Risk level determination method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a risk level determination method and device, a storage medium and electronic equipment, and the method comprises the steps: determining the safety level of an electronic control unit of a tested vehicle; corresponding verification test scripts are generated according to the security level and a plurality of test strategies, and the test strategies comprise a seed randomness verification test strategy, a fault injection test strategy and an unauthorized test strategy; the verification test scripts corresponding to the test strategies are executed respectively, the risk level of the security access service algorithm of the electronic control unit is determined according to the test result, and through the technical scheme, the problem that the security access service security of the electronic control unit of the vehicle is not fully verified in the related technology is solved.

Description

Technical Field

[0001] This application relates to the field of information security, and more specifically, to a method and apparatus for determining risk levels, a storage medium, and an electronic device. Background Technology

[0002] As the intelligentization and connectivity of automobiles continue to advance, people's demands for vehicle safety and reliability are constantly increasing, and information security, as a crucial aspect, is gradually receiving more attention. The realization of all vehicle functions relies on the controller, and the security of a single controller is the cornerstone of overall vehicle security. However, controllers are also often easier targets for unauthorized attacks. One such threat is the unauthorized modification of applications and updates to the controller, which can alter or disable the vehicle's functions.

[0003] Before accessing and flashing an ECU, secure access is required through Unified Diagnostic Services (UDS). The UDS secure access process involves the host computer sending a seed request to the ECU. After receiving the seed information from the Electronic Control Unit (ECU), the host computer calculates a key and sends it to the ECU. The ECU then compares the key with the key to determine whether secure access is permitted. However, there is no industry-standard algorithm for this secure access authentication process; most are designed by OEMs themselves. The security of these algorithms is rarely verified, posing a risk of being bypassed. Currently, there is no systematic and efficient solution to detect this risk.

[0004] There is currently no effective solution to the problem that the security of secure access services to vehicle electronic control units has not been fully verified in existing technologies.

[0005] Therefore, it is necessary to improve the relevant technology to overcome the aforementioned defects. Summary of the Invention

[0006] This application provides a method and apparatus for determining risk levels, a storage medium, and an electronic device to at least address the problem in the prior art that the security of secure access services for vehicle electronic control units has not been sufficiently verified.

[0007] According to one embodiment of this application, a method for determining a risk level is provided, comprising: determining the security level of the electronic control unit of the vehicle under test; generating corresponding verification test scripts according to the security level and multiple test strategies, wherein the multiple test strategies include: a seed randomness verification test strategy, a fault injection test strategy, and an unauthorized access test strategy; executing the verification test scripts corresponding to the test strategies respectively, and determining the risk level of the secure access service algorithm of the electronic control unit based on the test results.

[0008] In one exemplary embodiment, determining the security level of an electronic control unit (ECU) of a vehicle under test includes: switching the session mode of the ECU to an extended session mode and sending an anti-theft security level request to the ECU; upon receiving an anti-theft security level response corresponding to the anti-theft security level request sent by the ECU, determining the security level of the ECU to be an anti-theft security level; switching the session mode of the ECU to an extended session mode and sending an extended security level request to the ECU; upon receiving an extended security level response corresponding to the extended security level request sent by the ECU, determining the security level of the ECU to be an extended security level; switching the session mode of the ECU to a refresh session mode and sending a refresh security level request to the ECU; upon receiving a refresh security level response corresponding to the refresh security level request sent by the ECU, determining the security level of the ECU to be a refresh security level.

[0009] In an exemplary embodiment, executing the verification test script corresponding to the test strategy includes: when the test strategy is a seed randomness verification test strategy, sending a seed request corresponding to the security level to the electronic control unit; dividing the seed information corresponding to the seed request sent by the electronic control unit to generate a training set and a verification set; training the neural network using the seed information in the training set to obtain a prediction model; predicting the seed information in the verification set using the prediction model to obtain first predicted seed information; comparing the seed information in the verification set with the first predicted seed information to obtain a first test result, wherein the test result includes: the first test result.

[0010] In an exemplary embodiment, seed information in a verification set is compared with first predicted seed information to obtain a first test result. The method further includes: determining the number of targets identical to those in the first predicted seed information and determining the total number of seed information in the verification set; determining a target percentage based on the target number and the total number; determining that the first test result indicates a high-risk level for the secure access service algorithm if the target percentage is greater than a first preset percentage; determining that the first test result indicates a medium-risk level for the secure access service algorithm if the target percentage is greater than a second preset percentage; and determining that the first test result indicates a low-risk level for the secure access service algorithm if the target percentage is less than or equal to the second preset percentage, wherein the first preset percentage is greater than the second preset percentage.

[0011] In an exemplary embodiment, training a neural network using seed information from the training set to obtain a prediction model includes: initializing the parameters of the neural network, wherein the parameters include: first connection weights between the input layer and the hidden layer of the neural network, second connection weights between the hidden layer and the output layer, first biases of neurons in the hidden layer, and second biases of neurons in the output layer; performing training steps: inputting the state parameters of the electronic control unit into the neural network, and outputting second prediction seed information through the output layer of the neural network; determining the global error of the neural network based on the second prediction seed information and the seed information of the validation set; calculating the gradient of each parameter using gradient descent; correcting each parameter using the learning rate and momentum scaling factor of the neural network; and repeatedly executing the training steps until the global error of the neural network is less than a preset error, and / or the maximum number of iterations is reached, to obtain the prediction model.

[0012] In one exemplary embodiment, executing the verification test script corresponding to the test strategy includes: when the test strategy is the fault injection test strategy and the delay mechanism corresponding to the secure access service is triggered, performing a target operation and sending a seed request corresponding to the security level to the electronic control unit, wherein the target operation includes at least one of the following: triggering bus shutdown, powering on / off the electronic control unit, resetting the electronic control unit, adjusting the voltage of the electronic control unit to an overvoltage state, and adjusting the voltage of the electronic control unit to an undervoltage state; if seed information corresponding to the seed request is received, determining that the second test result indicates that the risk level of the secure access service algorithm is high risk; if seed information corresponding to the seed request is not received, determining that the second test result indicates that the risk level of the secure access service algorithm is low risk, wherein the test result includes: the second test result.

[0013] In one exemplary embodiment, before performing the target operation, the method further includes: triggering a delay mechanism corresponding to the secure access service when an erroneous key of the first number is sent to the electronic control unit and the electronic control unit is powered on or reset; and triggering the delay mechanism corresponding to the secure access service when an erroneous key of the second number is sent to the electronic control unit, wherein the second number is greater than the first number.

[0014] In one exemplary embodiment, the verification test scripts corresponding to the test strategy are executed respectively, including: when the test strategy is the unauthorized access test strategy and the security access authentication fails, performing an operation outside the security access authentication authority on the electronic control unit and determining the first response information of the electronic control unit, wherein the security access authentication includes at least one of the following: extended security access authentication, refresh security access authentication, and anti-theft security access authentication; when the security access authentication passes, performing other operations outside the access authentication authority on the electronic control unit and determining the second response information of the electronic control unit; when the first response information and / or the second response information is a negative response, determining a third test result indicating that the risk level of the security access service algorithm is low risk; when the first response information and / or the second response information is a positive response, determining a third test result indicating that the risk level of the security access service algorithm is high risk, wherein the test result includes: the third test result.

[0015] According to another embodiment of this application, a risk level determination device is provided, comprising: a determination module for determining the security level of an electronic control unit of a vehicle under test; a generation module for generating corresponding verification test scripts according to the security level and multiple test strategies, wherein the multiple test strategies include: a seed randomness verification test strategy, a fault injection test strategy, and an unauthorized access test strategy; and an execution module for executing the verification test scripts corresponding to the test strategies respectively, and determining the risk level of the secure access service algorithm of the electronic control unit based on the test results.

[0016] According to yet another embodiment of this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, and the computer program is configured to perform the steps in any of the above method embodiments when it is run.

[0017] According to yet another embodiment of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0018] According to yet another embodiment of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0019] This application determines the security level of the electronic control unit (ECU) of the vehicle under test; generates corresponding verification test scripts based on the security level and multiple test strategies, including a seed randomness verification test strategy, a fault injection test strategy, and an unauthorized access test strategy; executes the verification test scripts corresponding to the test strategies, and determines the risk level of the ECU's secure access service algorithm based on the test results. In other words, this application embodiment comprehensively utilizes seed randomness verification, fault injection, and unauthorized access test strategies to conduct a multi-dimensional risk assessment of the vehicle ECU's secure access service algorithm, effectively improving the comprehensiveness and accuracy of the test. Seed randomness verification, fault injection, and unauthorized access test strategies can verify the robustness of the algorithm under abnormal conditions and the effectiveness of access control, ensuring the secure operation of the ECU in complex environments. Therefore, it can solve the problem of insufficient verification of the security of the vehicle's ECU's secure access service, effectively preventing unauthorized access and potential attacks. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a hardware structure block diagram of a computer device for a method of determining risk level according to an embodiment of this application;

[0023] Figure 2 This is a flowchart of a method for determining risk levels according to an embodiment of this application;

[0024] Figure 3 This is a schematic diagram of a prediction model according to an embodiment of this application;

[0025] Figure 4 This is a structural block diagram of a risk level determination device according to an embodiment of this application. Detailed Implementation

[0026] The embodiments of this application will be described in detail below with reference to the accompanying drawings and examples.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0028] The methods and embodiments provided in this application can be executed in a computer device or similar computing device. Taking running on a computer device as an example, Figure 1 This is a hardware structure block diagram of a computer device for a risk level determination method according to an embodiment of this application. For example... Figure 1 As shown, a computer device may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The computer device may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the computer device described above. For example, the computer device may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0029] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the risk level determination method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thus implementing the aforementioned method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to computer devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0030] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider for the computer equipment. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0031] This embodiment provides a method for determining risk level. Figure 2 This is a flowchart of a risk level determination method according to an embodiment of this application, applied to the aforementioned computer equipment, such as... Figure 2 As shown, the process includes the following steps:

[0032] Step S202: Determine the safety level of the electronic control unit of the vehicle under test;

[0033] Step S204: Generate corresponding verification test scripts according to the security level and multiple test strategies, wherein the multiple test strategies include: seed randomness verification test strategy, fault injection test strategy, and privilege escalation test strategy;

[0034] It should be noted that the seed randomness verification test strategy evaluates the security of the ECU seed generation mechanism by requesting a large number of seeds and using a machine learning model (such as a backpropagation neural network) to make predictions. If the seed predicted by the algorithm has a high overlap with the actual generated seed, it indicates that the seed generation mechanism may not be secure enough and is easily cracked or predicted.

[0035] The fault injection test strategy simulates various fault scenarios (such as power failure, reset, abnormal voltage, etc.) to test whether the ECU's secure access mechanism can respond correctly under these conditions, preventing attackers from using abnormal responses of the ECU to bypass secure access.

[0036] The unauthorized access test strategy attempts to perform operations beyond the ECU's authorized permissions in both unauthorized and authorized states. It tests whether the ECU can correctly identify and reject these unauthorized operations in order to evaluate the effectiveness of its access control mechanism.

[0037] Step S206: Execute the verification test scripts corresponding to the test strategies respectively, and determine the risk level of the secure access service algorithm of the electronic control unit based on the test results.

[0038] It should be noted that for each testing strategy, the computer device will execute the corresponding verification test script, send a test request to the ECU, and record the ECU's response. Based on the ECU's response, the computer device can analyze and determine the risk level of the secure access service algorithm. For example, if the repetition rate between the predicted seed and the actual seed exceeds a preset threshold in seed randomness verification, the ECU's secure access service algorithm will be marked as high-risk. Similarly, if the ECU fails to correctly implement the delay mechanism in fault injection testing, or if the ECU gives a positive response to unauthorized operations in privilege escalation testing, these tests will also reveal corresponding security vulnerabilities, thereby determining that the ECU's secure access service is at risk.

[0039] Through the above steps, the security level of the electronic control unit (ECU) of the vehicle under test is determined. Based on the security level and multiple testing strategies, corresponding verification test scripts are generated. These multiple testing strategies include: a seed randomness verification test strategy, a fault injection test strategy, and an unauthorized access test strategy. The verification test scripts corresponding to each test strategy are executed, and the risk level of the ECU's secure access service algorithm is determined based on the test results. In this embodiment, by comprehensively utilizing seed randomness verification, fault injection, and unauthorized access test strategies, a multi-dimensional risk assessment of the vehicle's ECU's secure access service algorithm is performed, effectively improving the comprehensiveness and accuracy of the test. Seed randomness verification, fault injection, and unauthorized access test strategies can verify the robustness of the algorithm under abnormal conditions and the effectiveness of access control, ensuring the secure operation of the ECU in complex environments. Therefore, the problem of insufficient verification of the security of the vehicle's ECU's secure access service can be solved, effectively preventing unauthorized access and potential attacks.

[0040] Optionally, to better understand step S202 above, step S202 can be implemented in the following way: determining the security level of the electronic control unit of the vehicle under test includes: switching the session mode of the electronic control unit to extended session mode and sending an anti-theft security level request to the electronic control unit; upon receiving an anti-theft security level response corresponding to the anti-theft security level request sent by the electronic control unit, determining the security level of the electronic control unit to be an anti-theft security level; switching the session mode of the electronic control unit to extended session mode and sending an extended security level request to the electronic control unit; upon receiving an extended security level response corresponding to the extended security level request sent by the electronic control unit, determining the security level of the electronic control unit to be an extended security level; switching the session mode of the electronic control unit to refresh session mode and sending a refresh security level request to the electronic control unit; upon receiving a refresh security level response corresponding to the refresh security level request sent by the electronic control unit, determining the security level of the electronic control unit to be a refresh security level.

[0041] This application specifies how to determine the security level of the electronic control unit (ECU) of a vehicle under test, mainly involving the detection of three security levels: anti-theft security level, extended security level, and refresh security level. Specifically:

[0042] When determining the anti-theft security level, the detection system first establishes a connection with the ECU under test and switches its session mode to Extended Session. Then, the detection system sends a Security Access Request for Theft System (SAFS) to the ECU. Upon receiving the request, if the ECU supports the anti-theft security level service, it will reply with an anti-theft security level response, typically containing a seed for subsequent security authentication processes.

[0043] If the ECU does indeed send an anti-theft security level response, then the detection system can determine that the ECU's security level includes at least the anti-theft security level.

[0044] When determining the extended safety level, the detection system sends an Extended Safety Access Request (ESSOR) to the ECU. If the ECU supports this safety service, it will respond with the corresponding Extended Safety Level response. Upon receiving the Extended Safety Level response, the detection system can confirm that the ECU supports the Extended Safety Level.

[0045] When determining the security level to be updated, the detection system switches the ECU's session mode to Programming Session mode. A Security Access Request for Programming System (SAP) is sent to the ECU. If the ECU supports the security level update, it will respond with a Security Level Update Response. The fact that the ECU sends a Security Level Update Response indicates that it not only supports standard diagnostics and extended security services, but also supports the security level update.

[0046] It should be noted that the security level of an ECU can include one or more of the following: anti-theft security level, extended security level, and flashing security level.

[0047] When multiple security levels are involved, corresponding verification test scripts need to be generated separately according to different security levels and testing strategies.

[0048] Through the above steps, the detection system can systematically and comprehensively determine the security levels supported by the ECU, providing a foundation for subsequent security assessments and vulnerability detection. Each security level is detected by sending a specific service request and observing the ECU's response, ensuring an accurate assessment of the ECU's security functions.

[0049] Optionally, this application provides an implementation of a verification test script corresponding to a "seed randomness verification test strategy," comprising: sending a seed request corresponding to the security level to the electronic control unit; dividing the seed information corresponding to the seed request sent by the electronic control unit to generate a training set and a verification set; training a neural network using the seed information in the training set to obtain a prediction model; predicting the seed information in the verification set using the prediction model to obtain first predicted seed information; and comparing the seed information in the verification set with the first predicted seed information to obtain a first test result, wherein the test result includes: the first test result.

[0050] In this embodiment, firstly, based on the security level supported by the ECU, the test system sends a seed request corresponding to that security level to the ECU. It should be noted that, for the purpose of training and validating the machine learning model, the test system sends multiple seed requests (e.g., 100,000) to the ECU, therefore the number of seed requests received is also multiple.

[0051] The seed information received from the ECU is divided into a training set and a validation set. Assuming there are 100,000 seed information samples, 90,000 are used to train the model, and the remaining 10,000 serve as the validation set. The neural network is then trained using the seed information from the training set. In this embodiment, a backpropagation (BP) neural network is used, adjusting weights and biases through a backpropagation algorithm to minimize the error between the predicted and actual values.

[0052] After the model is trained, the prediction model is used to predict seed information in the validation set, generating the first prediction seed information. Then, these prediction seeds are compared with the actual seed information in the validation set to evaluate the safety of the algorithm.

[0053] The embodiments of this application can effectively evaluate the security strength of the seed generation algorithm in the ECU secure access service, provide data support for the security protection of the ECU, and thus help vehicle manufacturers and security researchers discover and fix potential security vulnerabilities, thereby enhancing the security of the vehicle system.

[0054] Optionally, the seed information in the validation set is compared with the first predicted seed information to obtain a first test result. The method further includes: determining the number of targets that are the same in the seed information in the validation set and the first predicted seed information, and determining the total number of seed information in the validation set; determining the target proportion based on the number of targets and the total number; if the target proportion is greater than a first preset proportion, determining that the first test result indicates that the risk level of the secure access service algorithm is high risk; if the target proportion is greater than a second preset proportion, determining that the first test result indicates that the risk level of the secure access service algorithm is medium risk; if the target proportion is less than or equal to the second preset proportion, determining that the first test result indicates that the risk level of the secure access service algorithm is low risk, wherein the first preset proportion is greater than the second preset proportion.

[0055] This application's embodiments define how to assess the risk level of a seed generation algorithm in a secure access service by comparing predicted seed information with actual seed information. Specifically:

[0056] The seed information in the validation set is compared with the seed information of the first prediction, and the number of identical seed information is counted, i.e., the number of targets. The number of targets divided by the total number yields the target proportion, which is an indicator of the model's prediction accuracy. The risk level of the algorithm is determined by comparing the target proportion with a preset proportion threshold.

[0057] Specifically: If the target percentage is greater than the first preset percentage (e.g., 95%), the algorithm is at high risk of being predicted, and the risk level is high risk.

[0058] If the target percentage is greater than the second preset percentage (e.g., 75%) but less than the first preset percentage, the algorithm is at risk of being moderately predicted, with a risk level of moderate.

[0059] If the target percentage is less than or equal to the second preset percentage (e.g., 75%), the algorithm has good randomness, is not easy to predict, and has a low risk level.

[0060] For example: Suppose there are 100,000 seed information samples, of which 90,000 are used to train the model, and the remaining 10,000 are used as the validation set. The first preset percentage is set to 95%, and the second preset percentage is set to 75%. After training, the model predicts the 10,000 seed information samples in the validation set. Let's say the model predicts 9,000 seed information samples that perfectly match the actual seed information in the validation set (i.e., the target number is 9,000). Target percentage = target number / total number of validation samples = 9,000 / 10,000 = 90%. 90% is greater than the second preset percentage of 75%, but less than the first preset percentage of 95%. Therefore, according to the above rules, the risk level is moderate.

[0061] Optionally, training the neural network using seed information from the training set to obtain a prediction model includes: initializing the parameters of the neural network, wherein the parameters include: first connection weights between the input layer and the hidden layer of the neural network, second connection weights between the hidden layer and the output layer, first biases of neurons in the hidden layer, and second biases of neurons in the output layer; performing training steps: inputting the state parameters of the electronic control unit into the neural network, and outputting second prediction seed information through the output layer of the neural network; determining the global error of the neural network based on the second prediction seed information and the seed information of the validation set; calculating the gradient of each parameter using gradient descent; correcting each parameter using the learning rate and momentum scaling factor of the neural network; and repeatedly executing the training steps until the global error of the neural network is less than a preset error, and / or the maximum number of iterations is reached, to obtain the prediction model.

[0062] The embodiments of this application define the process of training the prediction model, specifically:

[0063] 1. Initialize the parameters of the neural network;

[0064] The parameters include: the first connection weight between the input layer and the hidden layer: this is the connection strength from the input data to the first hidden layer in the neural network. The initial value is usually set randomly so that the network can explore different solutions.

[0065] The second connection weight between the hidden layer and the output layer is the connection strength from the hidden layer to the output layer.

[0066] The first bias of neurons in a hidden layer: Bias is a parameter in a neural network used to adjust the activation function of neurons, enabling the network to better fit the data. The bias of a hidden layer is crucial to its internal computation.

[0067] The second bias of the neurons in the output layer: The bias of the output layer is also used to adjust the output results to ensure that the seed information predicted by the network is as close as possible to the actual seed.

[0068] 2. Perform the training steps:

[0069] The training process is based on seed information in the training set, and the parameters are optimized through forward and backward propagation of the neural network. The specific steps are as follows:

[0070] 1) Input ECU status parameters into the neural network: Status parameters such as time, number of seed requests, vehicle mileage, etc. are used to train the model to identify the relationship between these parameters and seed information.

[0071] 2) The neural network outputs the second prediction seed information: Based on the current parameter settings, the network attempts to predict the next seed information.

[0072] 3) Determine the global error: Compare the predicted seed information with the actual seed information in the validation set and calculate the error. The global error is the average error between all predictions and the actual seeds, and is usually measured using mean squared error (MSE) or other loss functions.

[0073] 4) Calculate the gradient of each parameter: The gradient is the partial derivative of the error function with respect to each parameter, which is used to guide the direction of parameter adjustment.

[0074] 5) Parameter adjustment: The parameters are updated by the learning rate and momentum scaling factor. The learning rate controls the magnitude of the parameter update, while the momentum scaling factor helps to speed up convergence and avoid local minima.

[0075] 3. Repeat the training process until convergence or the maximum number of iterations is reached.

[0076] The model is considered to have completed training when the global error falls below this threshold. Training will also stop if the model has iterated a specified maximum number of times before reaching the minimum preset error. This avoids getting stuck in an infinite loop or overfitting.

[0077] Through the embodiments of this application, the neural network will predict seed information. If the prediction accuracy is very high, it may mean that the seed generation algorithm is predictable, that is, the algorithm is not strong enough and there is a risk of being cracked.

[0078] Optionally, this application provides an implementation of a verification test script corresponding to a "fault injection test strategy," comprising: when the delay mechanism corresponding to the secure access service is triggered, executing a target operation and sending a seed request corresponding to the security level to the electronic control unit, wherein the target operation includes at least one of the following: triggering bus shutdown, powering on / off the electronic control unit, resetting the electronic control unit, adjusting the voltage of the electronic control unit to an overvoltage state, and adjusting the voltage of the electronic control unit to an undervoltage state; when seed information corresponding to the seed request is received, determining that the second test result indicates that the risk level of the secure access service algorithm is high risk; when seed information corresponding to the seed request is not received, determining that the second test result indicates that the risk level of the secure access service algorithm is low risk, wherein the test result includes: the second test result.

[0079] This application embodiment verifies the robustness of the ECU secure access service delay mechanism. The delay mechanism is part of the ECU security strategy, designed to prevent brute-force attacks and rapid retry attacks. By introducing a fixed delay, it limits the frequency of secure access, thereby increasing the cost of attempts for attackers.

[0080] It should be noted that the target operations include triggering bus OFF, powering on / off the electronic control unit (ECU), resetting, and adjusting the ECU voltage to an overvoltage or undervoltage state. These operations are all attempts to interfere with the ECU during the time-delay mechanism's active period to observe whether the time-delay mechanism can effectively resist these interferences.

[0081] For example: Suppose that the ECU's secure access service triggers a 10-second delay mechanism after detecting two consecutive erroneous key attempts, meaning that the ECU will not respond to any new secure access requests for the next 10 seconds.

[0082] Objective 1: Five seconds after the delay mechanism is activated, attempt to shut down the ECU bus, then immediately attempt to reconnect and send a seed request. If the ECU responds immediately and sends a seed, this indicates that shutting down the bus did not effectively prevent the safety delay mechanism from executing, posing a high risk.

[0083] Target Operation 2: Perform a rapid reset of the ECU 7 seconds after the delay mechanism is activated. Immediately after the reset, attempt to send a seed request. If the ECU responds with a seed message within the delay period, this indicates that the reset operation may have bypassed the delay mechanism, also indicating a high risk.

[0084] Target Operation 3: Eight seconds after the delay mechanism is activated, adjust the ECU's supply voltage to an overvoltage state, and then adjust it back to the normal voltage. Attempt to send a seed request during this period. If the ECU responds to the request during the voltage anomaly, it indicates that the ECU's protection against voltage instability is insufficient, and the delay mechanism is at risk of being bypassed.

[0085] The test results of the fault injection test strategy are divided into two levels: high risk and low risk, depending on whether the ECU responds to the seed request during the delay mechanism.

[0086] If the ECU provides new seed information after any target operation, violating the delay mechanism rules, this indicates a significant flaw in the ECU's secure access service. An attacker could potentially exploit these operations to bypass security mechanisms and gain unauthorized access to and modification of the ECU. For example, if the ECU responds to the seed request immediately after executing target operation 1, this indicates a high risk.

[0087] If the ECU does not respond to the seed request after the target operation is executed, meaning it adheres to the delay mechanism, this indicates that the ECU maintained the integrity of the secure access service in the face of these specific disturbances, and the test result indicates low risk. For example, after executing target operation 2, even though the ECU underwent a reset, it still did not respond to the seed information within the 10-second delay, which would indicate low risk.

[0088] In this way, the robustness and effectiveness of the ECU's secure access service algorithm in the face of various potential attacks can be systematically evaluated, its risk level can be determined, and thus guide subsequent security strategy optimization and hardening measures.

[0089] Optionally, before performing the target operation, the method further includes: triggering a delay mechanism corresponding to the secure access service when an incorrect key is sent to the electronic control unit for the first time and the electronic control unit is powered on or reset; and triggering the delay mechanism corresponding to the secure access service when an incorrect key is sent to the electronic control unit for the second time, wherein the second number is greater than the first number.

[0090] This application provides two trigger delay mechanisms:

[0091] 1) When a host computer (e.g., a diagnostic tool or update device) sends an incorrect key to the ECU, the ECU detects a security authentication failure. Upon detecting the incorrect key, if the ECU is immediately powered on or reset, it triggers a delay mechanism for the secure access service. This means that during the delay period, even if the ECU restarts, it will not immediately respond to new seed requests, but will wait for a period of time (e.g., 10 seconds) before restarting the seed and key exchange process for the secure access service.

[0092] 2) If the host computer attempts to send an incorrect key and the number of errors reaches the set "second number" (which is usually greater than the "first number," for example, the first number may be 1 time and the second number may be 3 times), then the ECU will trigger the delay mechanism.

[0093] Optionally, this application provides an implementation of a verification test script corresponding to an "unauthorized access testing strategy," comprising: when the testing strategy is the unauthorized access testing strategy and the security access authentication fails, performing an operation outside the security access authentication authority on the electronic control unit, and determining the first response information of the electronic control unit, wherein the security access authentication includes at least one of the following: extended security access authentication, refresh security access authentication, and anti-theft security access authentication; when the security access authentication passes, performing other operations outside the access authentication authority on the electronic control unit, and determining the second response information of the electronic control unit; when the first response information and / or the second response information is a negative response, determining a third test result indicating that the risk level of the security access service algorithm is low risk; when the first response information and / or the second response information is a positive response, determining a third test result indicating that the risk level of the security access service algorithm is high risk, wherein the test result includes: the third test result.

[0094] The embodiments of this application are divided into two cases: "unauthorized access test" when the secure access authentication fails and "unauthorized access test" after the secure access authentication is passed.

[0095] Performing operations on an ECU without secure access authentication typically means attempting to access or manipulate undisclosed or unauthorized functions or data within the ECU.

[0096] For example:

[0097] An attempt is made to read sensitive information from the ECU, such as the vehicle's driving records or the ECU's internal configuration, information that is typically not allowed to be read without secure access authentication. In this case, the ECU should respond with a negative response, rejecting the operation. The negative response can be a fault code (DTC) or a specific error message indicating that the requested operation is unauthorized or not permitted by the current session mode.

[0098] If the ECU responds negatively to all unauthorized operations without passing secure access authentication, this indicates that the algorithm is effective in preventing unauthorized access. Therefore, the test results in this case indicate a low-risk level for the algorithm. If the ECU responds positively to unauthorized operations without passing secure access authentication, thus allowing unauthorized access, this indicates a significant vulnerability in the algorithm. The test results in this case indicate a high-risk level for the algorithm.

[0099] Passing secure access authentication, such as extended secure access authentication, refresh secure access authentication, or anti-theft secure access authentication, typically means access to more advanced functions of the ECU. However, even after authentication, access limits still exist, meaning there are specific permission controls. For example:

[0100] After successfully refreshing the security access authentication, an attempt is made to perform operations that can only be performed with anti-theft security access authentication, such as modifying the vehicle's anti-theft system settings. Even if a certain security access authentication has been passed, the ECU should still respond with a negative response to the operation outside its authorized scope and refuse to execute it.

[0101] If the ECU, after passing secure access authentication, responds negatively to all other operations outside its authenticated permissions, this indicates that the algorithm is sound in terms of access control, and the test result indicates a low-risk level. If the ECU, after passing a certain secure access authentication, responds positively to operations outside its authorized permissions, i.e., allows operations exceeding its current authentication permissions, this indicates a vulnerability in the algorithm's access control, and the test result indicates a high-risk level.

[0102] The effectiveness and integrity of the secure access service algorithm can be evaluated through these two tests. If the algorithm can correctly identify unauthorized operations and respond with a negative response when appropriate, then it is secure in preventing unauthorized access and execution of unauthorized operations. Conversely, if the ECU responds with a positive response in all cases, this may indicate a serious vulnerability in the security mechanism, requiring further strengthening and patching.

[0103] To better understand the process of determining the risk level described above, the implementation flow of the method for determining the risk level will be further explained below with reference to optional embodiments, but this is not intended to limit the technical solution of the embodiments of this application.

[0104] This embodiment provides a method for determining risk level, which includes the following steps:

[0105] S11: Establish a diagnostic connection with the tested vehicle ECU and determine the safety level supported by the ECU.

[0106] Specifically:

[0107] Switch the current session mode to switch extended session, and send an extended security level request and an anti-theft security level request to the ECU to check whether the ECU supports the corresponding security level.

[0108] Switch the current session mode to switch refresh session, send a request to the ECU to refresh the security level, and check whether the ECU supports the requested security level.

[0109] S12: Based on the detected safety level supported by the ECU, generate a verification test script according to the following test strategy, execute the test script, and send a verification message to the ECU.

[0110] Specifically, the testing strategy includes:

[0111] Strategy 1: Seed randomness verification test:

[0112] For different safety levels, a seed request is sent to the ECU (note that in order to facilitate the training of the neural network, a sufficiently large number of samples is required, so the number of samples is 100,000 times), and the seed information fed back by the ECU is extracted.

[0113] Leveraging the strong nonlinear fitting ability of BP neural networks, the predictability of the seed generation algorithm was verified. The extracted seed information data was divided into 10 groups. An attempt was made to fit the data to 9 groups using a BP neural network curve, and then seed predictions were compared with the 10th group of data. The repetition rate between the predicted and actual results was examined to evaluate the algorithm's safety.

[0114] BP prediction model training, the neural network structure of the prediction model is as follows Figure 3 As shown, the steps are as follows:

[0115] S121: Initialize parameters:

[0116] In the prediction model, X is the input, x = (x1, x2, ..., x...). m H represents the hidden layer output H = (H1, H, ..., H) p Y is the output layer output y = (y1, y2, ..., y3) s O represents the desired output O = (O1, O2, ..., O2). s The connection weights between the input layer and the hidden layer are ω. ij The connection weights between the hidden layer and the output layer are ω jk The bias of each neuron in the hidden layer is a. j j = (1,2,…,p), and the bias of the output layer neurons is b. k(k = 1, 2, ... s). Here, m is 3 (the input state parameters are time, number of seed requests, and vehicle mileage), s is 1, and according to Kolmogrov's theorem, the number of hidden layer neurons p is 7.

[0117] S122: Parameter Update:

[0118] Hidden layer output calculation method:

[0119]

[0120] Output layer output calculation method:

[0121]

[0122] Where f1(*) is the activation function of the hidden layer. f2(*) is the activation function of the output layer.

[0123] S123: Update weights and biases:

[0124] Based on the error between the predicted output and the expected output, the error is backpropagated to the input layer, and the weights and biases are corrected according to the gradient descent strategy:

[0125]

[0126] Where η is the network learning rate, δ k and δ j denoted as the error gradients of the output layer and the hidden layer, respectively; n is the number of network iterations; and E is the error.

[0127] S124: Determine if training is complete:

[0128] Once the parameter updates have been iterated until the error converges to within the specified error ε or is greater than the specified number of training iterations (the first 9 sets of data), it is considered that the current optimal weights and biases have been obtained, and training is stopped.

[0129] The last set of data is input into the network, the predicted results are compared with the actual results, and the prediction rate is evaluated:

[0130]

[0131] If the prediction rate exceeds the threshold, it is considered to be at risk (here, threshold 1 is set to 95%, threshold 2 is set to 75%; if it exceeds 75%, the algorithm is considered to have moderate risk, and if it exceeds 95%, the algorithm is considered to have high risk).

[0132] Strategy 2: Fault Injection Testing

[0133] The secure access service delay mechanism is triggered in the following situations:

[0134] Case 1: After requesting a seed and sending an incorrect key once, power on or reset the device to trigger a delay mechanism;

[0135] Scenario 2: After requesting the seed and sending the wrong key twice, the delay mechanism is triggered;

[0136] Within the delay time (10s), trigger BUS-OFF, ECU power on / off, ECU reset, adjust ECU voltage to overvoltage and undervoltage states, attempt to request a seed, and view ECU feedback information.

[0137] Check if the ECU responds with an affirmative response, i.e., replies with new seed information, to determine if the delay mechanism has been bypassed. If an affirmative response is received from the ECU to the requested seed, it is determined that the delay mechanism cannot be maintained and there is a threat.

[0138] Strategy 3: Unauthorized Access Testing

[0139] By importing the ECU security access permission configuration list, perform the following operations:

[0140] Operation 1: Before passing the security access authentication, attempt to perform read operations (i.e., initiate 22 service read), write operations (i.e., initiate 2E service write), 34 service, 36 service, etc., outside of the authorized permissions of the ECU, and record the ECU's feedback.

[0141] Operation 2: After passing the extended / refresh / anti-theft security access authentication, attempt to perform read operations (i.e., initiate 22 service read), write operations (i.e., initiate 2E service write), 34 service, 36 service, etc., outside of authorized permissions to the ECU, and record the ECU's feedback.

[0142] Check if the ECU responds with an affirmative response. If the ECU responds with an affirmative response to an operation outside its authority, then a threat is identified.

[0143] S13: Generate a security test report for the secure access service.

[0144] In this application embodiment, a security detection system or device for vehicle ECU secure access service is used to effectively detect defects in the MCU secure access service function, thereby improving the security of vehicle ECUs.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0146] This embodiment also provides a risk level determination device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0147] Figure 4 This is a structural block diagram of a risk level determination device according to an embodiment of this application, such as... Figure 4 As shown, the device includes:

[0148] Module 42 is used to determine the safety level of the electronic control unit of the vehicle under test;

[0149] The generation module 44 is used to generate corresponding verification test scripts according to the security level and multiple test strategies, wherein the multiple test strategies include: seed randomness verification test strategy, fault injection test strategy, and privilege escalation test strategy.

[0150] The execution module 46 is used to execute the verification test scripts corresponding to the test strategies respectively, and determine the risk level of the secure access service algorithm of the electronic control unit based on the test results. Through the above device, the security level of the electronic control unit of the vehicle under test is determined; corresponding verification test scripts are generated according to the security level and multiple test strategies, wherein the multiple test strategies include: seed randomness verification test strategy, fault injection test strategy, and unauthorized access test strategy; the verification test scripts corresponding to the test strategies are executed respectively, and the risk level of the secure access service algorithm of the electronic control unit is determined based on the test results. That is, in this embodiment, by comprehensively using seed randomness verification, fault injection, and unauthorized access test strategies, a multi-dimensional risk assessment of the secure access service algorithm of the vehicle's electronic control unit is performed, effectively improving the comprehensiveness and accuracy of the test. Seed randomness verification, fault injection, and unauthorized access test strategies can verify the robustness of the algorithm under abnormal conditions and the effectiveness of access control, ensuring the secure operation of the electronic control unit in complex environments. Therefore, it can solve the problem that the security of the secure access service of the vehicle's electronic control unit is not fully verified, effectively preventing unauthorized access and potential attacks.

[0151] In one exemplary embodiment, the determining module 42 is configured to: switch the session mode of the electronic control unit to an extended session mode and send an anti-theft security level request to the electronic control unit; upon receiving an anti-theft security level response corresponding to the anti-theft security level request sent by the electronic control unit, determine that the security level of the electronic control unit is an anti-theft security level; switch the session mode of the electronic control unit to an extended session mode and send an extended security level request to the electronic control unit; upon receiving an extended security level response corresponding to the extended security level request sent by the electronic control unit, determine that the security level of the electronic control unit is an extended security level; switch the session mode of the electronic control unit to a refresh session mode and send a refresh security level request to the electronic control unit; upon receiving a refresh security level response corresponding to the refresh security level request sent by the electronic control unit, determine that the security level of the electronic control unit is a refresh security level.

[0152] In an exemplary embodiment, the execution module 46 is configured to: send a seed request corresponding to the security level to the electronic control unit when the test strategy is a seed randomness verification test strategy; divide the seed information corresponding to the seed request sent by the electronic control unit to generate a training set and a validation set; train the neural network using the seed information in the training set to obtain a prediction model; predict the seed information in the validation set using the prediction model to obtain first predicted seed information; and compare the seed information in the validation set with the first predicted seed information to obtain a first test result, wherein the test result includes: the first test result.

[0153] In an exemplary embodiment, the execution module 46 is configured to determine the number of targets in the verification set that are identical to the first predicted seed information, and to determine the total number of seed information in the verification set; determine a target percentage based on the target number and the total number; if the target percentage is greater than a first preset percentage, determine that the risk level of the secure access service algorithm indicated by the first test result is high risk; if the target percentage is greater than a second preset percentage, determine that the risk level of the secure access service algorithm indicated by the first test result is medium risk; if the target percentage is less than or equal to the second preset percentage, determine that the risk level of the secure access service algorithm indicated by the first test result is low risk, wherein the first preset percentage is greater than the second preset percentage.

[0154] In an exemplary embodiment, execution module 46 is configured to initialize the parameters of the neural network, wherein the parameters include: first connection weights between the input layer and the hidden layer of the neural network, second connection weights between the hidden layer and the output layer, first biases of neurons in the hidden layer, and second biases of neurons in the output layer; and execute training steps: inputting the state parameters of the electronic control unit into the neural network, outputting second prediction seed information through the output layer of the neural network; determining the global error of the neural network based on the second prediction seed information and the seed information of the validation set; calculating the gradient of each parameter according to the gradient descent method; correcting each parameter through the learning rate and momentum scaling factor of the neural network; and repeatedly executing the training steps until the global error of the neural network is less than a preset error, and / or the maximum number of iterations is reached, so as to obtain the prediction model.

[0155] In an exemplary embodiment, the execution module 46 is configured to, when the test strategy is the fault injection test strategy and the delay mechanism corresponding to the secure access service is triggered, perform a target operation and send a seed request corresponding to the security level to the electronic control unit, wherein the target operation includes at least one of the following: triggering bus shutdown, powering on / off the electronic control unit, resetting the electronic control unit, adjusting the voltage of the electronic control unit to an overvoltage state, and adjusting the voltage of the electronic control unit to an undervoltage state; if seed information corresponding to the seed request is received, determine that the second test result indicates that the risk level of the secure access service algorithm is high risk; if seed information corresponding to the seed request is not received, determine that the second test result indicates that the risk level of the secure access service algorithm is low risk, wherein the test result includes: the second test result.

[0156] In an exemplary embodiment, the execution module 46 is configured to trigger a delay mechanism corresponding to the secure access service when the first incorrect key is sent to the electronic control unit and the electronic control unit is powered on or reset; and to trigger the delay mechanism corresponding to the secure access service when the second incorrect key is sent to the electronic control unit, wherein the second number is greater than the first number.

[0157] In an exemplary embodiment, the execution module 46 is configured to perform an operation outside the security access authentication authority on the electronic control unit when the test strategy is the unauthorized access test strategy and the security access authentication fails, and determine the first response information of the electronic control unit, wherein the security access authentication includes at least one of the following: extended security access authentication, refresh security access authentication, and anti-theft security access authentication; if the security access authentication is passed, perform other operations outside the access authentication authority on the electronic control unit, and determine the second response information of the electronic control unit; if the first response information and / or the second response information is a negative response, determine a third test result indicating that the risk level of the security access service algorithm is low risk; if the first response information and / or the second response information is a positive response, determine a third test result indicating that the risk level of the security access service algorithm is high risk, wherein the test result includes the third test result.

[0158] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0159] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when run.

[0160] Optionally, in this embodiment, the storage medium may be configured to store program code for performing the following steps:

[0161] S1, determine the safety level of the electronic control unit of the vehicle under test;

[0162] S2, Generate corresponding verification test scripts according to the security level and multiple test strategies, wherein the multiple test strategies include: seed randomness verification test strategy, fault injection test strategy, and privilege escalation test strategy;

[0163] S3, execute the verification test scripts corresponding to the test strategy respectively, and determine the risk level of the secure access service algorithm of the electronic control unit based on the test results.

[0164] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0165] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0166] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0167] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0168] S1, determine the safety level of the electronic control unit of the vehicle under test;

[0169] S2, Generate corresponding verification test scripts according to the security level and multiple test strategies, wherein the multiple test strategies include: seed randomness verification test strategy, fault injection test strategy, and privilege escalation test strategy;

[0170] S3, execute the verification test scripts corresponding to the test strategy respectively, and determine the risk level of the secure access service algorithm of the electronic control unit based on the test results.

[0171] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0172] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0173] Embodiments of this application also provide a computer program that includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps in any of the above method embodiments.

[0174] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0175] S1, determine the safety level of the electronic control unit of the vehicle under test;

[0176] S2, Generate corresponding verification test scripts according to the security level and multiple test strategies, wherein the multiple test strategies include: seed randomness verification test strategy, fault injection test strategy, and privilege escalation test strategy;

[0177] S3, execute the verification test scripts corresponding to the test strategy respectively, and determine the risk level of the secure access service algorithm of the electronic control unit based on the test results.

[0178] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0179] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0180] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for determining risk level, characterized in that, include: Determine the safety level of the electronic control unit of the vehicle under test; Based on the security level and multiple testing strategies, corresponding verification test scripts are generated respectively, wherein the multiple testing strategies include: seed randomness verification test strategy, fault injection test strategy, and privilege escalation test strategy; The verification test scripts corresponding to the test strategies are executed respectively, and the risk level of the secure access service algorithm of the electronic control unit is determined based on the test results.

2. The method according to claim 1, characterized in that, Determine the safety level of the electronic control unit of the vehicle under test, including: Switch the session mode of the electronic control unit to extended session mode and send an anti-theft security level request to the electronic control unit; upon receiving an anti-theft security level response corresponding to the anti-theft security level request sent by the electronic control unit, determine that the security level of the electronic control unit is an anti-theft security level; Switch the session mode of the electronic control unit to extended session mode and send an extended security level request to the electronic control unit; upon receiving an extended security level response corresponding to the extended security level request sent by the electronic control unit, determine that the security level of the electronic control unit is extended security level; Switch the session mode of the electronic control unit to refresh session mode and send a refresh security level request to the electronic control unit; upon receiving a refresh security level response corresponding to the refresh security level request sent by the electronic control unit, determine that the security level of the electronic control unit is refresh security level.

3. The method according to claim 1, characterized in that, Execute the verification test scripts corresponding to the test strategy, including: When the test strategy is a seed randomness verification test strategy, a seed request corresponding to the security level is sent to the electronic control unit; The seed information corresponding to the seed request sent by the electronic control unit is divided to generate a training set and a validation set; The neural network is trained using the seed information in the training set to obtain a prediction model; The seed information in the validation set is predicted using the prediction model to obtain the first predicted seed information; The seed information in the validation set is compared with the first predicted seed information to obtain a first test result, wherein the test result includes: the first test result.

4. The method according to claim 3, characterized in that, The method further includes comparing the seed information in the validation set with the first predicted seed information to obtain a first test result, and determining the number of targets that are the same in the seed information in the validation set and the first predicted seed information, and determining the total number of seed information in the validation set. The target percentage is determined based on the target quantity and the total quantity; If the target percentage is greater than the first preset percentage, the first test result indicates that the risk level of the secure access service algorithm is high risk; If the target percentage is greater than the second preset percentage, the first test result indicates that the risk level of the secure access service algorithm is medium risk. If the target percentage is less than or equal to the second preset percentage, the first test result indicates that the risk level of the secure access service algorithm is low risk, wherein the first preset percentage is greater than the second preset percentage.

5. The method according to claim 3, characterized in that, The neural network is trained using seed information from the training set to obtain a prediction model, including: Initialize the parameters of the neural network, wherein the parameters include: the first connection weights between the input layer and the hidden layer of the neural network, the second connection weights between the hidden layer and the output layer, the first bias of the neurons in the hidden layer, and the second bias of the neurons in the output layer; The training process involves: inputting the state parameters of the electronic control unit into the neural network; outputting second prediction seed information through the output layer of the neural network; determining the global error of the neural network based on the second prediction seed information and the seed information of the validation set; calculating the gradient of each parameter using the gradient descent method; and correcting each parameter using the learning rate and momentum scaling factor of the neural network. The training steps are repeated until the global error of the neural network is less than a preset error, and / or the maximum number of iterations is reached, in order to obtain the prediction model.

6. The method according to claim 1, characterized in that, Execute the verification test scripts corresponding to the test strategy, including: When the test strategy is the fault injection test strategy and the delay mechanism corresponding to the secure access service is triggered, the target operation is executed, and a seed request corresponding to the security level is sent to the electronic control unit, wherein the target operation includes at least one of the following: Trigger bus shutdown, power-on / off of electronic control unit, reset of electronic control unit, adjustment of electronic control unit voltage to overvoltage state, adjustment of electronic control unit voltage to undervoltage state; Upon receiving the seed information corresponding to the seed request, the second test result indicates that the risk level of the secure access service algorithm is high risk; If no seed information corresponding to the seed request is received, the second test result indicates that the risk level of the secure access service algorithm is low risk, wherein the test result includes: the second test result.

7. The method according to claim 6, characterized in that, Before performing the target operation, the method further includes: If an incorrect key is sent to the electronic control unit for the first time, and the electronic control unit is powered on or reset, the delay mechanism corresponding to the secure access service is triggered. If an incorrect key is sent a second time to the electronic control unit, the delay mechanism corresponding to the secure access service is triggered, wherein the second number of times is greater than the first number of times.

8. The method according to claim 1, characterized in that, Execute the verification test scripts corresponding to the test strategy, including: If the test strategy is the unauthorized access test strategy and the security access authentication fails, an operation outside the security access authentication authority is performed on the electronic control unit, and the first response information of the electronic control unit is determined. The security access authentication includes at least one of the following: extended security access authentication, refresh security access authentication, and anti-theft security access authentication. If the security access authentication passes, other operations outside the access authentication authority are performed on the electronic control unit, and the second response information of the electronic control unit is determined. If the first response information and / or the second response information are negative responses, the third test result indicates that the risk level of the secure access service algorithm is low risk; if the first response information and / or the second response information are positive responses, the third test result indicates that the risk level of the secure access service algorithm is high risk, wherein the test result includes the third test result.

9. A device for determining risk level, characterized in that, include: The determination module is used to determine the safety level of the electronic control unit of the vehicle under test; The generation module is used to generate corresponding verification test scripts based on the security level and multiple test strategies, wherein the multiple test strategies include: a seed randomness verification test strategy, Fault injection testing strategy, privilege escalation testing strategy; The execution module is used to execute the verification test scripts corresponding to the test strategy respectively, and determine the risk level of the secure access service algorithm of the electronic control unit based on the test results.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed, performs the method of any one of claims 1 to 8.

11. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method of any one of claims 1 to 8 through the computer program.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 8.

Images