A safety test simulation environment and automatic test scene rapid construction method and system for intelligent networked vehicles

Abstract

The application relates to a safety test simulation environment for an intelligent networked vehicle and a method and system for quickly constructing an automatic test scene, the method comprising a simulation environment quick construction stage and a test scene quick generation stage, and realizing linkage through structured asset data, wherein the simulation environment quick construction stage comprises vehicle architecture description input and analysis, topology simplification based on attack surface correlation, automatic judgment of virtualization mode, automatic mapping of network topology, automatic arrangement and deployment, the test scene quick generation stage comprises simulation environment asset scanning and fingerprint identification, vulnerability correlation based on knowledge base retrieval, intelligent generation of a test scheme based on a large language model, test scheme assembly and automatic execution, and the application solves the technical problems of low simulation environment construction efficiency, test scene generation dependence on manual work and mutual separation of environment construction and scene generation in current intelligent networked vehicle safety testing.

Description

Technical Field

[0001] This invention relates to the field of information security testing technology for intelligent connected vehicles, and in particular to a method and system for rapidly constructing a security testing simulation environment and automated testing scenarios for intelligent connected vehicles. Background Technology

[0002] With the rapid development of intelligent connected vehicle technology, modern automobiles have evolved from traditional mechanical systems into highly digitalized and networked complex cyber-physical systems. Vehicles integrate numerous electronic control units (ECUs), in-vehicle infotainment systems (IVI), telematics units (T-Boxes), and other electronic devices, interconnected through various in-vehicle networks such as CAN bus, in-vehicle Ethernet, and LIN bus. Simultaneously, vehicles also interact with external cloud platforms, infrastructure, and other vehicles via various communication methods such as cellular networks, Wi-Fi, Bluetooth, and V2X.

[0003] This highly connected architecture, while enhancing vehicle intelligence, also brings serious information security challenges. Cyberattacks targeting intelligent connected vehicles are frequent, including threats such as remote vehicle control, theft of user privacy data, and firmware tampering. Therefore, conducting comprehensive and effective security testing and evaluation of intelligent connected vehicles has become a crucial step in ensuring their security.

[0004] However, current safety testing of intelligent connected vehicles faces the following prominent issues: First, the test environment setup cycle is long. Traditional security testing methods rely on manual setup of the test environment, requiring the configuration of a large number of physical devices and network topologies, which is time-consuming and labor-intensive. For different vehicle models and configurations, testers need to repeatedly adjust environmental parameters, resulting in an excessively long preparation cycle.

[0005] Second, there is a trade-off between simulation realism and construction efficiency. When building security testing simulation environments, existing solutions typically include all ECU nodes and network connections in the vehicle's electronic and electrical architecture within the simulation scope, failing to distinguish which nodes and links are relevant to security testing and which are not. This indiscriminate, full-scale simulation approach results in high virtualization resource overhead and long deployment times, while actual security testing often only focuses on nodes and communication paths relevant to the vehicle's attack surface.

[0006] Third, the automation level of test scenario generation is low. Most existing security testing solutions rely on the experience of security experts, and the design of test cases and the planning of attack paths are primarily done manually. Faced with the complex attack surface of vehicle systems and constantly updated vulnerability information, manual methods are insufficient to quickly generate comprehensive test scenarios.

[0007] Fourth, the construction of the simulation environment and the generation of test scenarios are disconnected. In existing solutions, the construction of the simulation environment and the design of test cases are usually completed by different teams, with a lack of data linkage between the two. Asset information in the simulation environment cannot be directly used for the automatic generation of test plans, and test plans cannot be automatically mapped to specific nodes in the simulation environment for execution, resulting in a large amount of manual coordination work between environment readiness and test execution.

[0008] In summary, there is an urgent need for a technical solution that can quickly build a streamlined and efficient safety testing simulation environment and closely integrate simulation environment information with test scenario generation, in order to solve the problems of slow environment setup, low simulation efficiency, reliance on manual test scenario generation, and the disconnect between environment and scenario in current intelligent connected vehicle safety testing. Summary of the Invention

[0009] This invention provides a method and system for rapidly constructing a safety testing simulation environment and automated test scenarios for intelligent connected vehicles, aiming to solve the technical problems in current intelligent connected vehicle safety testing, such as low efficiency in simulation environment construction, reliance on manual generation of test scenarios, and the disconnect between environment construction and scenario generation.

[0010] This invention provides a method for rapidly constructing a safety testing simulation environment and automated testing scenarios for intelligent connected vehicles. The method includes a rapid simulation environment construction stage and a rapid testing scenario generation stage, which are connected and linked through structured asset data. The rapid construction phase of the simulation environment includes: Step S1: Obtain the vehicle architecture description file, parse the vehicle architecture description file to generate a structured vehicle architecture model represented in the form of a directed graph, the vehicle architecture description file includes a list of ECU nodes, attribute information of each ECU node, and communication connection relationships between ECU nodes. Step S2: Perform attack surface relevance assessment on each node in the vehicle architecture model, classifying nodes into security-related nodes and security-independent nodes. Only security-related nodes and their communication connections are retained to generate a simplified target simulation topology. Nodes with external communication interfaces, gateway nodes undertaking cross-domain communication functions, and nodes running high-privilege services are identified as security-related nodes. Starting from an external access node and ending at a high-privilege service node, a reachable path is calculated on the directed graph using a breadth-first traversal algorithm. Intermediate nodes on the reachable path are identified as security-related nodes. Step S3: For each security-related node in the target simulation topology, determine and assign a virtualization method according to the three-layer judgment rule: the first layer is that nodes with dedicated hardware dependencies are connected using bare metal; the second layer is that nodes running a complete operating system are connected using KVM virtual machines; and the third layer is that application services or microservice components are connected using Docker containers. Step S4: Map the physical bus connection relationship in the target simulation network to a virtual network configuration, including dividing functional domains through VLANs, configuring cross-domain routing rules for gateway nodes, simulating vehicle bus communication through a virtual CAN interface, and mapping external communication interfaces. Step S5: The service orchestration engine automatically generates and executes deployment scripts based on the virtualization method and network topology configuration of each node to complete the automated deployment of the simulation environment and outputs a structured asset list of the simulation environment. Step S6: Perform asset scanning and fingerprint recognition on the deployed simulation environment, and merge it with the asset list to generate an enhanced structured asset list; Step S7: The enhanced structured asset list is matched with the automotive security knowledge base through the RAG retrieval enhancement generation mechanism to retrieve associated vulnerability information, attack techniques and testing tools; Step S8: The enhanced structured asset list, retrieved vulnerability and tool information, and simulated network topology are used as context input to a large language model finely tuned for automotive security. The large language model selects test tools, plans attack paths, and arranges them into a structured test plan according to the ATT&CK technical and tactical framework. The target node identifiers of each step in the test plan correspond one-to-one with the virtual nodes in the simulation environment. Step S9: Convert the structured test plan into an executable test script and execute it automatically.

[0011] A further technical solution of the present invention is that, in step S1, the attribute information of the ECU node includes the node name, node type, type of operating system running, list of application services carried, type of external communication interface, and whether there is a dedicated hardware dependency; the communication connection relationship includes the bus type mounted on each ECU node, the functional domain to which it belongs, and the bridging relationship of the cross-domain gateway node.

[0012] A further technical solution of the present invention is that, in step S2, nodes that do not meet the safety-related determination conditions are determined to be safety-independent nodes and excluded from the simulation scope, including pure actuator ECUs, sensor nodes that do not involve data communication, and non-master nodes in redundant backup nodes; the communication connection relationship is simplified synchronously, and only the bus connection relationship and cross-domain gateway bridging relationship between safety-related nodes are retained.

[0013] A further technical solution of the present invention is that, in step S3, the bare metal method connects the physical hardware to the simulation environment through PCIe passthrough or USB passthrough; the KVM virtual machine method allocates independent virtual CPU, memory and virtual network card resources to the node; and the Docker container method encapsulates the runtime environment and configuration parameters of the service components through a pre-made Docker image.

[0014] A further technical solution of the present invention is that, in step S4, an in-vehicle Ethernet backbone network is constructed through an Open vSwitch virtual switch; CAN bus communication is simulated through a virtual CAN interface and a SocketCAN protocol stack, supporting standard CAN and CAN-FD protocols; and the mirror port of the virtual switch is configured to mirror and capture the communication traffic between virtual nodes.

[0015] A further technical solution of the present invention is that, in step S8, each test step in the structured test scheme output by the large language model includes a target node identifier, the name and parameter configuration of the test tool used, the ATT&CK tactical phase label, and the dependency relationship with the preceding steps.

[0016] A further technical solution of the present invention is that the automotive security knowledge base includes vehicle security vulnerability data, automotive security attack scenario knowledge, and ATT&CK tactical mapping relationships based on the CAVD automotive vulnerability database.

[0017] To achieve the above objectives, this invention also proposes a rapid construction system for a safety testing simulation environment and automated testing scenario for intelligent connected vehicles, comprising: The vehicle architecture parsing module is used to receive vehicle architecture description files provided by vehicle manufacturers and parse them to generate a structured vehicle architecture model represented in the form of a directed graph. The attack surface analysis and topology simplification module is used to evaluate the attack surface relevance of each node in the vehicle architecture model, filter out security-related nodes, and generate a simplified target simulation topology. The virtualization determination module is used to automatically assign virtualization methods to each node in the target simulation topology according to a three-layer determination rule. The network topology mapping module is used to automatically map the physical bus connection relationships in the target simulation topology to virtual network configurations; The orchestration and deployment module is used to automatically generate and execute deployment scripts based on the virtualization method and network topology configuration, complete the deployment of the simulation environment, and output a structured asset list; The asset scanning module is used to scan and fingerprint the deployed simulation environment to generate an enhanced structured asset list; The knowledge base retrieval module is used to match the enhanced structured asset list with the automotive safety knowledge base through the RAG retrieval mechanism; The test plan generation module is used to input asset information, vulnerability information, and topology information into a large language model that has been fine-tuned in the field of automotive security, and generate a structured test plan. The test execution module is used to convert structured test plans into executable test scripts and execute them automatically.

[0018] A further technical solution of the present invention is that the attack surface analysis and topology simplification module identifies nodes with external communication interfaces, gateway nodes undertaking cross-domain communication functions, and nodes running high-privilege services as security-related nodes. Starting from the external access node and ending at the high-privilege service node, the module calculates reachable paths on the directed graph of the vehicle architecture model using a breadth-first traversal algorithm, and identifies intermediate nodes located on the reachable paths as security-related nodes. Pure actuator-type ECUs, sensor nodes that do not involve data communication, and non-master nodes among redundant backup nodes are identified as security-independent nodes.

[0019] A further technical solution of the present invention is that, in the structured test scheme output by the test scheme generation module, the target node identifier of each test step corresponds one-to-one with the virtual node in the simulation environment, and the test execution module executes the test after parsing the target node identifier into the actual network address of the corresponding virtual node in the simulation environment.

[0020] The beneficial effects of this invention, which relates to a method and system for rapidly constructing safety testing simulation environments and automated testing scenarios for intelligent connected vehicles, are as follows: (1) Topology simplification based on attack surface analysis significantly improves construction speed: By evaluating the attack surface relevance of nodes in the vehicle architecture, simulation modeling is performed only on security-related nodes, which greatly reduces the number of nodes that need to be virtualized and the complexity of network configuration.

[0021] (2) Three-layer virtualization judgment rules achieve accurate resource allocation: The three-layer rules of hardware dependency check, operating system type judgment and service type judgment automatically allocate the most suitable virtualization method to each node, avoiding the inefficiency and inconsistency of manual selection, while ensuring the realism of simulation.

[0022] (3) Data closed-loop connection between simulation environment and test scenario: The structured asset list and network topology information output during the simulation environment construction phase are directly used as inputs during the test scenario generation phase. The node identifiers in the test scheme correspond one-to-one with the virtual nodes in the simulation environment, eliminating the manual connection between environment construction and test design in the traditional scheme.

[0023] (4) Domain knowledge-driven intelligent test scheme generation: By combining the large language model finely tuned in the automotive safety domain with the RAG retrieval mechanism, the vulnerability data, attack scenario knowledge and ATT&CK technical and tactical mapping relationship in the automotive safety knowledge base are combined with the specific asset information of the current simulation environment to automatically generate a test scheme with attack chain logic. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating a preferred embodiment of the method for rapidly constructing a safety testing simulation environment and automated testing scenario for intelligent connected vehicles according to the present invention. Figure 2 This is a system architecture diagram for rapidly building a safety testing simulation environment and automated testing scenario for intelligent connected vehicles. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0026] This invention proposes a method for rapidly constructing a safety testing simulation environment and automated testing scenarios for intelligent connected vehicles, including a rapid simulation environment construction stage and a rapid testing scenario generation stage. The two stages are connected and linked through structured asset data.

[0027] like Figure 1 As shown, the rapid construction phase of the simulation environment includes the following steps: Step S1, Vehicle Architecture Description Input and Parsing: The system receives a vehicle architecture description file provided by the vehicle manufacturer. This file includes a list of ECU nodes in the vehicle's electronic and electrical architecture, attribute information for each ECU node, and communication connections between the ECU nodes. The attribute information for each ECU node includes its node name, node type, running operating system type, list of application services it supports, external communication interface type, and whether it has any dedicated hardware dependencies. The communication connections include the bus type connected to each ECU node, its functional domain, and bridging relationships with cross-domain gateway nodes. The system parses the vehicle architecture description file to generate a structured vehicle architecture model.

[0028] Step S2: Topology simplification based on attack surface relevance: Attack surface relevance assessment is performed on each node in the vehicle architecture model, and the nodes are divided into two categories: security-related nodes and security-independent nodes. Simulation modeling is performed only on security-related nodes to generate a simplified target simulation topology.

[0029] The attack surface relevance assessment rules are as follows: Nodes with external communication interfaces are considered security-related, including telematics units (T-Boxes) with cellular network interfaces, in-vehicle infotainment systems (IVIs) with Wi-Fi or Bluetooth interfaces, and diagnostic gateways with OBD diagnostic interfaces; gateway nodes that perform cross-domain communication and protocol conversion functions are considered security-related; ECU nodes running high-privilege services are considered security-related, including nodes running OTA upgrade services, remote diagnostic services, and vehicle remote control services that involve sensitive operations; intermediate nodes on the attack path are considered security-related. Specifically, starting from the aforementioned external access nodes and ending at the high-privilege service nodes, a breadth-first traversal algorithm is used to calculate all reachable paths on the directed graph, and intermediate nodes located on the reachable paths that have not yet been determined by the aforementioned rules are considered security-related.

[0030] Nodes that do not meet any of the above conditions are considered safety-independent, including pure actuator ECUs, sensor nodes that do not involve data communication, and non-master nodes in redundant backup nodes. These nodes are not included in the simulation scope.

[0031] The communication connection relationships are simplified: only the bus connection relationships between security-related nodes and the cross-domain gateway bridging relationships are retained, and the bus links that only connect security-independent nodes are eliminated.

[0032] Step S3: Automatic determination of virtualization mode: For each security-related node in the simplified target simulation topology, the virtualization method is automatically assigned according to the following three-layer decision rules: The first layer of judgment: Check whether the node has any dedicated hardware dependencies. If the node depends on a specific hardware security module (HSM), a dedicated communication chip, or other physical hardware that cannot be simulated by software, then the node uses a bare metal approach, connecting the physical hardware to the simulation environment via PCIe passthrough or USB passthrough.

[0033] The second layer of judgment: After ruling out hardware passthrough requirements, check whether the node is running a complete operating system. If the node is running a complete operating system such as Linux, Android, or QNX, and requires independent kernel space and device driver support, then the node is virtualized using KVM virtual machines, and dedicated virtual CPU, memory, and virtual network interface resources are allocated to it.

[0034] The third layer of judgment: If the node does not meet the above two conditions, that is, the node is an application layer service or microservice component and does not require an independent operating system kernel, then a lightweight virtualization deployment using Docker containers is adopted. The runtime environment and configuration parameters of the service component are encapsulated through a pre-made Docker image.

[0035] Step S4: Automatic network topology mapping: The simplified target simulation topology's physical bus connections are automatically mapped to virtual network configurations. Specifically, this includes: Regarding the division of functional domains, based on the functional domain information retained in the target simulation topology, corresponding VLANs are created on the virtual switches, and virtual nodes within the same functional domain are assigned to the same VLAN to achieve network isolation between functional domains.

[0036] For gateway nodes, configure cross-VLAN routing rules and protocol conversion logic to enable them to achieve the same cross-domain communication bridging function as physical gateways in the virtual environment.

[0037] For the simulation of vehicle bus communication, CAN bus communication is simulated through a virtual CAN interface and SocketCAN protocol stack, supporting standard CAN and CAN-FD protocols; vehicle Ethernet communication is simulated through a virtual switch port group.

[0038] For the mapping of external communication interfaces, the cellular network interface, Wi-Fi interface, Bluetooth interface, and V2X interface in the target simulation topology are mapped to the corresponding virtual network interfaces, and the corresponding communication protocol parameters are configured.

[0039] Configure the mirror port of the virtual switch to capture the communication traffic between virtual nodes for traffic analysis during subsequent security testing.

[0040] Step S5: Automated Orchestration and Deployment The service orchestration engine automatically generates deployment orchestration scripts based on the virtualization methods of each node determined in step S3 and the network topology configuration determined in step S4. The orchestration engine determines the startup order of each virtual node and network component according to dependencies, sequentially creating virtual networks, starting virtual nodes, configuring network parameters, and installing pre-installed software to complete the one-click automated deployment of the simulation environment. After deployment, the orchestration engine outputs a structured asset list of the simulation environment, including information such as the identifier, IP address, open ports, running services, and network connectivity of each virtual node.

[0041] The rapid generation phase of the test scenario includes the following steps: Step S6: Simulation Environment Asset Scanning and Fingerprint Recognition: Active scanning and fingerprinting are performed on the simulation environment deployed in step S5 to verify and supplement the information in the structured asset list. The scan includes the actual operating system version running on each virtual node, open network ports, running services and their version numbers, supported communication protocols and versions, etc. The scan results are merged with the asset list output in step S5 to generate an enhanced structured asset list, which serves as input for generating the test scenario.

[0042] Step S7: Vulnerability association based on knowledge base retrieval: The enhanced structured asset list generated in step S6 is used as the search query. The RAG retrieval enhancement generation mechanism retrieves security information matching the current asset from the automotive security knowledge base. The automotive security knowledge base includes vehicle security vulnerability data, automotive security attack scenario knowledge, and ATT&CK tactical mapping relationships based on authoritative sources such as CAVD. The search process performs multi-dimensional matching based on attributes such as asset device type, system version, protocol type, and service type, returning vulnerability information, applicable attack techniques, and a list of corresponding testing tools associated with each asset in the current simulation environment.

[0043] Step S8: Intelligent generation of test plans based on large language models: The enhanced structured asset list from step S6, the vulnerability information and tool list retrieved in step S7, and the simulated network topology generated in step S4 are used as context input to a large language model fine-tuned for automotive security. Based on this contextual information, the large language model performs the following decisions: selecting appropriate testing tools according to the vulnerability exposure and network reachability of each asset; planning attack paths from external access points to target nodes based on the connection relationships between nodes in the simulated topology and gateway bridging paths; and arranging the selected tools and paths into an ordered sequence of test steps according to the attack chain logic, based on the ATT&CK technical and tactical framework.

[0044] The large language model outputs a structured test plan. Each test step in the test plan includes: a target node identifier, which corresponds one-to-one with a virtual node in the simulation environment; the name and parameter configuration of the test tool used; the ATT&CK tactical stage label of the attack technique; and the dependency relationship between this step and the preceding steps.

[0045] Step S9: Test Plan Assembly and Automated Execution: The system receives the structured test plan output in step S8, resolves the target node identifiers to the actual network addresses of the corresponding virtual nodes in the simulation environment, converts the test tool names and parameter configurations into executable tool invocation instructions, determines the execution order according to the step dependencies, and generates an executable test script. The system automatically invokes the corresponding security testing tools according to the test script, executes each test step sequentially in the simulation environment, and records communication data, system responses, and abnormal behaviors in real time during the test process.

[0046] The following section uses intelligent connected vehicles as a test object to illustrate the rapid construction process of the simulation environment of this invention.

[0047] (I) Vehicle Architecture Description Input and Parsing: The vehicle manufacturer provides an electronic and electrical architecture description document for this model. After system parsing, the following architecture model is obtained: The vehicle includes a central gateway ECU, a body control module (BCM), a powertrain control module (PCM), an infotainment system (IVI), a telematics unit (T-Box), an autonomous driving domain controller (ADC), four door control ECUs, two seat control ECUs, 12 sensor acquisition nodes, OTA upgrade services, and remote diagnostic services, totaling 25 nodes. These nodes are interconnected via four communication links: powertrain domain CAN bus, chassis domain CAN bus, body domain LIN bus, and backbone Ethernet. The central gateway ECU acts as a cross-domain gateway, bridging these four communication domains. The T-Box has a 4G / 5G cellular network interface, and the IVI has Wi-Fi and Bluetooth interfaces.

[0048] (II) Attack Surface Correlation Analysis and Topology Simplification: The system performs attack surface correlation assessments on each of the 25 nodes mentioned above: The T-Box has a cellular network communication interface, which is deemed security-related. The IVI has Wi-Fi and Bluetooth communication interfaces, which are also deemed security-related. The central gateway ECU handles cross-domain communication and protocol conversion, which is deemed security-related. OTA upgrade and remote diagnostic services perform high-privilege sensitive operations, which are deemed security-related. The Powertrain Control Module (PCM) and the Autonomous Driving Domain Controller (ADC) are located on the attack path from the T-Box through the central gateway and run critical services related to vehicle safety, which are deemed security-related. The Body Control Module (BCM) is located on the attack path from the IVI through the central gateway, which is deemed security-related.

[0049] The four door control ECUs and two seat control ECUs are pure actuator ECUs, which do not have external interfaces, do not undertake cross-domain communication, do not run high-privilege services, and are not located on the aforementioned attack paths, and are therefore determined to be security irrelevant. The 12 sensor acquisition nodes do not involve data communication and are therefore determined to be security irrelevant.

[0050] After simplification, the target simulation topology was reduced from 25 nodes to 9 nodes (T-Box, IVI, central gateway, PCM, ADC, BCM, OTA service, remote diagnostic service, and 1 diagnostic gateway), and the communication links were reduced from four complete buses to only the links connecting the aforementioned security-related nodes. The number of nodes was reduced by 64%, significantly reducing the resource overhead and deployment time of the simulation environment.

[0051] (iii) Automatic determination of virtualization method: The system executes a three-layer judgment rule on each of the nine security-related nodes: The diagnostic gateway relies on a dedicated diagnostic communication chip. After the first layer determines that it uses a bare metal method, it accesses via USB pass-through.

[0052] The T-Box runs a Linux operating system, the IVI runs an Android operating system, the central gateway runs a QNX real-time operating system, the PCM and ADC run embedded Linux systems, and the BCM runs the AUTOSAR classic platform. All six nodes are determined by the second layer to use KVM virtual machines.

[0053] OTA upgrade service and remote diagnostic service are application layer microservice components that do not require an independent operating system kernel. They are determined by the third layer to be made using Docker containers.

[0054] (iv) Automatic network topology mapping: The system creates four VLANs on the Open vSwitch virtual switch, corresponding to the powertrain domain (PCM, ADC), chassis domain, body module domain (BCM), and infotainment domain (IVI, OTA service, remote diagnostic service). A central gateway node is configured with cross-VLAN routing rules to bridge these domains. The T-Box simulates cellular network access through an independent virtual network interface, and the IVI is configured with virtual Wi-Fi and Bluetooth interfaces. Communication within each VLAN is simulated via a virtual CAN interface and the SocketCAN protocol stack. A virtual switch mirroring port is configured to mirror traffic between all virtual nodes to the security analysis engine.

[0055] (v) Automated orchestration and deployment: The service orchestration engine generates deployment scripts and executes the deployment in the following order: First, create virtual networks (4 VLANs and cross-domain routing); then start the bare metal node (diagnostic gateway); next, start the KVM virtual machine nodes (central gateway, T-Box, IVI, PCM, ADC, BCM); finally, start the Docker container nodes (OTA service and remote diagnostic service). Upon completion, a structured asset inventory containing complete information for all 9 nodes is output.

[0056] Based on the simulation environment constructed above, the following describes the process of generating and executing automated test scenarios.

[0057] (a) Asset scanning and fingerprint recognition: The system actively scans nine virtual nodes in the simulation environment. For example, the scan identifies that the T-Box runs a Linux kernel, with open SSH and MQTT services (MQTT based on Mosquitto); the IVI runs an Android system with open ADB debugging services; and the central gateway runs the QNX real-time operating system and the DoIP diagnostic service. The scan results include information such as the actual operating system version, service version number, and open ports of each node, which are merged with the asset list output by the orchestration engine to generate an enhanced structured asset list.

[0058] (II) Knowledge base retrieval and vulnerability association: The system enhances the asset list by matching it against the automotive safety knowledge base using the RAG retrieval mechanism. For example, based on the T-Box's MQTT service version information, it retrieves known authentication bypass vulnerabilities for that version; based on the IVI's Android system version and ADB service status, it retrieves corresponding privilege escalation vulnerabilities and attack techniques; and based on the central gateway's DoIP service, it retrieves corresponding diagnostic protocol injection attack methods. Simultaneously, the system returns a list of applicable testing tools for each vulnerability.

[0059] (III) Large Language Model Generation Test Plan: The system uses an enhanced asset list, retrieved vulnerability and tool information, and simulated network topology (T-Box accessed via cellular network, accessible through a central gateway to PCM and ADC) as context, inputting a large language model finely tuned for automotive safety applications.

[0060] After analyzing the above information, the large language model generates an attack chain test plan targeting the T-Box: Step 1 (Initial Access): Connect the T-Box via the cellular network interface and use an MQTT authentication bypass tool to attempt unauthorized access to the MQTT service, corresponding to the ATT&CK tactical phase "Initial Access"; Step 2 (Execution): After obtaining MQTT access permissions, use an MQTT malicious instruction injection tool to send abnormal control commands, corresponding to the tactical phase "Execution"; Step 3 (Lateral Movement): Utilize the Ethernet connection between the T-Box and the central gateway, use a DoIP protocol injection tool to attempt to traverse the gateway to reach the power domain, corresponding to the tactical phase "Lateral Movement"; Step 4 (Impact): Send a forged CAN control frame to the PCM and use a CAN bus fuzzing test tool to verify the power system response, corresponding to the tactical phase "Impact". The target node identifier in each step of the test plan corresponds one-to-one with the virtual node in the simulation environment.

[0061] (iv) Solution assembly and automatic execution: The system parses the structured test plan output by the large language model: it resolves the identifiers of each target node to the actual network addresses of the corresponding virtual nodes in the simulation environment; it resolves the test tool names to the calling commands and parameter templates of the corresponding tools in the tool library; and it generates executable test scripts according to the dependencies of steps one through four. The system automatically executes the test scripts, capturing network traffic in real time through the virtual switch mirror port during execution, and recording the execution results and system responses of each step.

[0062] The beneficial effects of this invention on the rapid construction method for safety testing simulation environments and automated testing scenarios for intelligent connected vehicles are: (1) Topology simplification based on attack surface analysis significantly improves construction speed: By evaluating the attack surface relevance of nodes in the vehicle architecture, simulation modeling is performed only on security-related nodes, which greatly reduces the number of nodes that need to be virtualized and the complexity of network configuration.

[0063] (2) Three-layer virtualization judgment rules achieve accurate resource allocation: The three-layer rules of hardware dependency check, operating system type judgment and service type judgment automatically allocate the most suitable virtualization method to each node, avoiding the inefficiency and inconsistency of manual selection, while ensuring the realism of simulation.

[0064] (3) Data closed-loop connection between simulation environment and test scenario: The structured asset list and network topology information output during the simulation environment construction phase are directly used as inputs during the test scenario generation phase. The node identifiers in the test scheme correspond one-to-one with the virtual nodes in the simulation environment, eliminating the manual connection between environment construction and test design in the traditional scheme.

[0065] (4) Domain knowledge-driven intelligent test scheme generation: By combining the large language model finely tuned in the automotive safety domain with the RAG retrieval mechanism, the vulnerability data, attack scenario knowledge and ATT&CK technical and tactical mapping relationship in the automotive safety knowledge base are combined with the specific asset information of the current simulation environment to automatically generate a test scheme with attack chain logic.

[0066] To achieve the above objectives, this invention also proposes a rapid construction system for a safety testing simulation environment and automated testing scenario for intelligent connected vehicles, such as... Figure 2 As shown, the present invention provides a rapid construction system for safety testing simulation environments and automated testing scenarios for intelligent connected vehicles, comprising: The vehicle architecture parsing module is used to receive vehicle architecture description files provided by vehicle manufacturers and parse them to generate a structured vehicle architecture model represented in the form of a directed graph. The attack surface analysis and topology simplification module is used to evaluate the attack surface relevance of each node in the vehicle architecture model, filter out security-related nodes, and generate a simplified target simulation topology. The virtualization determination module is used to automatically assign virtualization methods to each node in the target simulation topology according to a three-layer determination rule. The network topology mapping module is used to automatically map the physical bus connection relationships in the target simulation topology to virtual network configurations; The orchestration and deployment module is used to automatically generate and execute deployment scripts based on the virtualization method and network topology configuration, complete the deployment of the simulation environment, and output a structured asset list; The asset scanning module is used to scan and fingerprint the deployed simulation environment to generate an enhanced structured asset list; The knowledge base retrieval module is used to match the enhanced structured asset list with the automotive safety knowledge base through the RAG retrieval mechanism; The test plan generation module is used to input asset information, vulnerability information, and topology information into a large language model that has been fine-tuned in the field of automotive security, and generate a structured test plan. The test execution module is used to convert structured test plans into executable test scripts and execute them automatically.

[0067] The attack surface analysis and topology simplification module identifies nodes with external communication interfaces, gateway nodes that perform cross-domain communication functions, and nodes running high-privilege services as security-related nodes. Starting from the external access node and ending at the high-privilege service node, it calculates reachable paths on the directed graph of the vehicle architecture model using a breadth-first traversal algorithm, and identifies intermediate nodes on the reachable paths as security-related nodes. Pure actuator-type ECUs, sensor nodes that do not involve data communication, and non-master nodes among redundant backup nodes are identified as security-independent nodes.

[0068] In the structured test plan output by the test plan generation module, the target node identifier of each test step corresponds one-to-one with the virtual node in the simulation environment. The test execution module parses the target node identifier into the actual network address of the corresponding virtual node in the simulation environment and then executes the test.

[0069] The beneficial effects of this invention on the rapid construction system for safety testing simulation environments and automated testing scenarios for intelligent connected vehicles are: (1) Topology simplification based on attack surface analysis significantly improves construction speed: By evaluating the attack surface relevance of nodes in the vehicle architecture, simulation modeling is performed only on security-related nodes, which greatly reduces the number of nodes that need to be virtualized and the complexity of network configuration.

[0070] (2) Three-layer virtualization judgment rules achieve accurate resource allocation: The three-layer rules of hardware dependency check, operating system type judgment and service type judgment automatically allocate the most suitable virtualization method to each node, avoiding the inefficiency and inconsistency of manual selection, while ensuring the realism of simulation.

[0071] (3) Data closed-loop connection between simulation environment and test scenario: The structured asset list and network topology information output during the simulation environment construction phase are directly used as inputs during the test scenario generation phase. The node identifiers in the test scheme correspond one-to-one with the virtual nodes in the simulation environment, eliminating the manual connection between environment construction and test design in the traditional scheme.

[0072] (4) Domain knowledge-driven intelligent test scheme generation: By combining the large language model finely tuned in the automotive safety domain with the RAG retrieval mechanism, the vulnerability data, attack scenario knowledge and ATT&CK technical and tactical mapping relationship in the automotive safety knowledge base are combined with the specific asset information of the current simulation environment to automatically generate a test scheme with attack chain logic.

[0073] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for rapidly constructing a safety testing simulation environment and automated testing scenarios for intelligent connected vehicles, characterized in that, The method includes a rapid simulation environment construction stage and a rapid test scenario generation stage, which are connected and linked through structured asset data. The rapid construction phase of the simulation environment includes: Step S1: Obtain the vehicle architecture description file, parse the vehicle architecture description file to generate a structured vehicle architecture model represented in the form of a directed graph, the vehicle architecture description file includes a list of ECU nodes, attribute information of each ECU node, and communication connection relationships between ECU nodes. Step S2: Perform attack surface relevance assessment on each node in the vehicle architecture model, classifying nodes into security-related nodes and security-independent nodes. Only security-related nodes and their communication connections are retained to generate a simplified target simulation topology. Nodes with external communication interfaces, gateway nodes undertaking cross-domain communication functions, and nodes running high-privilege services are identified as security-related nodes. Starting from an external access node and ending at a high-privilege service node, a reachable path is calculated on the directed graph using a breadth-first traversal algorithm. Intermediate nodes on the reachable path are identified as security-related nodes. Step S3: For each security-related node in the target simulation topology, determine and assign a virtualization method according to the three-layer judgment rule: the first layer is bare metal access for nodes with dedicated hardware dependencies; the second layer is KVM virtual machine access for nodes running a complete operating system; and the third layer is Docker container access for application services or microservice components. Step S4: Map the physical bus connection relationships in the target simulation network to a virtual network configuration, including dividing functional domains through VLANs, configuring cross-domain routing rules for gateway nodes, simulating vehicle bus communication through a virtual CAN interface, and mapping external communication interfaces. Step S5: The service orchestration engine automatically generates and executes deployment scripts based on the virtualization method and network topology configuration of each node to complete the automated deployment of the simulation environment and outputs a structured asset list of the simulation environment. Step S6: Perform asset scanning and fingerprint recognition on the deployed simulation environment, and merge it with the structured asset list to generate an enhanced structured asset list; Step S7: The enhanced structured asset list is matched with the automotive security knowledge base through the RAG retrieval enhancement generation mechanism to retrieve associated vulnerability information, attack techniques and testing tools; Step S8: The enhanced structured asset list, retrieved vulnerability and tool information, and simulated network topology are used as context input to a large language model finely tuned for automotive security. The large language model selects test tools, plans attack paths, and arranges them into a structured test plan according to the ATT&CK technical and tactical framework. The target node identifiers of each step in the test plan correspond one-to-one with the virtual nodes in the simulation environment. Step S9: Convert the structured test plan into an executable test script and execute it automatically; In step S1, the attribute information of the ECU node includes the node name, node type, type of operating system, list of application services it carries, type of external communication interface, and whether there is any dedicated hardware dependency; the communication connection relationship includes the bus type mounted on each ECU node, the functional domain it belongs to, and the bridging relationship of cross-domain gateway nodes. In step S2, nodes that do not meet the safety-related determination conditions are determined to be safety-independent nodes and excluded from the simulation scope, including pure actuator ECUs, sensor nodes that do not involve data communication, and non-master nodes in redundant backup nodes; the communication connection relationship is simplified synchronously, and only the bus connection relationship and cross-domain gateway bridging relationship between safety-related nodes are retained.

2. The method for rapidly constructing a safety testing simulation environment and automated testing scenario for intelligent connected vehicles according to claim 1, characterized in that, In step S3, the bare metal method connects the physical hardware to the simulation environment via PCIe passthrough or USB passthrough; the KVM virtual machine method allocates independent virtual CPU, memory and virtual network card resources to the node; and the Docker container method encapsulates the runtime environment and configuration parameters of the service components through a pre-made Docker image.

3. The method for rapidly constructing a safety testing simulation environment and automated testing scenario for intelligent connected vehicles according to claim 1, characterized in that, In step S4, an in-vehicle Ethernet backbone network is constructed using an Open vSwitch virtual switch; CAN bus communication is simulated using a virtual CAN interface and a SocketCAN protocol stack, supporting standard CAN and CAN-FD protocols; and the mirror port of the virtual switch is configured to mirror and capture the communication traffic between virtual nodes.

4. The method for rapidly constructing a safety testing simulation environment and automated testing scenario for intelligent connected vehicles according to claim 1, characterized in that, In step S8, the structured test scheme output by the large language model includes a target node identifier, the name and parameter configuration of the test tool used, the ATT&CK tactical phase label, and the dependency relationship with the preceding steps.

5. The method for rapidly constructing a safety testing simulation environment and automated testing scenario for intelligent connected vehicles according to claim 1, characterized in that, The automotive security knowledge base includes vehicle security vulnerability data, automotive security attack scenario knowledge, and ATT&CK technical and tactical mapping relationships based on the CAVD automotive vulnerability database.

6. A system for rapidly constructing a safety testing simulation environment and automated testing scenarios for intelligent connected vehicles, characterized in that, include: The vehicle architecture parsing module is used to receive vehicle architecture description files provided by vehicle manufacturers and parse them to generate a structured vehicle architecture model represented in the form of a directed graph. The attack surface analysis and topology simplification module is used to evaluate the attack surface relevance of each node in the vehicle architecture model, filter out security-related nodes, and generate a simplified target simulation topology. The virtualization determination module is used to automatically assign virtualization methods to each node in the target simulation topology according to a three-layer determination rule. The network topology mapping module is used to automatically map the physical bus connection relationships in the target simulation topology to virtual network configurations; The orchestration and deployment module is used to automatically generate and execute deployment scripts based on the virtualization method and network topology configuration, complete the deployment of the simulation environment, and output a structured asset list; The asset scanning module is used to scan and fingerprint the deployed simulation environment to generate an enhanced structured asset list; The knowledge base retrieval module is used to match the enhanced structured asset list with the automotive safety knowledge base through the RAG retrieval mechanism; The test plan generation module is used to input asset information, vulnerability information, and topology information into a large language model that has been fine-tuned in the field of automotive security, and generate a structured test plan. The test execution module is used to convert structured test plans into executable test scripts and execute them automatically; The attack surface analysis and topology simplification module identifies nodes with external communication interfaces, gateway nodes that undertake cross-domain communication functions, and nodes running high-privilege services as security-related nodes. Starting from the external access node and ending at the high-privilege service node, it calculates reachable paths on the directed graph of the vehicle architecture model using a breadth-first traversal algorithm and identifies intermediate nodes located on the reachable paths as security-related nodes. Pure actuator ECUs, sensor nodes that do not involve data communication, and non-master nodes in redundant backup nodes are classified as safety-independent nodes.

7. The rapid construction system for safety testing simulation environment and automated testing scenario for intelligent connected vehicles according to claim 6, characterized in that, In the structured test plan output by the test plan generation module, the target node identifier of each test step corresponds one-to-one with the virtual node in the simulation environment. The test execution module parses the target node identifier into the actual network address of the corresponding virtual node in the simulation environment and then executes the test.

Images