A method and system for dynamically identifying security compliance risks of a DCAS system

Abstract

The application provides a DCAS system safety compliance risk dynamic identification method and system, and the process includes regulation structure analysis and mapping, whole life cycle compliance risk dynamic identification, compliance risk grading intelligent decision, and compliance closed-loop management and authentication support. The system can automatically complete the whole process of regulation clause disassembly, compliance index extraction, risk dynamic identification, risk quantification grading, rectification scheme matching, effect secondary verification, and compliance evaluation report generation, and can realize the continuous evolution of the compliance system with the update of regulations and the iteration of the system. The application effectively solves the problems of low efficiency, risk identification lag, and strong subjectivity of decision-making in traditional manual compliance verification, greatly improves the compliance evaluation accuracy and rectification efficiency of intelligent driving assistance systems, shortens the type certification cycle, and reduces the compliance cost of enterprises.

Description

Technical Field

[0001] This invention relates to the field of intelligent driving safety compliance technology, specifically to a method and system for dynamic identification of safety compliance risks in a DCAS system. Background Technology

[0002] In 2022, the United Nations World Forum for Harmonization of Vehicle Regulations (WP.29) adopted the Uniform Regulation on Driver Assistance Systems (DCAS) (UN R171). This regulation, for the first time, established type approval requirements for Level 2 driver assistance systems (DCAS) covering multiple dimensions, including functional safety, system safety, human-machine interaction, and information security. It also clarified the mandatory compliance standards for DCAS systems at all stages of design, testing, production, and operation. The promulgation of UN R171 marks the transition of global regulation of driver assistance systems from recommended industry guidelines to mandatory regulatory certification, imposing systematic and stringent requirements on the compliance capabilities of intelligent driving companies throughout the entire process.

[0003] DCAS (Driver Control Assistance System) refers to a Level 2 driver assistance system that can simultaneously provide longitudinal and lateral motion control assistance. Its typical functions include a combination of adaptive cruise control (ACC) and lane keeping assist (LKA). Compared with traditional single driver assistance functions, DCAS systems involve more complex sensor fusion, decision-making and planning, and execution control logic. Its compliance risks are distributed throughout all stages of the entire lifecycle, from requirements definition, system design, software coding, hardware integration, simulation testing, real vehicle verification to mass production and operation.

[0004] Currently, the mainstream practices for DCAS system compliance certification under UN R171 regulations, both domestically and internationally, still primarily rely on the following methods: First, compliance engineers manually read the regulation text clause by clause and conduct compliance checks against the system design documents; second, they utilize general document management systems or requirements management tools (such as IBM DOORS, Polarion, etc.) to manage the correlation between regulatory clauses and system requirements; and third, third-party testing organizations conduct sampling compliance testing before type approval. These practices have the following significant drawbacks:

[0005] (1) The interpretation of regulations is highly subjective and consistency is difficult to guarantee. The UN R171 regulation text contains a large number of technical requirements, test conditions, performance indicators and judgment criteria. Different compliance engineers have different understandings and application standards of the same clause, resulting in a lack of consistency in compliance judgment results.

[0006] (2) The compliance verification is inefficient and cannot adapt to the rapid iteration of the system. Faced with the verification requirements of dozens of regulatory clauses and hundreds of technical indicators, the manual check-up method is time-consuming and laborious. Moreover, as the DCAS system functions are continuously upgraded, the workload of incremental coverage and regression verification of regulations increases sharply.

[0007] (3) Risk identification is seriously delayed and there is a lack of forward-looking management capabilities. Traditional compliance reviews are usually carried out in a concentrated manner after the system development is completed or before type certification. The time of discovery of compliance risks is much later than the time of introduction of problems, resulting in high rectification costs and even affecting project progress and certification cycle.

[0008] (4) Compliance decisions lack quantitative basis and are too subjective. For the identified compliance risks, there is currently a lack of systematic risk level quantitative assessment methods and graded disposal mechanisms. The priority of rectification measures and resource allocation often rely on personal experience and judgment, resulting in unstable decision quality.

[0009] (5) Compliance experience is difficult to accumulate and reuse, and knowledge transfer is difficult. The judgment criteria, problem discovery and rectification plan in the compliance verification process are mostly scattered in personal work documents or email communication, lacking a systematic and structured knowledge accumulation and reuse mechanism.

[0010] (6) Lack of coordinated response between regulatory changes and system iterations. UN R171 regulations may be revised and its interpretative documents may be updated during implementation, while the DCAS system itself is also constantly iterating and upgrading. The existing management methods cannot achieve dynamic synchronization between regulatory changes and system compliance status.

[0011] In recent years, with the rapid development of Natural Language Processing (NLP) technology, deep learning models have shown promising application prospects in areas such as automatic parsing of regulatory clauses and structured text extraction. Meanwhile, RegTech has achieved relatively mature applications in heavily regulated industries such as finance and healthcare, but it is still in its early stages in the field of autonomous driving regulatory compliance. How to systematically apply technologies such as structured regulatory parsing, full lifecycle data collection, risk quantification and grading, and closed-loop management to DCAS compliance certification under UN R171 regulations is a pressing technical challenge that needs to be addressed in this field. Summary of the Invention

[0012] To address the aforementioned technical problems, this invention proposes a method and system for dynamic identification of security compliance risks in DCAS systems. Starting with the structured analysis of the UN R171 regulatory text, and based on the three-dimensional mapping relationship between regulatory clauses, compliance indicators, and system parameters, it achieves dynamic identification, quantitative classification, and intelligent decision-making control of compliance risks throughout the entire lifecycle of the DCAS system, forming a complete compliance closed loop and continuous iteration mechanism. The technical solution provided by this invention is as follows:

[0013] Firstly, a dynamic identification system for security and compliance risks in a DCAS system includes a regulatory structured parsing and mapping module, a full lifecycle dynamic identification module for compliance risks, a compliance risk classification intelligent decision-making module, and a compliance closed-loop management and certification support module.

[0014] Preferably, the regulatory structure parsing and mapping module includes:

[0015] The regulatory clause decomposition unit is used to analyze and structurally decompose the text clauses of regulations one by one.

[0016] The compliance indicator extraction unit is used to extract quantifiable compliance indicators and technical requirements from the decomposed regulatory clauses;

[0017] The system parameter three-dimensional mapping unit is used to establish a three-dimensional mapping relationship between regulatory clauses, compliance indicators and DCAS system parameters, forming a standardized basis for compliance judgment.

[0018] Preferably, the full lifecycle compliance risk dynamic identification module includes:

[0019] The DCAS full-stage data acquisition unit is used to collect multi-source data throughout the entire lifecycle of the DCAS system, including R&D design, testing and verification, and actual operation.

[0020] The dynamic compliance risk identification unit is used to perform real-time analysis of the collected data from all stages based on the regulatory mapping library, and dynamically identify various compliance risks.

[0021] The compliance risk tracing unit is used to accurately trace the source of identified compliance risks and pinpoint the specific links and causes of the risks.

[0022] Preferably, the compliance risk classification intelligent decision-making module includes:

[0023] The compliance risk quantification and grading unit is used to quantify and classify the various types of compliance risks identified.

[0024] The rectification and optimization plan matching unit is used to automatically match corresponding rectification and optimization measures according to different risk levels.

[0025] The intelligent handling solution generation form is used to integrate and match results to generate targeted and compliant handling solutions.

[0026] Preferably, the compliance closed-loop management and certification support module includes:

[0027] The secondary verification unit for rectification effectiveness is used to verify and confirm the effectiveness of risk rectification implementation.

[0028] The standardized compliance assessment report generation unit is used to automatically generate standardized compliance assessment reports that meet regulatory type certification requirements;

[0029] The compliance system continuously iterates and updates, which is used to dynamically optimize the regulatory mapping library and risk identification model based on the iteration of the DCAS system and the updates of regulations.

[0030] Secondly, a method for dynamically identifying security compliance risks in a DCAS system includes the following steps:

[0031] S1. Extract the quantifiable compliance indicators and technical parameter requirements of the regulatory clauses, construct a three-dimensional mapping relationship between the regulatory clauses, compliance indicators and technical parameters, and form a regulatory mapping library;

[0032] S2 establishes standardized data collection interfaces for each stage of the DCAS system, collects multi-source heterogeneous data from the entire lifecycle of R&D design, testing and verification, and actual operation in real time or periodically, performs item-by-item comparison and analysis of the data based on the constructed regulatory mapping library, and identifies various compliance risks and completes risk tracing based on the risk identification model.

[0033] S3 quantifies and classifies the identified compliance risks, matches corresponding rectification and optimization plans and compliance handling strategies based on the risk level, and generates targeted intelligent handling plans.

[0034] S4 performs secondary verification and validity confirmation of the rectification and optimization plan, and automatically generates a standardized compliance assessment report that meets the requirements of regulatory type certification.

[0035] S5. Based on the functional iterations of the DCAS system and the updates of regulatory versions, iteratively update the regulatory mapping library and risk identification model.

[0036] Preferably, the specific workflow of S5 includes:

[0037] S51, monitor the functional iteration of the DCAS system and the update dynamics of the UN R171 regulation version;

[0038] S52 automatically updates the regulatory clause breakdown results and compliance indicator library based on system iteration content or changes in regulatory clauses;

[0039] S53, dynamically adjust the three-dimensional mapping relationship between regulatory provisions, compliance indicators and DCAS system parameters;

[0040] S54 retrains and optimizes the risk identification model based on the updated regulatory mapping library to ensure the accuracy and timeliness of compliance risk identification and judgment.

[0041] Compared with existing technologies, the beneficial effects achieved by this invention are as follows: Starting from the structured analysis of the UN R171 regulatory text, and based on the three-dimensional mapping relationship between regulatory clauses, compliance indicators, and DCAS system parameters, this invention proposes a dynamic identification and hierarchical intelligent decision-making method for compliance risks covering the entire lifecycle of the DCAS system. The system can automatically complete the entire process of regulatory clause decomposition, compliance indicator extraction, dynamic risk identification, risk quantification and hierarchical classification, remediation plan matching, secondary verification of effects, and generation of compliance assessment reports. Furthermore, it can achieve continuous evolution of the compliance system with regulatory updates and system iterations. Therefore, this invention provides users with a systematic intelligent management solution for the entire process of compliance risks in the DCAS system oriented towards UN R171 regulations, which can significantly improve the accuracy of compliance assessments and remediation efficiency, shorten the type certification cycle, and reduce enterprise compliance costs. Attached Figure Description

[0042] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0043] Figure 1 This is a flowchart illustrating an embodiment of the present invention;

[0044] Figure 2 This is a schematic diagram illustrating the structured breakdown and three-dimensional mapping relationship of regulatory clauses in an embodiment of the present invention;

[0045] Figure 3 This is a schematic diagram of the dynamic identification process for full lifecycle compliance risks in an embodiment of the present invention;

[0046] Figure 4 This is a flowchart illustrating the compliance risk quantification and intelligent decision-making process in an embodiment of the present invention.

[0047] Figure 5 This is a flowchart illustrating the compliance closed-loop management and certification support process in an embodiment of the present invention. Detailed Implementation

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] To make the above-mentioned objectives, features and effects of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0050] Example 1: As Figure 1As shown, a method for dynamic identification of security compliance risks in a DCAS system includes the following steps:

[0051] S1 breaks down all the clauses of UN R171 regulation, extracts various quantifiable compliance indicators and technical parameter requirements, constructs a three-dimensional mapping relationship between regulatory clauses, compliance indicators and DCAS system parameters, and forms a standardized compliance judgment basis library that can be directly called by the system.

[0052] S2, establish standardized data collection interfaces for each stage of the DCAS system, collect multi-source heterogeneous data from the entire lifecycle of R&D design, testing and verification, and actual operation in real time or periodically, and conduct item-by-item comparison and analysis of the data based on the constructed regulatory mapping library to dynamically identify various R171 compliance risks and complete risk tracing.

[0053] S3 quantifies and classifies the identified compliance risks, automatically matches corresponding rectification and optimization plans and compliance handling strategies based on the risk level, and generates targeted intelligent handling plans.

[0054] S4 conducts secondary verification and effectiveness confirmation of the implementation effect of risk rectification, forming a complete compliance control closed loop from risk identification, rectification implementation to effect verification, and automatically generates a standardized compliance assessment report that meets the type certification requirements of UN R171 regulations;

[0055] S5 dynamically optimizes the regulatory mapping library and risk identification model based on the functional iteration of the DCAS system and the update of the UN R171 regulatory version, so as to achieve continuous iteration and updating of the compliance system.

[0056] like Figure 2 As shown, step S1 first utilizes natural language processing technology to parse and structurally decompose the text clauses of the UN R171 regulation clause by clause. The text structure of the UN R171 regulation typically includes: the definition of the scope of application, definitions and explanations of terms, detailed provisions of technical requirements (covering system security, functional requirements, human-computer interface (HMI), information security, fault diagnosis and response, performance testing methods, etc.), test procedures and pass conditions, type approval procedures and requirements, product conformity, and conformity of production (CoP) requirements. The regulation clause decomposition unit constructs a hierarchical parsing model of the regulation text, decomposing the regulation clauses into multiple levels such as chapters, clauses, sub-clauses, and technical items, and assigns a unique identifier to each level, forming a regulatory clause tree that can be structured for storage and retrieval.

[0057] Based on the regulatory clause tree, the compliance indicator extraction unit utilizes a compliance indicator extraction algorithm based on a pre-trained language representation model (BERT) to automatically identify and extract quantifiable compliance indicators and technical parameter requirements implicit in each clause. For example, it extracts the specific numerical indicator "Minimum Risk Maneuver (MRM) trigger time ≤ × seconds" from clauses concerning "Minimum Risk Maneuver (MRM)"; and extracts specific indicator requirements such as "Audio / Visual / Tactile alarm signal response time ≤ × seconds" and "The driver must regain control of the vehicle within × seconds after a takeover request is issued" from clauses concerning "Driver Takeover Request". The extracted compliance indicators include: indicator name, indicator type (numerical / enumerated / Boolean / textual description), indicator threshold or judgment standard, source clause number, and indicator dependencies, forming a structured compliance indicator library.

[0058] The system parameter 3D mapping unit is used to establish a three-dimensional mapping relationship between regulatory provisions, compliance indicators, and DCAS system parameters. Specifically, this unit maps each compliance indicator to one or more specific parameters of the DCAS system, forming a traceable and verifiable mapping link. For example, the requirement in the regulatory provision regarding "maximum permissible intervention torque for lateral control of the system" is mapped to the "maximum assist torque of EPS" parameter in the DCAS system parameters; the requirement in the regulatory provision regarding "minimum performance requirements for driver attention monitoring functions" is mapped to multiple parameters in the system parameters such as "driver monitoring camera frame rate," "head posture detection accuracy," and "eye closure detection sensitivity." The construction of the 3D mapping relationship establishes a quantifiable correspondence between regulatory requirements and system implementation, laying a data foundation for subsequent automatic identification of compliance risks.

[0059] In this embodiment, the three-dimensional mapping relationship is stored and visualized in the form of a knowledge graph. Each regulatory clause, compliance indicator, and system parameter serves as a node in the knowledge graph, and the mapping relationship between nodes serves as an edge, facilitating easy access and traceability for designers and compliance engineers. The establishment of the mapping relationship is based on a combination of knowledge input from regulatory experts and automatic reasoning from deep learning models, and is incorporated into the standard compliance judgment base after manual review and confirmation.

[0060] like Figure 3 As shown, step S2 includes:

[0061] The DCAS full-stage data acquisition unit collects multi-source data throughout the entire lifecycle of the DCAS system, including R&D design, testing and verification, and actual operation. During the R&D design phase, the collected data includes, but is not limited to: system requirements specifications, system architecture design documents (including functional architecture, technical architecture, and network architecture), software source code (extracting code metrics through static code analysis tools and code style compliance test results), hardware parameter configuration tables (including sensor models and performance parameters, controller computing power parameters, etc.), safety analysis reports (such as HARA analysis results, FMEA / FTA analysis reports, etc.), and system interface definition documents. During the testing and verification phase, the collected data includes, but is not limited to: simulation test case libraries and execution results (including functional coverage, code coverage, and scenario coverage), real-vehicle test data (including test results under different road types, traffic scenarios, and environmental conditions), test coverage under extreme conditions and edge scenarios, system fault injection test results, and usability test data for the human-machine interface. During actual operation, the collected data includes, but is not limited to: system status data during actual vehicle operation (including system activation times, runtime, number of fault alarms, etc.), driver takeover behavior data (including takeover trigger reasons, takeover response time, takeover success rate, etc.), human-machine interaction operation records, system OTA upgrade logs, etc.

[0062] The Dynamic Compliance Risk Identification Unit analyzes the collected data from all stages in real time based on a regulatory mapping library, dynamically identifying various R171 compliance risks. The core working principle of this unit is to automatically match the data acquired by the DCAS full-stage data acquisition unit to the corresponding compliance indicators in the three-dimensional mapping relationship. By automatically comparing the actual parameter values ​​with the thresholds or judgment criteria required by the compliance indicators, data items deviating from compliance requirements are identified and marked as potential compliance risks. For example, when the collected "time from system failure to issuing a driver takeover request" exceeds the threshold required by UN R171 regulations, the system automatically identifies the compliance risk and records detailed risk information. The identification process supports two modes: real-time triggered identification and periodic batch identification. The former is suitable for real-time data flow analysis during the operational phase, while the latter is suitable for batch data import and analysis during the R&D and testing phases.

[0063] The compliance risk tracing unit accurately traces the identified compliance risks, pinpointing the specific stages and causes of their occurrence. The tracing analysis unfolds along three dimensions: time (at which stage did the risk first appear), space (which subsystem or module is involved), and causality (what triggered or caused the risk). It employs analysis methods based on association rule mining and causal reasoning to automatically trace the root cause of the risk. For example, when identifying a compliance risk of "system performance degradation under extreme lighting conditions," the tracing unit automatically correlates it with relevant factors such as sensor selection parameters, algorithm robustness test coverage, and environmental adaptability verification schemes, helping designers quickly locate the root cause of the problem.

[0064] In this embodiment, the output of step S2 includes a structured list of compliance risks. Each risk record contains information such as: risk ID, associated regulatory clause number, associated compliance indicator, risk description, risk discovery stage, risk discovery time, risk tracing result, and current status (pending / processing / closed).

[0065] like Figure 4 As shown, step S3 includes:

[0066] The compliance risk quantification and grading unit quantifies and classifies the identified R171 compliance risks. This embodiment uses a multi-dimensional risk assessment matrix method to quantify and score each risk from three dimensions: risk severity (S), probability of occurrence (P), and controllability (C).

[0067] The severity of risk (S) is assigned a value based on the nature of the requirements and the severity of the potential consequences of the relevant clauses in UN R171 regulations, and is divided into the following levels: S=4 (serious impact, involving type approval rejection items or major security risks), S=3 (significant impact, involving non-compliance of major functions with regulatory requirements), S=2 (moderate impact, involving non-compliance of secondary functions or auxiliary requirements), and S=1 (minor impact, involving incomplete documentation or minor deviations).

[0068] The probability of occurrence (P) is assessed based on the current actual state of the DCAS system and is divided into: P=4 (certain to occur, probability >90%), P=3 (very likely to occur, probability 50%~90%), P=2 (possible to occur, probability 10%~50%), and P=1 (unlikely to occur, probability <10%).

[0069] Controllability (C) is assessed based on the current technical means and management measures to control risks, and is divided into: C=1 (easy to control, mature solutions exist), C=2 (generally controllable, requires certain development investment), C=3 (difficult to control, requires significant technical breakthroughs), and C=4 (extremely difficult to control, no mature solutions yet).

[0070] The formula for calculating the overall risk level R is: R = S × P × C;

[0071] Based on the R value, the risk is divided into three levels: R≥24 is high risk (red), 12≤R<24 is medium risk (yellow), and R<12 is low risk (green).

[0072] The rectification and optimization solution matching unit automatically matches corresponding rectification and optimization measures based on different risk levels. The system has a built-in solution library containing various compliance rectification measures, including but not limited to: system parameter adjustments (such as modifying control algorithm parameters to meet response time requirements), software function optimization (such as adding status monitoring logic or redundant judgment mechanisms), hardware configuration upgrades (such as replacing sensors or controllers with higher-performance ones), supplementary testing and verification (such as adding test cases for specific scenarios to verify compliance), improved design documents (such as supplementing security analysis documents or system design specifications), and process and system optimization (such as improving development processes or quality management systems). The matching rules for different risk levels are as follows:

[0073] High risk: Match the highest priority rectification measures, requiring the immediate development of a rectification plan, completion of rectification plan review within the specified time (e.g., within 48 hours), and full regression verification after rectification is completed;

[0074] Medium risk: Match standard-level rectification measures, requiring rectification to be completed within a specified period (e.g., within 2 weeks), followed by targeted verification after rectification;

[0075] Low risk: Match the improvement suggestions at the regular level, incorporate them into the improvement plan of the next iteration cycle, and complete them in conjunction with the normal system upgrade schedule.

[0076] The intelligent handling solution generation unit integrates and matches results to generate targeted compliance handling solutions. The content structure of the handling solution includes: risk overview (related legal provisions, compliance indicators, risk level), rectification goals and requirements (compliance indicator thresholds to be achieved), specific rectification measures and implementation steps (detailed to the operational level, clarifying the content to be modified, the modules involved, and the responsible person's role), rectification time plan (milestones and completion deadlines for each stage), verification methods and judgment criteria (how to confirm that the rectification effect meets the standards), and rectification process record template (used to track rectification progress and record key information).

[0077] In this embodiment, there is also a solution optimization and recommendation function. The recommendation model trained based on historical rectification case data can recommend the optimal solution from multiple candidate rectification measures and estimate the workload, cycle and resource input required for rectification, providing decision-makers with a quantitative basis for solution selection.

[0078] like Figure 5 As shown, step S4 includes:

[0079] The secondary verification unit for rectification effectiveness conducts a secondary verification and validity confirmation of the implementation effect of risk rectification. This unit automatically triggers the verification process after the rectification measures are completed, and specifically includes the following sub-steps:

[0080] (1) Data re-collection: Relevant data are re-collected on the rectified DCAS system, and the data collection conditions are kept consistent with those of the initial identification to ensure the effectiveness of the comparison;

[0081] (2) Compliance comparison: The data after rectification is compared with the compliance indicator thresholds again to determine whether the regulatory requirements have been met;

[0082] (3) Effectiveness assessment: Compare the data differences before and after rectification to confirm the effectiveness of the rectification measures. If the data after rectification meets the compliance requirements, mark the risk as "verified and closed"; if the data after rectification still deviates or new deviations occur, remark the risk as "inadequate rectification, requiring secondary rectification", and automatically trigger a new round of rectification and verification cycle;

[0083] (4) Verification report generation: The verification process and results are fully recorded to form a traceable chain of verification evidence.

[0084] The standardized compliance assessment report generation unit automatically generates a standardized compliance assessment report that meets the type certification requirements of UN R171 regulations. This report covers the following core contents:

[0085] Basic information about the DCAS system: system name, version number, applicable vehicle models, hardware platform, software version, etc.

[0086] Declaration of Applicability**: A list of all applicable provisions of UN R171 and a description of system coverage;

[0087] Summary of compliance status throughout the entire lifecycle: A table summarizing the compliance status of each stage of R&D, testing, and operation;

[0088] Compliance explanation for each regulatory clause: For each regulatory clause, provide a systematic compliance determination (fully compliant / partially compliant / non-compliant), the basis for the determination, an index of relevant supporting evidence, and an explanation of any deviations (if any).

[0089] Identified compliance risks and their handling status: a complete list of compliance risks, risk levels, handling measures, rectification progress, and verification conclusions;

[0090] Type certification evidence material index: links or paths pointing to various evidence documents (design documents, test reports, analysis reports, log data, etc.), forming a complete chain of evidence;

[0091] Compliance conclusion: A comprehensive assessment was conducted to determine whether the system meets all type approval requirements of UN R171 regulations.

[0092] Furthermore, the specific workflow for dynamically optimizing the regulatory mapping library and risk identification model in S5 includes:

[0093] S51 monitors the functional iteration information of the DCAS system (such as new version releases, new functions, parameter adjustments, etc.) and the version update dynamics of UN R171 regulations (such as the release of regulatory amendments, the release of official interpretative documents, etc.) through interfaces or manual input.

[0094] S52, based on system iteration content or changes in regulatory clauses, automatically or semi-automatically update the regulatory clause breakdown results and compliance indicator library: if it is a system iteration, assess whether the newly added or changed system parameters need to establish new mapping relationships; if it is a regulatory update, identify the added, deleted or modified clauses and indicators, and update the regulatory clause tree and compliance indicator library.

[0095] S53, dynamically adjust the three-dimensional mapping relationship between regulatory clauses, compliance indicators and DCAS system parameters to ensure that the mapping relationship always accurately reflects the current regulatory requirements and the actual status of the system;

[0096] S54, based on the updated regulatory mapping library, synchronously optimizes the judgment rules, threshold parameters and matching logic of the risk identification model. When necessary, it uses newly added compliance data to perform incremental training or fine-tuning of the deep learning model to ensure the accuracy and timeliness of risk identification and judgment.

[0097] In this embodiment, the update record is fully traceable, and the time, content, operator, and review status of each iteration update are all recorded, forming a complete history of the evolution of the compliance system.

[0098] In this embodiment, the human-computer interaction interface adopts a graphical user interface (GUI) design, and the main functional modules are laid out as follows:

[0099] Regulatory mapping management view: Displays the three-dimensional mapping relationship between regulatory clauses, compliance indicators and system parameters in the form of knowledge graph or table, and supports retrieval, filtering and drill-down viewing;

[0100] Risk monitoring dashboard: Visually displays the distribution of various compliance risks in chart form (by risk level, stage, module, etc.), updates risk status in real time, and allows one-click drill-down to view detailed information and handling progress of each risk;

[0101] Decision Support Workbench: Displays risk management solutions generated by the intelligent decision-making module, supporting compliance engineers to review, edit, approve, and issue rectification tasks online;

[0102] Report generation view: Preview and export standardized compliance assessment reports, supporting custom configuration of report templates and multi-format output (PDF, Word, XML, etc.).

[0103] Example 2: A dynamic identification system for security compliance risks in a DCAS system, comprising a regulatory structured parsing and mapping module, a full lifecycle dynamic identification module for compliance risks, a compliance risk classification intelligent decision-making module, and a compliance closed-loop management and certification support module.

[0104] The regulatory structured parsing and mapping module is primarily used to comprehensively deconstruct the clauses of UN R171 regulations, extract various compliance indicators, and establish a three-dimensional mapping relationship between regulatory clauses, compliance indicators, and DCAS system parameters, forming standardized compliance judgment criteria that can be directly invoked by the system. This module includes: a regulatory clause deconstruction unit, used to parse and structure the text clauses of UN R171 regulations line by line; a compliance indicator extraction unit, used to extract quantifiable compliance indicators and technical requirements from the deconstructed regulatory clauses; and a system parameter three-dimensional mapping unit, used to establish a three-dimensional mapping relationship between regulatory clauses, compliance indicators, and DCAS system parameters, forming standardized compliance judgment criteria.

[0105] The dynamic compliance risk identification module throughout the entire lifecycle is primarily used to collect multi-source heterogeneous data from the DCAS system across all stages of R&D, testing, and operation. Based on a regulatory mapping library, it performs real-time dynamic identification and precise tracing of various R171 compliance risks. This module includes: a DCAS full-stage data acquisition unit, used to collect multi-source data from the entire lifecycle of the DCAS system, including R&D design, testing and verification, and actual operation; a dynamic compliance risk identification unit, used to perform real-time analysis of the collected data from all stages based on the regulatory mapping library to dynamically identify various R171 compliance risks; and a compliance risk tracing unit, used to precisely trace the identified compliance risks to pinpoint the specific stages and causes of the risks.

[0106] Furthermore, the DCAS full-stage data includes, but is not limited to: requirements documents, system architecture design documents, software source code, and hardware parameter configurations during the R&D stage; simulation test cases and results, real vehicle test data, and extreme working condition coverage during the testing stage; and actual vehicle operation data, system fault logs, human-machine interaction records, and driver takeover behavior data during the operation stage.

[0107] The intelligent decision-making module for compliance risk classification is mainly used to quantitatively assess and classify various identified R171 compliance risks, and automatically match corresponding rectification and optimization plans and compliance handling strategies according to different risk levels. This module includes: a compliance risk quantification and classification unit, used to quantitatively assess and classify various identified R171 compliance risks; a rectification and optimization plan matching unit, used to automatically match corresponding rectification and optimization measures according to different risk levels; and an intelligent handling plan generation unit, used to integrate the matching results and generate targeted compliance handling plans.

[0108] Furthermore, the quantitative classification of compliance risks is based on a comprehensive score of three dimensions: risk severity, probability of occurrence, and controllability. Risks are divided into several levels, and differentiated rectification, optimization, and compliance handling plans are matched for different levels of risks to achieve precise control of risk classification.

[0109] The compliance closed-loop management and certification support module is primarily used for secondary verification and effectiveness confirmation of risk remediation results, forming a complete compliance management closed loop from risk identification and remediation implementation to effect verification, and automatically generating standardized compliance assessment reports that meet type certification requirements. This module includes: a remediation effect secondary verification unit for secondary verification and effectiveness confirmation of risk remediation implementation; a standardized compliance assessment report generation unit for automatically generating standardized compliance assessment reports that meet UN R171 regulatory type certification requirements; and a compliance system continuous iteration and update unit for dynamically optimizing the regulatory mapping library and risk identification model based on DCAS system iterations and regulatory updates.

[0110] Furthermore, the standardized compliance assessment report covers the compliance status of the DCAS system at each stage of its entire lifecycle, the handling of identified risks, the verification conclusions of rectification effects, and all compliance evidence required for type certification, directly supporting the application for type certification under the UN R171 regulation.

[0111] Example 3: The computer-readable storage medium of this example stores a computer program that, when executed by a processor, implements the steps in the dynamic identification method for security compliance risks of a DCAS system in Example 1.

[0112] The computer-readable storage medium in this embodiment can be an internal storage unit of the terminal, such as the terminal's hard disk or memory; the computer-readable storage medium in this embodiment can also be an external storage device of the terminal, such as a plug-in hard disk, smart memory card, secure digital card, flash memory card, etc. equipped on the terminal; furthermore, the computer-readable storage medium can include both the terminal's internal storage unit and external storage devices.

[0113] The computer-readable storage medium of this embodiment is used to store computer programs and other programs and data required by the terminal. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0114] Example 4: The computer device of this example includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the DCAS system security compliance risk dynamic identification method of Example 1.

[0115] In this embodiment, the processor can be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, off-the-shelf programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. The memory can include read-only memory and random access memory, and provides instructions and data to the processor. A portion of the memory can also include non-volatile random access memory. For example, the memory can also store device type information.

[0116] Those skilled in the art will clearly understand that each implementation can be achieved using software plus the necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0117] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A dynamic identification system for security compliance risks in a DCAS system, characterized in that, It includes a regulatory structured analysis and mapping module, a full lifecycle compliance risk dynamic identification module, a compliance risk classification intelligent decision-making module, and a compliance closed-loop management and certification support module.

2. The DCAS system security compliance risk dynamic identification system according to claim 1, characterized in that, The regulatory structure parsing and mapping module includes: The regulatory clause decomposition unit is used to analyze and structurally decompose the text clauses of regulations one by one. The compliance indicator extraction unit is used to extract quantifiable compliance indicators and technical requirements from the decomposed regulatory clauses; The system parameter three-dimensional mapping unit is used to establish a three-dimensional mapping relationship between regulatory clauses, compliance indicators and DCAS system parameters, forming a standardized basis for compliance judgment.

3. The DCAS system security compliance risk dynamic identification system according to claim 1, characterized in that, The full lifecycle compliance risk dynamic identification module includes: The DCAS full-stage data acquisition unit is used to collect multi-source data throughout the entire lifecycle of the DCAS system, including R&D design, testing and verification, and actual operation. The dynamic compliance risk identification unit is used to perform real-time analysis of the collected data from all stages based on the regulatory mapping library, and dynamically identify various compliance risks. The compliance risk tracing unit is used to accurately trace the source of identified compliance risks and pinpoint the specific links and causes of the risks.

4. The DCAS system security compliance risk dynamic identification system according to claim 1, characterized in that, The compliance risk classification intelligent decision-making module includes: The compliance risk quantification and grading unit is used to quantify and classify the various types of compliance risks identified. The rectification and optimization plan matching unit is used to automatically match corresponding rectification and optimization measures according to different risk levels. The intelligent handling solution generation form is used to integrate and match results to generate targeted and compliant handling solutions.

5. The DCAS system security compliance risk dynamic identification system according to claim 1, characterized in that, The compliance closed-loop management and certification support module includes: The secondary verification unit for rectification effectiveness is used to verify and confirm the effectiveness of risk rectification implementation. The standardized compliance assessment report generation unit is used to automatically generate standardized compliance assessment reports that meet regulatory type certification requirements; The compliance system continuously iterates and updates, which is used to dynamically optimize the regulatory mapping library and risk identification model based on the iteration of the DCAS system and the updates of regulations.

6. A method for dynamic identification of security compliance risks in a DCAS system, characterized in that, Includes the following steps: S1. Extract the quantifiable compliance indicators and technical parameter requirements of the regulatory clauses, construct a three-dimensional mapping relationship between the regulatory clauses, compliance indicators and technical parameters, and form a regulatory mapping library; S2 establishes standardized data collection interfaces for each stage of the DCAS system, collects multi-source heterogeneous data from the entire lifecycle of R&D design, testing and verification, and actual operation in real time or periodically, performs item-by-item comparison and analysis of the data based on the constructed regulatory mapping library, and identifies various compliance risks and completes risk tracing based on the risk identification model. S3 quantifies and classifies the identified compliance risks, matches corresponding rectification and optimization plans and compliance handling strategies based on the risk level, and generates targeted intelligent handling plans. S4 performs secondary verification and validity confirmation of the rectification and optimization plan, and automatically generates a standardized compliance assessment report that meets the requirements of regulatory type certification. S5. Based on the functional iterations of the DCAS system and the updates of regulatory versions, iteratively update the regulatory mapping library and risk identification model.

7. The method for dynamic identification of security compliance risks in a DCAS system according to claim 6, characterized in that, The specific workflow of S5 includes: S51, monitor the functional iteration of the DCAS system and the update dynamics of the UN R171 regulation version; S52 automatically updates the regulatory clause breakdown results and compliance indicator library based on system iteration content or changes in regulatory clauses; S53, dynamically adjust the three-dimensional mapping relationship between regulatory provisions, compliance indicators and DCAS system parameters; S54 retrains and optimizes the risk identification model based on the updated regulatory mapping library to ensure the accuracy and timeliness of compliance risk identification and judgment.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the dynamic identification method for security compliance risks of a DCAS system as described in any one of claims 6-7.

9. A computer device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the DCAS system security compliance risk dynamic identification method as described in any one of claims 6-7.

Images