A sensor vulnerability detection method and system based on physical signal fuzzing

Abstract

The application discloses a sensor vulnerability detection method and system based on physical signal fuzzing, and relates to the field of Internet of Things security. The application constructs a physical signal element set as an initial seed, uses a fuzzing method to mutate the seed, generates a mutated signal element sequence as a test case, synthesizes corresponding physical test signals through a signal generation hardware device according to signal parameters in the test case, and sends the signals to a test sensor and an Internet of Things device system, obtains sensor readings and performs feature discretization, calculates fitness according to a discrete feature vector, and feeds back to the seed sequence generation, and performs anomaly detection based on the discrete vector. The application can generate a signal element sequence that can cause the original sensor reading to be wrong by setting a specific data mutation mode, which is used for detecting possible anomalies and attacks suffered by the sensor in a real working condition, and helps to improve the sensor performance and device reliability.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to a method and system for automated vulnerability discovery and security detection of sensors and IoT devices. Background Technology

[0002] Sensors are devices that convert information from the physical world into electrical signals. They are crucial in cyber-physical systems and are widely used in intelligent applications. Over the past decade, security researchers have discovered various sensor vulnerabilities that enable attacks based on malicious physical signals such as sound, electromagnetic waves, and lasers. These attacks can interfere with or spoof sensor measurements, causing other sensor-dependent systems to malfunction, misoperate, or even be damaged.

[0003] The ability to detect existing and emerging vulnerabilities in sensors could make trillions of sensors more reliable. However, compared to the achievements of academia and industry in software and system vulnerability detection, the discovery and detection of sensor vulnerabilities is still in its early stages. Sensor vulnerabilities stem from hardware defects and can be exploited by physical signals. For example, research shows that signals outside the design input signal type or range of a microphone, such as modulated lasers, electromagnetic waves, or ultrasound, can be converted into human voices that are audible to machines but not to the human ear due to unexpected photoacoustic effects, electromagnetic coupling, and amplifier nonlinearities. For security practitioners, it is also difficult to discover these vulnerabilities by analyzing sensor firmware, circuits, or other design documents according to existing security procedures. Furthermore, existing sensor vulnerability research is very time-consuming and heavily reliant on expert knowledge. In addition, due to differences in hardware structure and operating principles, existing methods are difficult to generalize to other types of sensors. Currently, there is no automated, expert-free, and universal method to assist in the detection of sensor vulnerabilities, hindering sensor security research and industrial security testing. The fuzzing framework tool designed in this invention is the first fuzzing method based on physical signals, capable of automatically detecting existing and potential new sensor vulnerabilities. The basic strategy is to generate various unexpected physical signals as fuzzy test inputs to the sensor under test, and then monitor anomalies in the output to reveal vulnerabilities.

[0004] However, due to the differences in sensor software systems, fuzz testing of sensors presents several unprecedented challenges. Current technologies mainly face the following two major difficulties: Firstly, how to efficiently generate physical fuzzy test signals. Due to the vulnerability of sensors, they may react to any unexpected physical stimuli. Therefore, physical signals do not have the same limitations as digital inputs, such as length, form, and mode. Furthermore, the distortion input space of physical signals is continuous and infinite.

[0005] Secondly, how to detect vulnerabilities with limited feedback information. Traditional feedback-guided fuzzing methods rely on code coverage or state machine-driven test case generation and monitor resource leaks or crashes to reveal vulnerabilities. However, this information is unavailable in sensors, which are often treated as black boxes. Aside from input signals and output measurement readings, it is difficult to access information about the sensor's runtime.

[0006] Therefore, the current field of sensor vulnerability research still lacks an automated, efficient, and hardware-software integrated sensor vulnerability detection technology. Summary of the Invention

[0007] In view of this, the present invention provides a sensor vulnerability detection method and system based on physical signal fuzzy testing. It combines an integrated hardware and software platform for signal transmission and sensor response data communication, utilizes fuzzy testing to efficiently generate physical test signals, and, based on the extraction of sensor and IoT device responses, uses feature discretization methods and vulnerability detectors to realize the discovery and detection of sensor vulnerabilities.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention proposes a sensor vulnerability detection method based on physical signal fuzzy testing, comprising the following steps: S1: Construct a set of signal construction elements for a physical signal. The set of signal construction elements is represented by a quadruple, including frequency, phase, amplitude, and modulation scheme. Initialize a random seed sequence based on the set of signal construction elements. Each seed contains a set of specific signal parameter values ​​and is associated with a set of mutation probabilities. S2: Based on the fuzzy testing algorithm, the seed is mutated to generate a sequence of mutated signal elements as test cases; S3: Based on the signal parameters in the test case, synthesize the corresponding physical test signal through the signal generation hardware device, and transmit the physical test signal to the sensor under test; S4: Acquire the response signal of the sensor under test under the action of the physical test signal, extract the characteristics of the response signal and convert it into a discrete feature vector; S5: Calculate the fitness based on the discrete feature vector corresponding to the response signal, and adjust the parameters of the fuzzy testing algorithm based on the fitness; at the same time, perform anomaly detection and recording based on the discrete feature vectors of the response signal and the normal reading signal of the sensor, and update the seed sequence based on the anomaly detection results; S6: Repeat steps S2 to S5 until the preset test termination condition is met.

[0009] Furthermore, the physical signals described by the signal construction element set include at least one of acoustic signals, optical signals, electrical signals, magnetic signals, and thermal signals, and the modulation methods of the physical signals include no modulation, amplitude modulation, phase modulation, and frequency modulation.

[0010] Furthermore, each seed corresponds to an operator matrix, which is used to traverse and adjust the signal parameters in the seed to generate a new seed. The adjustment method is as follows: the original value of the parameter is combined with a fixed parameter value by an operator group that includes addition, subtraction, multiplication, division, exponentiation and bitwise negation to obtain the new value of the parameter.

[0011] Furthermore, seed variation modes include: Deterministic mutation: implemented based on a predefined operator matrix; Destructive mutation: Based on a preset mutation probability, the signal parameters in the seed are destructively modified. The modification methods include: arithmetic value destruction by proportionally increasing or decreasing the original value, random destruction by random sampling within a physically reasonable range, and destruction based on an interest list by covering the parameters corresponding to the discovered vulnerabilities. Crossover mutation: swaps parameters between the current seed and a historical seed; For each seed in the seed sequence, first perform deterministic mutation and destructive mutation in sequence to generate the first test case set; then perform destructive mutation alone to generate the second test case set; merge the two sets and execute steps S3 to S5; if none of the test cases in the merged set trigger an exception, then perform crossover mutation and destructive mutation in sequence on the same parent seed corresponding to the test case to generate the third test case set and execute steps S3 to S5 again.

[0012] Furthermore, the signal generation hardware device is selected according to the type of the physical test signal; when the physical test signal is an ultrasonic signal, the signal generation hardware device is an ultrasonic probe; when the physical test signal is an electromagnetic signal, the signal generation hardware device is an antenna; when the physical test signal is a sound wave signal, the signal generation hardware device is a loudspeaker; when the physical test signal is an optical signal, the signal generation hardware device is a laser emitter. The physical test signal is transmitted and the response is collected through an integrated hardware and software platform, which adapts to the communication interfaces of different sensors through a unified interface expansion board.

[0013] Further, step S4 includes: (4.1) Collect normal sensor readings over a long period of time in an interference-free environment. Divide the collected normal reading data into multiple data segments of the same length as the single test data. For each data segment, calculate a set of preset statistical features. For each feature i, calculate its maximum value across all data segments. and minimum value And calculate its range of variation. Form a baseline triplet for each feature i. The baseline of normal features is formed by the reference triples of all features. (4.2) Extract the statistical feature values ​​from the sensor response data collected in each test. ; for each feature value Its corresponding baseline triplet Compare and discretize: like Then the corresponding discrete value Assign it to 0; like Then the corresponding discrete value ,in This is the floor function; like Then the corresponding discrete value ,in It is a rounding function; Discrete values ​​of all features i By concatenating them in sequence, a discrete feature vector of the response signal corresponding to the test case is formed.

[0014] Furthermore, the preset statistical characteristics include maximum value, minimum value, average value, standard deviation, Euclidean distance, frequency entropy, spectral center, energy zero-crossing rate, and baseband energy.

[0015] Further, step S5 includes: (5.1) Calculation based on discrete eigenvectors Where the deviation is the absolute value of the discrete feature vector corresponding to the response signal, and the minimum distance is the minimum distance between any element in the discrete feature vector corresponding to the response signal and the discrete feature vector corresponding to the normal reading signal of the sensor. and The weighting coefficients are used; preferably, the discrete feature vector corresponding to the normal reading signal of the sensor is a vector of all zeros. (5.2) Adjust the parameters of the fuzzy testing algorithm based on the fitness calculation results: If the test cases generated by the current seed lead to increased coverage, initialize the mutation probability associated with that seed to encourage further exploration; If none of the test cases generated by the current seed improve coverage, the mutation probability associated with that seed will be reduced proportionally, thus lowering its priority for subsequent selection. (5.3) Anomaly detection and recording are performed based on discrete feature vectors, and the seed sequence is updated according to the anomaly detection results: If none of the test cases generated by the current seed trigger an exception, then the current seed will be subjected to crossover mutation and destructive mutation in sequence, and then an exception detection will be performed again. If a test case successfully triggers an exception, the seed of that test case that triggered the exception is added to the seed sequence.

[0016] Furthermore, the process of anomaly detection and recording based on discrete feature vectors includes: Extract the Manhattan distance or Euclidean distance between the discrete feature vector corresponding to the response signal and the discrete feature vector corresponding to the normal reading data, and determine whether the response signal is abnormal based on the preset deviation threshold; if the deviation exceeds the deviation threshold, automatically record the abnormal sample and its corresponding test signal parameters and original response data; The discrete feature vector corresponding to the abnormal sample is matched with a predefined feature template library using the template matching method. Each feature template corresponds to a known sensor vulnerability pattern. When the match is successful, the abnormal sample is classified. When the match fails, the vulnerability pattern of the abnormal sample is confirmed and its feature template is added to the feature template library.

[0017] Secondly, this invention proposes a sensor vulnerability detection system based on physical signal fuzzy testing, which is used to implement the aforementioned sensor vulnerability detection method based on physical signal fuzzy testing.

[0018] The beneficial effects of this invention are: 1. Compared with traditional methods that rely on expert knowledge or frequency sweeping, this invention provides an implementable and deployable real algorithm framework for fuzzy testing of sensor vulnerabilities. The method provided by this invention can greatly improve the efficiency of sensor vulnerability mining. In the same amount of time, it can record more vulnerabilities and vulnerabilities of more types than frequency sweeping.

[0019] 2. Compared with the mutation operators such as bit flipping, deletion and insertion in traditional fuzzing methods, a new mutation operator and method are designed based on the characteristics of physical signal fuzzing. This fuzzing method minimizes the physical test signal input space by constructing a signal set and extracts discrete vector features as feedback. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the framework of a sensor vulnerability detection method based on physical signal fuzzy testing.

[0022] Figure 2 This is a schematic diagram of the seed sequence update in the fuzzing algorithm. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0025] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0026] This invention provides a sensor vulnerability detection method based on physical signal fuzz testing. This method is a systematic physical signal fuzz testing approach used to discover potential anomalies or vulnerabilities in sensors and IoT devices under specific physical signal excitation. The method achieves efficient vulnerability discovery by constructing multi-dimensional signal elements, automatically generating test signals through mutation, acquiring sensor responses, discretizing feature feedback, and performing parallel anomaly detection. Figure 1 The overall flowchart of this method is shown, which mainly includes the following steps: Step S1: Establish the signal construction element set and initialize the fuzz test. First, a set of signal construction elements is defined and constructed to describe the key attributes of physical signals. This set of elements is the foundation for subsequent signal generation and variation. Its core elements include signal amplitude (A), frequency (F), phase (P), and modulation scheme (M), which can be formally represented by a quadruple {A,F,P,M}.

[0027] Based on this set of elements, one or more initial seeds are generated. Each seed contains not only a specific set of signal parameter values, but also a set of mutation probabilities, denoted as . , representing the probability that the frequency, amplitude, and phase will be modified during subsequent mutations, respectively. The initial seed can be set based on the analysis of typical operating signals of the target sensor, or it can be randomly generated within a certain parameter range.

[0028] Initial seed It is input into the subsequent fuzzy testing algorithm loop as the starting point for generating the test signal.

[0029] Step S2: Generate physical test signals based on fuzzy testing algorithm This step is the core loop of fuzz testing, designed to generate a large number of diverse physical test signals from the seed through the system's mutation strategy. The specific process is as follows: Seed selection and sequence maintenance: The algorithm maintains a seed sequence to be tested. In each iteration, a current seed is selected from the sequence according to a preset strategy (such as priority scheduling, random selection, etc.). , This represents the probability of abrupt changes in frequency, amplitude, and phase.

[0030] like Figure 2 As shown, for this seed, deterministic mutation and destructive mutation are performed sequentially to generate the first test case set; then destructive mutation is performed separately to generate the second test case set; the two sets are merged and steps S3 to S5 are executed; if none of the test cases in the merged set trigger an exception, then crossover mutation and destructive mutation are performed sequentially on the same parent seed corresponding to the test case to generate the third test case set, and then steps S3 to S5 are executed again.

[0031] The three mutation methods mentioned above are as follows: Deterministic mutation: Based on a predefined operator matrix, the discrete and finite signal parameters in the seed are traversed and adjusted. The adjustment process is as follows: a fixed set of arithmetic operators is used to perform operations on the original values ​​of the parameters and the fixed parameter values ​​to obtain new parameters and generate a deterministic new seed; the set of arithmetic operators consists of addition, subtraction, multiplication, division, exponentiation and bitwise negation.

[0032] Destructive mutation: This operation is based on the associated mutation probability. To assign higher mutation frequencies to more important signal elements within the original signal element set, the mutation operators used include: 1. Arithmetic value destruction mutation. The parameter is selected from one of the following four operators: increase / decrease the current parameter value by 0-1 times, multiply / divide the current value by 0.1 to 3 times.

[0033] 2. Random Disruption Variation. The current signal type, amplitude, frequency, and phase are randomly varied. For the signal type, one signal type is randomly selected; for amplitude, frequency, and phase, they are uniformly sampled within reasonable physical constraints to serve as new parameters.

[0034] 3. Destructive mutation based on the interest value list. Using the existing vulnerabilities corresponding to quadruples as the interest value list, one or more of the amplitude, frequency, and phase of the current seed are randomly selected, and the corresponding elements are selected from the current interest value list for overlay.

[0035] Crossover mutation: The current seed is combined with other historical seeds in the seed sequence to explore new combinations between different signal features and generate crossover mutation seeds.

[0036] Through the above mutation operation, multiple test cases (new seeds) are obtained.

[0037] Step S3: Transmit signals and acquire sensor responses on the integrated hardware and software platform. Physical signal synthesis: All the new seeds (i.e., the new parameter quadruples) generated in the above steps are synthesized into a continuous, transmittable physical test signal according to a predetermined physical signal model. It can be described by the following formula: Here, since, AM, PM, and FM represent sinusoidal signal, amplitude-modulated signal, phase-modulated signal, and frequency-modulated signal, respectively. For the current moment The corresponding total phase offset, The modulated signal is the original signal carrying information; P is the initial phase, and F is the carrier frequency. This is the phase modulation scaling factor. This is the frequency modulation scaling factor.

[0038] The generated physical test signal is applied to the sensor under test or IoT device through an integrated hardware and software platform. This platform integrates signal transmission and data acquisition functions, as detailed below: Signal transmission: The platform can connect to various signal generators, power amplifiers, antennas and other devices, and can accurately generate and transmit various types of synthesized physical signals (such as sound waves, radio frequency signals, optical signals, etc.).

[0039] Data Acquisition and Communication: The platform uses a unified interface expansion board to adapt to the communication interfaces (such as UART, I2C, SPI, ADC, etc.) or communication protocols of different sensors, and acquires the output data (i.e., sensor response data) of the sensors in real time and synchronously under the excitation of test signals.

[0040] Lightweight and scalable: The platform adopts a modular design, which can flexibly integrate commercial launch equipment according to test requirements, and can be adapted to different devices under test through expansion boards, meeting the requirements of lightweight and rapid deployment.

[0041] Step S4: Feature Discretization Processing and Feedback Mechanism Construction To convert continuous sensor responses into quantized feedback that can guide fuzz testing, this step employs feature discretization technology, mapping the continuous sensor output space into discrete feature vectors. The specific algorithm comprises two stages: offline benchmark construction and online feedback processing, as follows: S4.1: Constructing a Normal Signal Characteristic Benchmark (Offline Stage) First, under normal conditions without malicious interference, the sensor's measurement data is collected over a long period of time and recorded as Mb.

[0042] Subsequently, Mb is divided into D data segments with the same length as the single test data mt.

[0043] For each data segment, a set of preset statistical characteristics is calculated. In this embodiment, the feature set F may include: maximum value, minimum value, average value, standard deviation, Euclidean norm, frequency entropy, spectral center, zero-crossing rate, baseband energy, etc.

[0044] Next, for each feature i, calculate the maximum value of that feature across all D data segments. Minimum value And calculate its range of variation. .

[0045] Finally, a baseline triplet is established for each feature i. All triples together constitute the normal characteristic baseline of the system.

[0046] S4.2: Feature Extraction and Discretization of the Data to be Tested (Online Stage) For each test, the sensor response data mt is collected, and the same feature set F as the offline benchmark is extracted to obtain the feature values. .

[0047] Each With the corresponding baseline triplet Compare and discretize the values: like If so, the characteristic is considered to be normal, and the corresponding discrete value is... Assign it the value of 0.

[0048] like If the feature is considered too low, then the degree of lowness is calculated: Here, floor is the floor function, which rounds down to the nearest integer. The larger the absolute value, the further it deviates from the normal range.

[0049] like If the feature is considered too high, a similar upward discretization rule can be used to calculate its discrete value, for example: Here, ceil is the floor function, which returns a positive integer. The larger the value, the further it deviates from the normal range.

[0050] Vector concatenation: combining all features discrete values By concatenating features in a fixed order, a single discrete feature vector is formed. This vector It intuitively reflects the discretization deviation of the current test cases relative to the normal baseline across all feature dimensions.

[0051] S4.3: Computation of Fitness and Feedback Scheduling Based on discrete feature vectors Calculate the fitness of the current test case. An effective way to calculate fitness is to evaluate... The number and magnitude of newly emerging non-zero values ​​(i.e. newly triggered abnormal features) reflect the new states explored by the test cases.

[0052] Based on the fitness calculation results, the parameters of the fuzzing algorithm are dynamically adjusted: if none of the new test cases generated by the current seed improve coverage, the corresponding modified element (K) in the seed is reduced proportionally. mutation probability of {F, A, P} If a test case generated by the current seed improves coverage (e.g., a non-zero pattern that has not appeared before appears in V), it indicates that the seed has good exploration capabilities. In this case, the mutation probability of the corresponding modified element is not reduced, but its associated mutation probability pro is set to the initial value (i.e., the maximum value) to encourage further exploration.

[0053] Seed sequence update: If none of the new seeds generated by the current seed trigger any anomalies (the parallel anomaly detector in step S5 checks whether the current signal under test is abnormal; this process is executed in parallel with step S5), the current seed is retained for crossover mutation and destructive mutation in step S2. If a new seed successfully triggers an anomaly, the new seed that triggers the anomaly is added to the retained seed sequence as a high-quality seed for the next round of seed generation, focusing on the input space prone to anomalies.

[0054] Step S5: Parallel Anomaly Detection and Deep Analysis A parallel anomaly detector runs concurrently with the main fuzzing loop described above. Its workflow is as follows: Anomaly Detection: Extract the Manhattan or Euclidean distance between the discrete vector corresponding to the signal under test and the discrete vector of the normal signal. Determine whether the test data is abnormal based on the set deviation threshold from the normal signal vector. Once the deviation exceeds the predetermined threshold, automatically record the abnormal sample and its corresponding test signal parameters and original response data.

[0055] Automated Analysis: Deeper automated analysis of recorded anomaly cases. For example, template matching is used to match the discrete feature vector V of anomaly cases with a predefined feature template library. Each feature template corresponds to a known sensor vulnerability pattern (such as "aliasing," "frequency leakage," "cycle nonlinearity," etc.). Successful matching allows for rapid classification of the anomaly case, improving understanding of its root cause; unsuccessful matching identifies a new vulnerability pattern and adds its feature template to the knowledge base to enhance the vulnerability detector's capabilities.

[0056] Through the coordinated work of the above five steps, this invention achieves automated and efficient fuzz testing and vulnerability discovery for the physical layer security of sensors and IoT devices.

[0057] This embodiment also provides a sensor vulnerability detection system based on physical signal fuzzy testing to implement the above detection method. The system includes: The seed management and mutation module is used to generate and store initial seeds, and mutate the seeds based on a fuzz testing algorithm to generate test cases; The signal synthesis and transmission module is used to synthesize physical test signals according to the signal parameters of the test case and transmit the signals to the sensor under test. The data acquisition and communication module is used to acquire the response readings of the sensor under test under the action of physical test signals. The feature processing and feedback module is used to extract and discretize the response readings, generate discrete feature vectors, calculate the fitness based on the discrete feature vectors, and provide feedback to the seed management and mutation module. The anomaly detection and recording module runs in parallel with the feature processing and feedback module, and is used to determine and record anomalies based on the discrete feature vector.

[0058] For the system embodiments, since they basically correspond to the method embodiments, relevant details can be found in the descriptions of the method embodiments; the implementation methods of the remaining modules will not be repeated here. The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0059] The system embodiments of the present invention can be applied to any device with data processing capabilities, such as a computer or other similar device. The system embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution.

[0060] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. Those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. A sensor vulnerability detection method based on physical signal fuzzy testing, characterized in that, Includes the following steps: S1: Construct a set of signal construction elements for a physical signal. The set of signal construction elements is represented by a quadruple, including frequency, phase, amplitude, and modulation scheme. Initialize a random seed sequence based on the set of signal construction elements. Each seed contains a set of specific signal parameter values ​​and is associated with a set of mutation probabilities. S2: Based on the fuzzy testing algorithm, the seed is mutated to generate a sequence of mutated signal elements as test cases; S3: Based on the signal parameters in the test case, synthesize the corresponding physical test signal through the signal generation hardware device, and transmit the physical test signal to the sensor under test; S4: Acquire the response signal of the sensor under test under the action of the physical test signal, extract the characteristics of the response signal and convert it into a discrete feature vector; S5: Calculate the fitness based on the discrete feature vector corresponding to the response signal, and adjust the parameters of the fuzzy testing algorithm based on the fitness; at the same time, perform anomaly detection and recording based on the discrete feature vectors of the response signal and the normal reading signal of the sensor, and update the seed sequence based on the anomaly detection results; S6: Repeat steps S2 to S5 until the preset test termination condition is met.

2. The sensor vulnerability detection method based on physical signal fuzzy testing according to claim 1, characterized in that, The physical signals described by the signal construction element set include at least one of acoustic signals, optical signals, electrical signals, magnetic signals, and thermal signals. The modulation methods of the physical signals include no modulation, amplitude modulation, phase modulation, and frequency modulation.

3. The sensor vulnerability detection method based on physical signal fuzzy testing according to claim 1, characterized in that, Each seed corresponds to an operator matrix, which is used to traverse and adjust the signal parameters in the seed to generate a new seed. The adjustment method is as follows: the original value of the parameter is combined with a fixed parameter value by an operator group that includes addition, subtraction, multiplication, division, exponentiation and bitwise negation to obtain the new value of the parameter.

4. The sensor vulnerability detection method based on physical signal fuzzy testing according to claim 3, characterized in that, Seed mutation modes include: Deterministic mutation: implemented based on a predefined operator matrix; Destructive mutation: Based on a preset mutation probability, the signal parameters in the seed are destructively modified. The modification methods include: arithmetic value destruction by proportionally increasing or decreasing the original value, random destruction by random sampling within a physically reasonable range, and destruction based on an interest list by covering the parameters corresponding to the discovered vulnerabilities. Crossover mutation: swaps parameters between the current seed and a historical seed; For each seed in the seed sequence, first perform deterministic mutation and destructive mutation in sequence to generate the first test case set; then perform destructive mutation alone to generate the second test case set; merge the two sets and execute steps S3 to S5; if none of the test cases in the merged set trigger an exception, then perform crossover mutation and destructive mutation in sequence on the same parent seed corresponding to the test case to generate the third test case set and execute steps S3 to S5 again.

5. The sensor vulnerability detection method based on physical signal fuzzy testing according to claim 1, characterized in that, The signal generation hardware device is selected according to the type of the physical test signal; when the physical test signal is an ultrasonic signal, the signal generation hardware device is an ultrasonic probe; when the physical test signal is an electromagnetic signal, the signal generation hardware device is an antenna; when the physical test signal is a sound wave signal, the signal generation hardware device is a loudspeaker; when the physical test signal is an optical signal, the signal generation hardware device is a laser emitter. The physical test signal is transmitted and the response is collected through an integrated hardware and software platform, which adapts to the communication interfaces of different sensors through a unified interface expansion board.

6. The sensor vulnerability detection method based on physical signal fuzzy testing according to claim 1, characterized in that, Step S4 includes: (4.1) Collect normal sensor readings over a long period of time in an interference-free environment. Divide the collected normal reading data into multiple data segments of the same length as the single test data. For each data segment, calculate a set of preset statistical features. For each feature i, calculate its maximum value across all data segments. and minimum value And calculate its range of variation. Form a baseline triplet for each feature i. The baseline of normal features is formed by the reference triples of all features. (4.2) Extract the statistical feature values ​​from the sensor response data collected in each test. ; for each feature value Its corresponding baseline triplet Compare and discretize: like Then the corresponding discrete value Assign it to 0; like Then the corresponding discrete value ,in This is the floor function; like Then the corresponding discrete value ,in It is a rounding function; Discrete values ​​of all features i By concatenating them in sequence, a discrete feature vector of the response signal corresponding to the test case is formed.

7. The sensor vulnerability detection method based on physical signal fuzzy testing according to claim 6, characterized in that, The preset statistical features include maximum value, minimum value, average value, standard deviation, Euclidean distance, frequency entropy, spectral center, energy zero-crossing rate, and baseband energy.

8. The sensor vulnerability detection method based on physical signal fuzzy testing according to claim 6, characterized in that, Step S5 includes: (5.1) Calculation based on discrete eigenvectors Where the deviation is the absolute value of the discrete feature vector corresponding to the response signal, and the minimum distance is the minimum distance between any element in the discrete feature vector corresponding to the response signal and the discrete feature vector corresponding to the normal reading signal of the sensor. and These are the weighting coefficients; (5.2) Adjust the parameters of the fuzzy testing algorithm based on the fitness calculation results: If the test cases generated by the current seed lead to increased coverage, initialize the mutation probability associated with that seed to encourage further exploration; If none of the test cases generated by the current seed improve coverage, the mutation probability associated with that seed will be reduced proportionally, thus lowering its priority for subsequent selection. (5.3) Anomaly detection and recording are performed based on discrete feature vectors, and the seed sequence is updated according to the anomaly detection results: If none of the test cases generated by the current seed trigger an exception, then the current seed will be subjected to crossover mutation and destructive mutation in sequence, and then an exception detection will be performed again. If a test case successfully triggers an exception, the seed of that test case that triggered the exception is added to the seed sequence.

9. The sensor vulnerability detection method based on physical signal fuzzy testing according to claim 1, characterized in that, The process of anomaly detection and recording based on discrete feature vectors includes: Extract the Manhattan distance or Euclidean distance between the discrete feature vector corresponding to the response signal and the discrete feature vector corresponding to the normal reading data, and determine whether the response signal is abnormal based on the preset deviation threshold; if the deviation exceeds the deviation threshold, automatically record the abnormal sample and its corresponding test signal parameters and original response data; The discrete feature vector corresponding to the abnormal sample is matched with a predefined feature template library using the template matching method. Each feature template corresponds to a known sensor vulnerability pattern. When the match is successful, the abnormal sample is classified. When the match fails, the vulnerability pattern of the abnormal sample is confirmed and its feature template is added to the feature template library.

10. A sensor vulnerability detection system based on physical signal fuzzy testing, used to implement the sensor vulnerability detection method based on physical signal fuzzy testing as described in claim 1, characterized in that, include: The seed management and mutation module is used to generate and store initial seeds, and mutate the seeds based on a fuzz testing algorithm to generate test cases; The signal synthesis and transmission module is used to synthesize physical test signals according to the signal parameters of the test case and transmit the signals to the sensor under test. The data acquisition and communication module is used to acquire the response readings of the sensor under test under the action of physical test signals. The feature processing and feedback module is used to extract and discretize the response readings, generate discrete feature vectors, calculate the fitness based on the discrete feature vectors, and provide feedback to the seed management and mutation module. The anomaly detection and recording module runs in parallel with the feature processing and feedback module, and is used to determine and record anomalies based on the discrete feature vector.

Images