0057] S3. Wireless Terminal Equipment Monitoring: Activate the full-standard terminal analyzer to capture radio frequency communication signals within the vehicle range of the shielded environment, identify and initially locate suspicious wireless terminal signals;

[0058] The all-standard terminal analyzer supports 5G NSA / SA and 4G TDD / FDD. This device emits a specially designed fundamental wave signal (such as a simulated base station signal) to capture and analyze the IMSI / identification information of wireless terminals (mobile phones, GPS devices, WiFi / Bluetooth modules) responding to this signal within a shielded tent. The device interface displays real-time categorized information (carrier SIM cards, IoT cards, overseas cards, unknown signals). For identified 'unknown signals' or signals of specific risk categories (such as overseas IoT cards), the device can provide preliminary field strength indication and approximate direction, marking them as 'targets to be verified'.

[0059] S4. While the full-standard terminal analyzer is running, multi-modal collaborative detection and verification are carried out;

[0060] S4.1 Multimodal Collaborative Detection:

[0061] First, an infrared thermal imager (resolution ≥ 640*480) scans the entire vehicle's exterior surface (engine hood, doors, tires), interior panels, and areas with concentrated electronic equipment (center console, trunk power supply), marking 'hot spots' (ΔT ≥ 5℃) with temperatures significantly higher than the environment or adjacent areas.

[0062] Secondly, nonlinear node detectors: perform semiconductor testing on the interior, seats, trunk, and other parts of the vehicle to detect whether there are any abnormal semiconductor devices in the above structures.

[0063] Secondly, the endoscope is used to examine and record images of areas that are difficult to observe directly (behind the dashboard, under the seats, in the headliner, and in the trunk recess).

[0064] Next, a handheld back-scatter X-ray machine (tube voltage 90kV, dose ≤2μSv) is used to perform X-ray imaging on key parts of the vehicle (doors, seat frames, roof lining, front and rear bumpers, key chassis nodes) to detect whether there are abnormal foreign objects, cables, or circuit boards between metal layers or inside the structure.

[0065] Finally, the near-field signal detector performs a fine field strength gradient scan of the entire vehicle (stepping speed ≤ 0.1m / s). Before this process, please turn off or keep away from potentially interfering equipment (such as full-system analyzers) to avoid signal interference and detect any suspicious signal transmission or reception signs throughout the vehicle.

[0066] S4.2 Compare the spectrum baseline threshold model established in step S2, and mark the abnormal signals / hot spots / nodes with signal strengths exceeding -60dBm or not conforming to normal characteristics found in steps S3 and S4.1 during detection;

[0067] The detection results from steps 3 and 4.1 are cross-compared with the spectral baseline threshold model established in step 2, either in real-time or post-processing stages:

[0068] If a signal is detected at the location found in step 3 / 4.1, and the signal belongs to the "new / abnormal spectral components" defined in step 2 or has an amplitude exceeding -60dBm, it is marked as a "high-confidence anomalous target".

[0069] If a signal is detected at the location found in step 3 / 4.1, but the signal belongs to the vehicle system characteristic fingerprint and the amplitude is normal, then it is excluded.

[0070] Abnormal hotspots, abnormal structures in X-rays, and suspicious objects in videos discovered in step 4.1, regardless of whether they are accompanied by signal anomalies, must be manually reviewed and judged based on their location and nature. If they cannot be reasonably explained (not part of the vehicle's original design or normal functional components), they are also marked as "targets to be verified".

[0071] S5. Verification, location and handling of suspicious devices: For the abnormal targets marked in step S4.1, cross-verify the location results of the near-field signal detector, X-ray fluoroscopic images, endoscopic video observation results, thermal imaging images and semiconductor scanning results. After determining the location of the suspicious device, carry out physical disassembly or further X-ray fluoroscopic imaging inspection and evidence collection.

[0072] Based on the new labeling results, the "high-confidence anomalous targets" and "targets to be verified" labeled in step 4.1 are as follows:

[0073] Prioritize the location of "high-confidence anomalous targets" and cross-validate it with the positioning results of the near-field signal detector, X-ray fluoroscopic images (if applicable), and endoscopic video observation recordings to determine the final physical location;

[0074] Conduct a detailed inspection of the target location (visual and tactile). If necessary, use a backscatter X-ray machine to confirm the internal structure from multiple angles using fluoroscopic imaging.

[0075] Once a suspicious device is confirmed, it should be physically dismantled or evidence preserved (by taking photos, videos, and recording characteristics) in accordance with safety regulations, and the details should be documented. When a vehicle enters the shielded tent environment, the curtain must be closed, and there must be testing personnel on both the inside and outside, cooperating with each other. When attaching Velcro, it should be ensured that it is firmly attached to ensure effective electromagnetic shielding.

[0076] The wireless terminal device monitoring process is as follows: The all-standard terminal analyzer is activated. After detecting a signal within the shielded environment, it is judged and identified through a preset program. The detected signals are then categorized and displayed on the device screen, including signals from major carriers, 2G / 4G / 5G IoT cards, overseas SIM cards, and unknown numbers. Clicking to activate a suspicious signal initiates location tracking. For example, if the signal is categorized as "unknown," an immediate voice announcement will alert the testing personnel that the signal has been activated and should be addressed promptly. After the personnel click the "activate location" button, the device displays a field strength feedback image, and the mobile device is then used to locate the signal. Additionally, when signal location is unclear or cannot be accurately determined, a near-field signal detector can be used with a positioning antenna to scan the specific location of the electromagnetic signal for precise positioning.

[0077] Regarding the placement of the all-standard terminal analyzer, the following should be noted:

[0078] At the start of the test, place the full-standard terminal analyzer inside the vehicle, near the geometric center;

[0079] During testing, if the full-system terminal analyzer interferes with other equipment or multiple devices are operating in concert, it should be turned off or placed away from the equipment as appropriate.

[0080] If the device detects an abnormal signal and activates positioning, but finds that the positioning is not accurate enough, the full-standard terminal analyzer can be moved outside the vehicle and a near-field signal detector can be used to achieve precise positioning.

[0081] The working principle of the shielding tent is as follows: the shielding material of the tent contains special substances that can reflect and absorb electromagnetic signals. When an electromagnetic signal encounters the shielding material, part of it is reflected back, and the other part is absorbed by the material and converted into heat energy, thus greatly weakening the intensity of the electromagnetic signal that passes through the shielding material, achieving the electromagnetic shielding function. After the shielding environment is set up, a simple way to verify its success is to bring in a dual-SIM dual-standby mobile phone. If the shielding effect is satisfactory, the phone will display "No Service" or indicate the lowest signal strength.

[0082] Further testing when an abnormal signal is detected by the full-system terminal analyzer: After detecting an abnormal signal, the terminal activation function should be activated. The approximate location should be determined based on the strength of the feedback signal. After finding the approximate area, keep the terminal in the active state and use a near-field signal detector for fine positioning. This process can be referred to the above. At this time, endoscopes, infrared thermal imagers, and backscatter X-ray machines can be used as auxiliary tools until the terminal is found. Note that when using a near-field signal detector, the full-system terminal analyzer should be kept away to avoid signal interference between devices.

[0083] Further inspection when an abnormal heat source is detected by an infrared thermal imager: If the heat source is an object, its function and purpose should be determined, and if necessary, it should be subjected to X-ray inspection. If the heat source is a part of a vehicle, that part should be disassembled or subjected to X-ray inspection as necessary. Note that thermal traces from inspectors may cause interference; therefore, inspectors should avoid direct contact between their bodies and the equipment with the vehicle before and during this inspection.

[0084] Further testing when a nonlinear node detector detects anomalies: Due to the technical principle of nonlinear node detectors, the device has a probability of triggering alarms for metal contact points and metal oxides, but scanning electronic products is not a reliable indicator. Therefore, it is particularly important to distinguish between false alarms. Specifically, when an alarm occurs while scanning items inside a vehicle, the structure and components of the items should be carefully examined. If necessary, X-ray inspection should be performed. If no abnormal structure is found after careful inspection, the alarm can be considered a false alarm. When an alarm occurs while scanning the interior structure of a vehicle, the structure should be carefully examined for any suspicious devices. Endoscopes, infrared thermal imagers, and backscatter X-ray machines can be used as auxiliary tools. If no abnormal device is found after careful inspection, the alarm can be considered a false alarm.

[0085] Further testing when an abnormal signal is detected by the near-field signal detector: After detecting an abnormal signal, replace the positioning antenna of the near-field signal detector to improve positioning accuracy and perform further signal localization. Based on the antenna's receiving sector, testing should be conducted from different directions to determine the approximate area of ​​the signal source. If obstructed by vehicle structures, endoscopes, backscatter X-ray machines, and infrared thermal imagers can be used as auxiliary detection tools until the signal source is located. Note that when using the near-field signal detector, the full-system terminal analyzer should be turned off, or at least not placed in the antenna receiving path of the near-field signal detector, to avoid inter-device interference.

[0086] S6. Test Conclusion: The test conclusion is drawn based on the above test process.

[0087] Example 2

[0088] like Figure 4 As shown, the detection method for wireless terminal devices based on electromagnetic shielding tents includes the following specific steps:

[0089] S1. Signal Isolation Environment Construction: Construct an electromagnetic shielding tent in a flat, suitable testing site free from strong electromagnetic interference sources. The tent should be at least 8m × 4m × 3.5m in size and should achieve a shielding effectiveness of ≥75dB in the 10MHz~20GHz frequency band. The tent's grounding resistance should be ≤4Ω. After placing the device under test inside, close the tent flap to create a closed testing environment.

[0090] S2. Wireless Terminal Analyzer Power On: Place the full-standard terminal analyzer in the center of the tent or vehicle, power on the device, and wait for the motherboard to be ready. Once the motherboard is ready, you can begin testing.

[0091] S3. Begin Continuous Monitoring: Perform long-term monitoring of signals within the area. During the monitoring process, carefully observe the equipment for alarms. If an alarm signal is detected, investigate the alarm signal promptly. During this monitoring period, if the device under test is an electronic device or contains electronic components, it should be appropriately adjusted to be in different states such as power-on / power-off, motion / stationary, and working / standby. Monitor each state separately, with each state monitoring for at least 30 minutes. By changing the state, you can avoid missing suspicious devices activated in specific working states.

[0092] S4. Handling Suspicious Devices: When a suspicious signal source or other anomaly is detected with a signal strength > -60dBm, first activate the full-mode terminal analyzer to keep the suspicious device in continuous transmission mode. Move the full-mode terminal analyzer and locate the device based on the signal strength value. When the signal strength is at its maximum, carefully examine the area with the strongest signal strength of the target device. If necessary, use a near-field signal detector for precise spatial positioning. If the suspicious device is found, evidence should be collected and handled according to relevant procedures.

[0093] S5. Draw test conclusions

[0094] When a vehicle enters the shielded tent environment, the curtain must be closed, and testing personnel must be present on both the inside and outside of the tent to cooperate with each other. When attaching Velcro, ensure that it is tightly attached without gaps to ensure effective electromagnetic shielding.

[0095] The wireless terminal device monitoring process is as follows: The all-standard terminal analyzer is activated. After detecting a signal within the shielded environment, it is judged and identified through a preset program. The detected signals are then categorized and displayed on the device screen, including signals from major carriers, 2G / 4G / 5G IoT cards, overseas SIM cards, and unknown numbers. Clicking to activate a suspicious signal initiates location tracking. For example, if the signal is categorized as "unknown," an immediate voice announcement will alert the monitoring personnel that the signal has been uploaded and should be addressed promptly. After the personnel click the "activate location" button, the device displays a field strength feedback image, and the mobile device is then used to locate the signal. Additionally, when signal location is unclear or cannot be accurately determined, a near-field signal detector equipped with a positioning antenna can be used to scan the specific location of the electromagnetic signal for precise positioning.

[0096] Example 3

[0097] like Figure 5 As shown, the security technology detection method also includes a real-time processing layer, a medium-speed processing layer, and an asynchronous analysis layer. The real-time processing layer is deployed on the edge computing nodes inside the electromagnetic shielding tent and configured to execute with a delay of ≤10ms.

[0098] S1. Synchronous acquisition of multi-source data

[0099] Inside the shielded tent (shielding effectiveness greater than or equal to 75dB in the 1GHz band), edge nodes acquire the raw spectrum via direct connection, obtain 0.1-8GHz spectrum data in real time, with a sampling rate of 1GS / s and a delay of ≤8ms; an infrared thermal imager (resolution 640×480) captures the temperature distribution of the entire vehicle at 30fps with a sensitivity of 0.05℃; a backscatter X-ray machine (tube voltage 90kV, dose rate ≤2μSv / h) performs transparent imaging of the interlayer of the vehicle door.

[0100] S2. Real-time processing of edge layers

[0101] Electromagnetic feature extraction employs a parallel wavelet transform algorithm, implemented on an FPGA, using the Daubechies 4 wavelet basis and energy integral values. Frequency band: 2.4–5.8 GHz. Output characteristics are spatial coordinates of burst pulse signals (pulse width ≤ 2 μs, intensity > -60 dBm), with a positioning error ≤ 0.1 m;

[0102] The industrial control computer is based on thermal imaging recognition technology. When it detects a hot spot with ΔT≥7.2℃ and correlates it with electromagnetic anomalies in time and space, an alarm is triggered if the correlation reaches a preset signal interval. At this time, a near-field detector, a backscatter X-ray machine, an endoscope, and a nonlinear node detector are used to scan the target area.

[0103] S3. Intermediate-velocity layer synergistic analysis

[0104] Multimodal association rules are mined, and the spatiotemporal correlation is analyzed using the Apriori algorithm to output detection suggestions, such as: using a backscatter X-ray machine to perform multi-slice scanning of the associated area (slice thickness 0.5mm); dynamic baseline calibration should be performed while the vehicle is running, recording ECU communication characteristics (electromagnetic fingerprint at 125kbps rate on CAN bus) to establish a frequency domain baseline model.

[0105] S4. Asynchronous Layer Decision-Making and Feedback

[0106] The system matches historical databases and uses an improved cosine similarity algorithm to compare vehicle feature libraries, calculating similarity with a threshold of 0.85. If the similarity is higher than or equal to the threshold, a high-risk label is output. Incremental training is performed using a random forest model. As the number of samples increases, the AdaBoost algorithm is used to expand the learning process, and the feature weights ΔW = 0.2 × false alarm rate and the learning rate η = 0.01 are adjusted to improve the detection performance.

[0107] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A method for detecting vehicle security technology based on a shielded tent, characterized in that, Includes the following steps: S1. Construct a signal isolation environment: Set up an electromagnetic shielding tent at the testing site, drive the vehicle to be tested into the tent and close the tent door curtain; S2. Electromagnetic baseline calibration: Use a spectrum analyzer to collect the background noise spectrum of the vehicle in the off / start state, and establish a spectrum baseline threshold model; S3. Wireless Terminal Equipment Monitoring: Activate the full-standard terminal analyzer to capture radio frequency communication signals within the vehicle range of the shielded environment, identify and initially locate suspicious wireless terminal signals; S4. While the full-standard terminal analyzer is running, multi-modal collaborative detection and verification are carried out; S4.1 Multimodal Collaborative Detection and Verification: The temperature distribution of the entire vehicle is monitored using an infrared thermal imager; A nonlinear node detector is used to scan the vehicle area at a speed of ≤0.1m / s; Using an endoscope, physical inspections are conducted through video observation of areas of the vehicle that are difficult to observe directly. Using a backscatter X-ray machine to perform physical inspections of car doors and bodies through X-ray transmission; Using a near-field signal detector: perform a detailed field strength gradient scan of the entire vehicle; S4.2 Compare the spectrum baseline threshold model established in step S2, and mark the abnormal signals / hot spots / nodes whose signal strength exceeds -60dBm or does not conform to normal characteristics found in steps S3 and S4.1; S5. Verification, location and handling of suspicious devices: For the abnormal signals / hot spots / nodes marked in step S4.2, cross-verify them with the location results of the near-field signal detector, X-ray fluoroscopic images, endoscopic video observation results, thermal imaging images and semiconductor scanning results. After determining the location of the suspicious device, carry out physical disassembly or further X-ray fluoroscopic imaging inspection and evidence collection. S6. Test Conclusion: The test conclusion is drawn based on the above test process; It also includes a real-time processing layer, a medium-speed processing layer, and an asynchronous analysis layer. The real-time processing layer is deployed on edge computing nodes within the electromagnetic shielding tent and configured to execute with a delay of ≤10ms. a. Extracting electromagnetic signal features using wavelet transform and frequency domain energy integration; b. Keyframe capture of thermal imaging video streams based on dynamic sampling of motion vectors; The medium-speed processing layer is deployed on the industrial control computer for testing and configured to execute with a delay of ≤2 minutes. c. Physical anomaly correlation analysis: The Apriori algorithm is used to mine the spatiotemporal rules that correlate electromagnetic signal layer anomalies with physical layer anomalies. Among them, electromagnetic signal layer anomalies specifically refer to electromagnetic signal strengths exceeding -60dBm that do not belong to the vehicle's inherent electromagnetic characteristic spectrum fingerprint database; physical layer anomalies refer to hot spots with ΔT≥5℃ detected by infrared thermal imagers, semiconductor anomalous nodes detected by nonlinear node detectors, foreign objects in the vehicle body structure detected by backscatter X-ray machines, and suspicious physical structures detected by endoscopes. d. Generate multi-device collaborative control commands to trigger threshold calculation; where multi-device refers to industrial control computer, near-field detector, backscatter X-ray machine, endoscope, and nonlinear node detector; the object of threshold calculation is the anomaly judgment threshold, and the main body of calculation is industrial control computer; The asynchronous analysis layer is deployed on the central server and configured to execute with a delay of ≤5 minutes. e. Match the historical database, use the improved cosine similarity algorithm to compare the vehicle feature library, calculate the similarity, and set the threshold to 0.

85. If the similarity is higher than or equal to the threshold, output a high-risk label. f. Adjust the threshold based on false alarm feedback and dynamically update the node weights of the random forest classifier; wherein, incremental training is performed through the random forest model, learning is carried out using the AdaBoost algorithm, and the feature weights ΔW=0.2×false alarm rate and learning rate η=0.01 are adjusted to improve the detection effect. The real-time processing layer is directly connected to the metal feed point of the electromagnetic shielding tent via a PCIe×4 interface, with a transmission impedance matching of 50Ω±5%; the edge computing node uses FPGA to implement parallel wavelet transform calculation, with a processing bandwidth of 0.1-8GHz and a sampling rate of ≥1GS / s. The dynamic update of the asynchronous analysis layer includes: reducing the weight of unshielded environment features based on historical false alarm cases, with a weight reduction ratio of ΔW = 0.2 × false alarm rate; and starting incremental training of the classifier based on the online gradient descent algorithm when more than 100 new eavesdropping device samples are added.

2. The vehicle security technology detection method based on a shielded tent according to claim 1, characterized in that, Step S1 includes an electromagnetic shielding tent, wherein the shielding effectiveness of the electromagnetic shielding tent is greater than or equal to 75dB in the 10MHz~20GHz frequency band.

3. The vehicle security technology detection method based on a shielded tent according to claim 1, characterized in that, The step S2 of constructing the spectral baseline threshold model includes: a) With the vehicle off, perform a full-band scan of the 0.1-8GHz frequency band and record the amplitude-frequency characteristics of the ambient background noise as a baseline noise reference; b) When the vehicle is running, identify and record the inherent and stable electromagnetic radiation characteristics of the vehicle's electronic system to form a characteristic spectrum fingerprint database; c) Combining the baseline noise reference and the feature spectral fingerprint database, set a dynamic alarm threshold to issue an alarm for abnormal spectral components that exceed the baseline noise level or do not belong to the feature fingerprint database.

4. The vehicle security technology detection method based on a shielded tent according to claim 1, characterized in that, The initial screening of wireless terminal equipment monitoring in step S3 includes: turning on the full-standard terminal analyzer, transmitting a fundamental wave signal, capturing and parsing the IMSI / identification information of wireless terminals responding to this signal inside the shielded tent, displaying the information in real time on the device interface, and marking the identified risk-category signals as "targets to be verified".

5. The vehicle security technology detection method based on a shielded tent according to claim 1, characterized in that, The method described in step S4.1 includes: the near-field signal detector is used to perform spatial field strength gradient scanning on the suspicious signal area initially located in step S3 to achieve precise directional positioning; note that the terminal detection analyzer in step S3 is used to activate the terminal to achieve continuous tracking of the suspicious signal; the method described in step S4.2 includes anomaly comparison and marking: the detection results of steps S3 and S4.2 are cross-compared with the spectrum baseline threshold model established in step S2 in real time or post-processing stage.

6. A system for implementing the vehicle security technology detection method based on a shielded tent as described in any one of claims 1-5, characterized in that, The electromagnetic shielding tent and the multi-mode terminal analyzer are described. The electromagnetic shielding tent has a signal coupling enhancement layer integrated on its side wall, with a shielding effectiveness of greater than or equal to 75dB in the 10MHz~20GHz frequency band. It includes a seven-layer composite structure and a detachable door curtain. The multi-mode terminal analyzer has a built-in resonant circuit that matches the impedance of the signal coupling enhancement layer. It supports 2G / 4G / 5G / WiFi / GPS multi-band signal scanning and SIM card type identification, and can perform sub-meter level positioning. It includes a multi-band scanning module and a signal trapping unit.

7. The system for a vehicle security technology detection method based on a shielded tent according to claim 6, characterized in that, The seven-layer composite structure is a double-sided symmetrical coating structure. Each side consists of a substrate, a first coating, a second coating, and a third coating from the outside to the inside. The other side has the same coating sequence and shares the same substrate. The detachable door curtain is equipped with an electromagnetic sealing strip at the edge, and the shielding effectiveness is ≥70dB when closed.

Images