An unmanned vehicle credibility heterogeneous particle information security penetration testing method and system

Abstract

The application relates to the technical field of unmanned driving and discloses an unmanned driving credibility heterogeneous particle information security penetration testing method and system, which comprises the following steps: deploying a whole-vehicle-level and part-level dual-port heterogeneous probe, completing clock synchronization, and constructing a cross-particle timing alignment test execution environment; based on the test execution environment, executing conditional trigger cross-particle collaborative testing through a collaborative scheduling engine to obtain cross-particle test response data; based on a unified time reference, performing timing correlation and event matching on the cross-particle test response data to construct an attack trace evidence chain; extracting four-dimensional evaluation features from the attack trace evidence chain, calculating a comprehensive risk value in combination with a risk attenuation coefficient corresponding to a coupling path length, mapping the comprehensive risk value to a functional safety level, and outputting an information security penetration verification result.

Description

Technical Field

[0001] This invention relates to the field of autonomous driving technology, specifically to a method and system for heterogeneous information security penetration testing of autonomous driving trustworthiness. Background Technology

[0002] With the continuous improvement of vehicle intelligence and connectivity, autonomous driving systems have become a core component of future transportation. Their deep integration of electronic control units, high-precision sensors, V2X communication modules, and decision-making and planning algorithms forms a complex cyber-physical system, and information security threats are also expanding rapidly. Penetration testing has become a core technical means to ensure the functional safety and operational reliability of autonomous driving systems.

[0003] Currently, autonomous driving information security penetration testing is mainly divided into two modes: vehicle-level black-box / grey-box testing and component-level white-box testing. These modes conduct security verification from two dimensions: detection of external threats to the whole vehicle and detection of underlying defects in components. This is the mainstream testing method in the industry.

[0004] The current technical problem is that vehicle-level and component-level testing are isolated and cannot be coordinated in both directions. The two form independent testing islands, which cannot effectively build and verify multi-step chain attack scenarios across components and functional domains, nor can they quantify and map information security vulnerability risks to autonomous driving functional safety targets. Ultimately, this leads to systemic security risk underreporting, mismatch between testing strategies and dynamic threat environments, and inaccurate security remediation priority decisions, making it difficult to meet the security verification needs of rapid iteration of autonomous driving systems. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention proposes a method and system for heterogeneous information security penetration testing of autonomous driving trustworthiness, in order to solve the aforementioned technical problems.

[0006] Firstly, a heterogeneous granularity information security penetration testing method for autonomous driving trustworthiness is provided, including: Deploy dual-port heterogeneous probes at the vehicle and component levels and complete clock synchronization to build a test execution environment with cross-granularity timing alignment; Based on the aforementioned test execution environment, condition-triggered cross-granularity collaborative tests are performed through a collaborative orchestration engine to obtain cross-granularity test response data; Based on a unified time benchmark, the cross-granularity test response data is correlated with time sequence and matched with events to construct an evidence chain for attack tracing. Four-dimensional evaluation features are extracted from the attack tracing evidence chain, and a comprehensive risk value is calculated by combining the risk attenuation coefficient corresponding to the coupling path length. The comprehensive risk value is then mapped to the functional safety level, and the information security penetration verification result is output.

[0007] Furthermore, deploy vehicle-level and component-level dual-port heterogeneous probes and complete clock synchronization to build a test execution environment with cross-granularity timing alignment, including: Deploy vehicle-level probes that connect to the vehicle's external communication and diagnostic interfaces, as well as component-level probes that connect to the physical debugging interfaces of target components, to build a dual-port heterogeneous probe architecture. A master-slave clock synchronization link is established based on a precision clock synchronization protocol to obtain clock interaction message data; The clock deviation and clock drift parameters of each probe are obtained by calculating the clock interaction message data. The local clock of each probe is corrected based on the clock deviation and clock drift parameters to obtain a test execution environment with cross-granularity timing alignment.

[0008] Furthermore, based on the aforementioned test execution environment, condition-triggered cross-granularity collaborative testing is performed to obtain cross-granularity test response data, including: The collaborative orchestration engine loads test scripts defined by a four-segment structure, schedules vehicle-level probes to perform penetration testing stimuli at the vehicle level, and obtains the initial response data of the vehicle system. Extract CAN message features, ECU diagnostic responses or error codes, and vehicle functional status from the initial response data, and calculate the trigger matching result according to any, all, or ordered combinations of the preset conditions in the test script. If the trigger matching result meets the trigger threshold and sequence constraints, then the component-level probe is scheduled to perform a deep penetration operation on the target component to obtain the internal response data of the component; Based on the preset state range to which the response data inside the component belongs, it is determined whether to continue executing the first type of vehicle-level test action, switch to executing the second type of vehicle-level test action, or terminate the current test step; wherein, the first type of vehicle-level test action includes continuing to send verification messages, and the second type of vehicle-level test action includes switching to send boundary test messages; If the triggering condition is not met within the preset timeout period, the penetration test stimulus at the whole vehicle level will be re-executed according to the preset number of retries, and the process of feature extraction and matching result calculation will be returned. The current test step will be terminated after the maximum number of retries is reached. Functional response data generated throughout the entire testing process is collected at the vehicle level. The initial response data, component internal response data, and functional response data are integrated to obtain cross-granularity test response data.

[0009] Furthermore, based on a unified time benchmark, the cross-granularity test response data is subjected to temporal correlation and event matching to construct an attack attribution evidence chain, including: Set a time tolerance threshold at the microsecond level to obtain data matching and filtering conditions; Based on the data matching and filtering conditions, the cross-granularity test response data is filtered to obtain time-matched vehicle-level test data and component-level test data; By establishing a causal correspondence between time-matched vehicle-level network events and component-level internal state events, an attack tracing evidence chain is constructed, from the attack entry point to component defects and then to functional impact.

[0010] Furthermore, four-dimensional evaluation features are extracted from the attack attribution evidence chain, and a comprehensive risk value is calculated by combining the risk attenuation coefficient corresponding to the coupling path length, including: The relevant features of security threats are extracted from the attack attribution evidence chain to obtain a four-dimensional evaluation feature set; The four-dimensional evaluation feature set is quantitatively calculated to obtain the entry accessibility score, component vulnerability score, coupling path length score, and functional safety impact score, respectively. The risk attenuation coefficient is calculated using the coupling path length as a variable and an exponential attenuation function. The comprehensive risk value is calculated by combining the scores from the four dimensions with the risk decay coefficient.

[0011] Furthermore, the comprehensive risk value is mapped to a functional safety level, and the information security penetration testing results are output, including: Obtain the preset mapping relationship between comprehensive risk value and functional safety level to obtain the level conversion rule; The comprehensive risk value is converted according to the level conversion rules to obtain the corresponding functional safety level; By combining the attack attribution evidence chain with the functional security level, the information security penetration test results are obtained.

[0012] Furthermore, it also includes: Different cross-granularity test scripts are modeled as arms of a multi-armed gambling machine, and the execution effect of the test scripts is used as the reward value to obtain the basic reinforcement learning model. The reinforcement learning basic model is solved using a reinforcement learning algorithm, and the optimal test script is dynamically selected to obtain the optimized test strategy. The new and effective attack paths are standardized and encapsulated to obtain reusable test script fragments. The reusable test script fragments are used to update the test knowledge base, resulting in an iterated test knowledge base.

[0013] Furthermore, it also includes: Obtain the code change information and software bill of materials after the vehicle software upgrade to obtain the software change dataset; The software change dataset is analyzed to obtain the set of affected electronic control units; Based on the aforementioned test knowledge base, historical attack paths related to the affected electronic control unit are filtered to obtain incremental test scripts; Execute the incremental test script to obtain the targeted security regression verification results after the software upgrade.

[0014] Secondly, a heterogeneous information security penetration testing system for autonomous driving trustworthiness is provided, based on the autonomous driving trustworthiness heterogeneous information security penetration testing method described in any of the preceding items, including: The synchronization module is configured to deploy dual-port heterogeneous probes at the vehicle level and component level and complete clock synchronization, thereby building a test execution environment with cross-granularity timing alignment. The testing module is configured to perform condition-triggered cross-granularity collaborative tests through a collaborative orchestration engine based on the test execution environment, and obtain cross-granularity test response data. The matching module is configured to perform time-series correlation and event matching on the cross-granularity test response data based on a unified time benchmark, and construct an evidence chain for attack tracing. The evaluation module is configured to extract four-dimensional evaluation features from the attack tracing evidence chain, calculate a comprehensive risk value by combining the risk attenuation coefficient corresponding to the coupling path length, map the comprehensive risk value to a functional safety level, and output the information security penetration verification result.

[0015] Thirdly, a terminal is provided, including a processor, an input device, an output device, and a memory, wherein the processor, input device, output device, and memory are interconnected, wherein the memory is used to store a computer program, the computer program including program instructions, and the processor is configured to invoke the program instructions to execute an autonomous driving trustworthiness heterogeneous information security penetration testing method as described in any of the preceding claims.

[0016] The invention employing the above technical solution has the following advantages: This invention, through heterogeneous granularity collaborative testing, can effectively discover high-risk vulnerabilities that are chain attacks formed by multiple low-risk vulnerabilities coupled at the system level, which are undetectable by traditional methods, thereby verifying the effectiveness of the defense-in-depth strategy.

[0017] This invention introduces reinforcement learning-driven adaptive testing, upgrading the penetration process from human experience-driven to intelligent target-driven, enabling faster and more accurate identification of core security vulnerabilities and improving testing efficiency and coverage.

[0018] This invention establishes a correlation model between information security and functional safety, transforming abstract cybersecurity threats into concrete and quantifiable functional safety risks, thus providing a basis for management decision-making and engineering resource allocation. Attached Figure Description

[0019] To more clearly illustrate the specific embodiments of the present invention, the accompanying drawings used in the specific embodiments will be briefly described below. In all the drawings, the elements or parts are not necessarily drawn to scale.

[0020] Figure 1 This is a flowchart of a heterogeneous granularity information security penetration testing method for autonomous driving reliability according to the present invention; Figure 2 This is a flowchart of a heterogeneous information security penetration testing system for autonomous driving trustworthiness according to the present invention. Detailed Implementation

[0021] The embodiments of the technical solution of the present invention will now be described in detail with reference to the accompanying drawings. These embodiments are merely illustrative of the technical solution of the present invention and are therefore intended to limit the scope of protection of the present invention.

[0022] like Figures 1-2 As shown, the present invention provides a heterogeneous granularity information security penetration testing method for autonomous driving trustworthiness, comprising: Step S01: Deploy dual-port heterogeneous probes at the vehicle level and component level and complete clock synchronization to build a test execution environment with cross-granularity timing alignment; Step S02: Based on the test execution environment, perform condition-triggered cross-granularity collaborative testing through the collaborative orchestration engine to obtain cross-granularity test response data; Step S03: Based on a unified time reference, perform time-series correlation and event matching on the cross-granularity test response data to construct an attack attribution evidence chain; Step S04: Extract four-dimensional evaluation features from the attack tracing evidence chain, calculate the comprehensive risk value by combining it with the risk attenuation coefficient corresponding to the coupling path length, map the comprehensive risk value to the functional safety level, and output the information security penetration verification result.

[0023] Specifically, the system is first modeled as a whole, and the entire system is regarded as a discrete event system, with the state defined by the vehicle network state and the internal state of the components.

[0024] The basic mathematical model of the system is as follows: System state space:

[0025] in, Vehicle-level state space (such as CAN bus load, ECU response mode, vehicle driving status).

[0026] Component-level state space (such as ECU register values, memory contents, CPU load).

[0027] Test action space:

[0028] in, Vehicle-level test actions performed by probe A (such as sending fuzzy test messages). Component-level testing actions (such as reading memory) performed by B-end probes.

[0029] The system's evolution is driven by CDL scripts and can be modeled as a controlled Markov process:

[0030] in, .

[0031] In this embodiment, a test execution environment with cross-granularity timing alignment is constructed by deploying dual-port heterogeneous probes at the vehicle level and component level and completing clock synchronization, including: Deploy vehicle-level probes that connect to the vehicle's external communication and diagnostic interfaces, as well as component-level probes that connect to the physical debugging interfaces of target components, to build a dual-port heterogeneous probe architecture. A master-slave clock synchronization link is established based on a precision clock synchronization protocol to obtain clock interaction message data; The clock deviation and clock drift parameters of each probe are obtained by calculating the clock interaction message data. The local clock of each probe is corrected based on the clock deviation and clock drift parameters to obtain a test execution environment with cross-granularity timing alignment.

[0032] Specifically, this part is the physical basis for the system to perform tests, and is responsible for applying test stimuli and collecting responses at both the whole vehicle and component levels.

[0033] A-end probe (vehicle level): Connects to the vehicle's OBD-II diagnostic interface, in-vehicle Ethernet mirror port, or wireless communication interface (such as BLE / Wi-Fi). This probe executes standard vehicle-level black-box and gray-box test scripts, including but not limited to: in-vehicle network port scanning, CAN / CANFD / in-vehicle Ethernet protocol fuzzing test, DoS attack, wireless signal replay and hijacking.

[0034] B-end probes (component-level): These probes connect directly to the target ECU via physical debugging interfaces (such as JTAG, SWD, UART) or perform physical / signal layer attacks on sensors using dedicated equipment (such as lidar / radar signal simulators, camera image injection devices). These probes perform in-depth white-box testing, including: firmware online debugging and dynamic analysis, register and memory read / write operations, hardware security module testing, and sensor spoofing signal injection.

[0035] High-precision time synchronization mechanism: The probes at both ends A and B achieve microsecond-level clock alignment under the PTP / gPTP precision clock synchronization protocol. This provides the foundation for subsequently accurately correlated vehicle network packets with events such as changes in chip internal registers and memory access trajectories on a unified timeline.

[0036] Clock skew and drift model: Assuming the master clock (such as a synchronization engine) time is... .

[0037] probe Local clock There is a linear relationship with the master clock:

[0038] in, This refers to clock offset. This refers to clock drift.

[0039] PTP / gPTP synchronization process: The PTP protocol estimates the synchronization process by exchanging a series of messages. and .

[0040] Synchronization message: The master node is in Send a Sync message, the slave node in take over.

[0041] Follow-up message: The master node then sends a message containing precise... of Message.

[0042] Delayed request / response: from the node send The master node is Receive and reply containing of Message.

[0043] Deviation and delay calculation: Assuming the path is symmetric and there is a one-way delay

[0044] Clock Deviation

[0045] Uniform formula for timestamps: After synchronization is complete, any timestamps collected from probe i All can be uniformly corrected to the master clock time. :

[0046] By continuously running the PTP protocol, the system can be dynamically updated. and This ensures that the time synchronization accuracy of probes A and B is maintained at the microsecond level.

[0047] In this embodiment, based on the test execution environment, a condition-triggered cross-granularity collaborative test is performed to obtain cross-granularity test response data, including: The collaborative orchestration engine loads test scripts defined by a four-segment structure, schedules vehicle-level probes to perform penetration testing stimuli at the vehicle level, and obtains the initial response data of the vehicle system. Extract CAN message features, ECU diagnostic responses or error codes, and vehicle functional status from the initial response data, and calculate the trigger matching result according to any, all, or ordered combinations of the preset conditions in the test script. If the trigger matching result meets the trigger threshold and sequence constraints, then the component-level probe is scheduled to perform a deep penetration operation on the target component to obtain the internal response data of the component; Based on the preset state range to which the response data inside the component belongs, it is determined whether to continue executing the first type of vehicle-level test action, switch to executing the second type of vehicle-level test action, or terminate the current test step; wherein, the first type of vehicle-level test action includes continuing to send verification messages, and the second type of vehicle-level test action includes switching to send boundary test messages; If the triggering condition is not met within the preset timeout period, the penetration test stimulus at the whole vehicle level will be re-executed according to the preset number of retries, and the process of feature extraction and matching result calculation will be returned. The current test step will be terminated after the maximum number of retries is reached. Functional response data generated throughout the entire testing process is collected at the vehicle level. The initial response data, component internal response data, and functional response data are integrated to obtain cross-granularity test response data.

[0048] Specifically, a CDL script can be formalized as a directed graph. In this context, node V represents the test step, and edge E represents the state transition condition.

[0049] Mathematical model of CDL four-segment structure: A CDL script It is a sequence of quadruplets:

[0050] Each of them It is a quadruple:

[0051] The k-th step of the vehicle's movement; : Expected intermediate state of the whole vehicle (as a trigger condition); : The component action triggered after the conditions are met; The final behavior / impact observed at the whole vehicle level.

[0052] As the control core of the test system, the collaborative orchestration engine transforms cross-granularity test logic into an executable automated closed loop through processes.

[0053] It uses the CDL script description language, specifically designed for heterogeneous granularity testing, to construct complete test cases in a four-segment structure: First, vehicle-level stimuli are executed through the A-end probe, such as sending malicious diagnostic messages; then, the vehicle system is monitored to see if the expected intermediate state occurs, such as a specific ECU mode switch; once the conditions are met, the B-end probe is immediately triggered to perform deep operations at the component level, including memory verification or vulnerability exploitation; finally, the system returns to the vehicle level to observe the functional impact, completing the full verification from the attack entry point to the security impact.

[0054] During engine operation, intelligent dynamic triggering is achieved through a condition gateway. This component continuously parses the vehicle network data stream, and when a pattern matching the script's preset conditions is detected (e.g., message verification error or ECU abnormal reset, immediately activating the corresponding component-level test script), this context-based triggering mechanism can adaptively adjust the injection parameters according to the real-time system status, ensuring that the test depth remains synchronized with the actual situation.

[0055] To construct a complete chain of evidence, the data stitcher deeply fuses multi-granularity test data. Based on a high-precision time synchronization mechanism, it aligns and correlates network packets and vehicle behavior data collected from end A with register states and memory snapshots obtained from end B, forming a complete tracing path from the network attack surface to the internal state of the chip.

[0056] The engine manages the entire lifecycle of script execution through a state machine model, and controls the transition of the test phase according to the trigger judgment, timeout retry and feedback mapping results, so that each vehicle-level action and component-level action form a calculable and traceable closed loop.

[0057] Dynamic triggering and closed-loop decision logic of the condition gateway: For the Each test step involves a vehicle-level probe performing vehicle-wide actions. Subsequently, the condition gateway continuously receives vehicle network and functional status data and extracts data from it. Triggering state quantity The trigger status quantities include specific CAN message identifiers and data fields, ECU diagnostic responses or error codes, changes in vehicle function status, and status values ​​obtained through standard diagnostic interfaces; When the condition is met ,otherwise The weighted matching degree of the triggering condition is:

[0058] in, For the first The weight of the triggering condition. For combined conditions that are required to appear in a preset order, define the order constraint:

[0059] in, For the first The moment when the condition is first met, The maximum time interval allowed for adjacent conditions; time commands with no sequential requirements. The triggering result of the component-level probe is as follows:

[0060] in, This is the trigger threshold. When all conditions must be met, [the threshold will be triggered]. Set to 1; when any condition is met, it will be triggered. Set to no greater than the minimum value among all non-zero weights; when using a weighted combination condition, set according to the test script. Only when Only then does the collaborative orchestration engine schedule component-level probes to execute the corresponding component actions. .

[0061] Vehicle-level probes After the test stimulus is issued, the dynamic timeout is calculated based on the historical response delay of similar test steps:

[0062] in, and These represent the mean and standard deviation of historical response delays for similar test steps, respectively. This is the tolerance factor. and These are the preset minimum and maximum timeout times, respectively. The triggering and timeout handling rules are as follows:

[0063] in, This is the current number of retries. A preset maximum number of retries is set. Monitoring continues until the timeout expires; if the timeout occurs but the maximum number of retries has not been reached, the vehicle operation is re-executed. The monitoring window will be reset; once the maximum number of retries is reached, the current test step will be terminated, the timeout reason will be recorded, and the test will no longer wait indefinitely.

[0064] After the component-level probe completes its execution, the collected register values, memory characteristics, ECU error codes, and processor load are combined to form an internal response feature vector. And determine the next vehicle-level action based on the preset state range of the test script:

[0065] in, This indicates a set of states where the register value is in the first preset range and the memory characteristics match the target vulnerability characteristics. At this time, continue to send a Class A verification message. This represents a set of states where the internal state is abnormal but the conditions for confirming the target vulnerability have not yet been met. At this time, switch to sending a Class B boundary test message. This indicates a set of states where no internal anomalies were detected, a safety boundary was reached, or execution could not continue. In this case, the current test step is terminated. This is a Category 1 vehicle-level test. This is the second type of vehicle-level testing action.

[0066] Therefore, the results collected by component-level probes are not only used to end the test, but also serve as feedback input for selecting subsequent actions of vehicle-level probes.

[0067] After the component-level operations are completed and the determined subsequent vehicle-level actions are executed, the system collects the vehicle's functional-level response data and integrates the initial response data, component internal response data, and functional-level response data into a cross-granularity test response dataset.

[0068] In this embodiment, based on a unified time benchmark, the cross-granularity test response data is subjected to time-series correlation and event matching to construct an attack attribution evidence chain, including: Set a time tolerance threshold at the microsecond level to obtain data matching and filtering conditions; Based on the data matching and filtering conditions, the cross-granularity test response data is filtered to obtain time-matched vehicle-level test data and component-level test data; By establishing a causal correspondence between time-matched vehicle-level network events and component-level internal state events, an attack tracing evidence chain is constructed, from the attack entry point to component defects and then to functional impact.

[0069] Specifically, set a time tolerance threshold. Its value is determined by the synchronization accuracy of PTP / gPTP, and is usually 110 microseconds.

[0070] Only when the time difference between vehicle-level events and component-level events is less than Only then is it considered that there is a causal relationship between the two.

[0071] The association algorithm of the data stitcher: Given a time window The data stitcher receives two types of data streams: Data stream at end A: , These include network messages, etc.

[0072] B-end data flow: , These include registers, memory snapshots, etc.

[0073] Using a time synchronization formula, all timestamps are unified to Association operations Defined as:

[0074] Through the aforementioned correlation algorithm, the system maps the vehicle-level attack entry events with the component-level vulnerability exploitation events and the final functional failure events on the timeline, forming a complete chain of evidence for attack tracing.

[0075] In this embodiment, four-dimensional evaluation features are extracted from the attack attribution evidence chain, and a comprehensive risk value is calculated by combining the risk attenuation coefficient corresponding to the coupling path length, including: The relevant features of security threats are extracted from the attack attribution evidence chain to obtain a four-dimensional evaluation feature set; The four-dimensional evaluation feature set is quantitatively calculated to obtain the entry accessibility score, component vulnerability score, coupling path length score, and functional safety impact score, respectively. The risk attenuation coefficient is calculated using the coupling path length as a variable and an exponential attenuation function. The comprehensive risk value is calculated by combining the scores from the four dimensions with the risk decay coefficient.

[0076] In this embodiment, the comprehensive risk value is mapped to the functional safety level, and the information security penetration testing results are output, including: Obtain the preset mapping relationship between comprehensive risk value and functional safety level to obtain the level conversion rule; The comprehensive risk value is converted according to the level conversion rules to obtain the corresponding functional safety level; By combining the attack attribution evidence chain with the functional security level, the information security penetration test results are obtained.

[0077] Specifically, this module accurately quantifies the security risks discovered during the testing process and closely links them to vehicle functional safety requirements. The system adopts an innovative four-dimensional scoring system to comprehensively evaluate each identified threat.

[0078] Four-dimensional scoring system: 1. Accessibility: The difficulty of achieving an attack vector.

[0079] 2. Component vulnerability: The severity of the vulnerability itself (e.g., CVSS score).

[0080] 3. Coupling path length: Based on the attack graph model, calculate the shortest number of attack steps required from the vehicle attack entry point to triggering component-level defects, quantifying the complexity and cost of chain attacks.

[0081] 4. Functional safety impact: Estimate the highest level of functional safety hazard that this chain attack may cause.

[0082] Based on this comprehensive evaluation result, the system directly converts the four-dimensional score into the ASIL safety level defined by the ISO26262 standard through a pre-calibrated mapping matrix.

[0083] Formulating the four-dimensional scoring system: Accessibility (Acc):

[0084] in, These represent the difficulty of physical contact, the difficulty of protocol cracking, and the difficulty of password cracking, respectively. Higher values ​​indicate greater difficulty, and the default weighting coefficient is [value missing]. =0.3, =0.4, =0.3, among which, the difficulty of protocol cracking has the greatest impact on remote attacks. It's weight. .

[0085] Component vulnerability (Vulnerability, Vul): We directly use the CVSSv3.1 baseline score and normalize it:

[0086] Coupling Distance (Cd): Based on attack graph calculate.

[0087] N: Set of attack step state nodes.

[0088] E: State transition edge, the weight of which represents the difficulty of the attack step. .

[0089]

[0090] in, It is a whole-vehicle attack entry point node. It is the target node that triggers component defects. The larger the value, the longer and more complex the attack chain.

[0091] Functional safety impact (SI): According to ISO 26262, the degree of hazard is quantified. For example:

[0092] Overall Risk Value (R):

[0093] Derivation and explanation: This represents traditional information security risks.

[0094] It is a decay factor. It is the attack chain length attenuation coefficient (typically ranging from 0.1 to 0.3, obtained by fitting industry attack data), used to quantify the degree of dilution of actual risk by each additional step in the attack chain. It quantifies the risk mitigation effect of the coupling path length.

[0095] The longer the attack chain ( The larger the risk, the greater the ultimate risk. The damage decreases exponentially. This reflects the dilution effect of attack complexity on actual risk.

[0096] As a multiplier, this ultimately anchors information security risks to their impact on functional safety.

[0097] ASIL Rank Mapping Matrix ( ) This is a lookup table or piecewise function that maps continuous risk scores (RR) to discrete ASIL levels.

[0098]

[0099] in, The threshold is pre-defined based on expert experience and historical data.

[0100] The system generates a complete penetration testing report that includes attack paths, vulnerability details, overall risk value, ASIL level, functional safety impact description, and remediation recommendations.

[0101] In this embodiment, it also includes: Different cross-granularity test scripts are modeled as arms of a multi-armed gambling machine, and the execution effect of the test scripts is used as the reward value to obtain the basic reinforcement learning model. The reinforcement learning algorithm is used to solve the basic reinforcement learning model, and the optimal test script is dynamically selected to obtain the optimized test strategy; The new and effective attack paths are standardized and encapsulated to obtain reusable test script fragments. The test knowledge base is updated using reusable test script fragments to obtain the iterative test knowledge base.

[0102] Specifically, the system can construct the selection and execution process of CDL scripts as a multi-armed gambling machine problem through a built-in self-learning library. By leveraging online reinforcement learning, it continuously optimizes testing strategies and parameter configurations, thereby continuously improving vulnerability discovery efficiency. Whenever a new effective attack path is discovered, the system automatically encapsulates these verified "vehicle entry point - component defect" correspondences into reusable CDL script fragments, continuously enriching the testing knowledge base, enabling testing capabilities to autonomously evolve along with vehicle model iterations and threat evolution.

[0103] At the engineering practice level, the system integrates with the CI / CD pipeline through a lifecycle management interface. After a vehicle completes an OTA upgrade, the system automatically generates precise incremental test scripts based on the software bill of materials and code change analysis.

[0104] This intelligent regression testing mechanism only requires targeted verification of the affected ECUs and related historical attack paths, without the need for full-scale testing. Practical applications show that this method can reduce the size of regression test cases to 12%-18% of the original level, completing full security verification within hours.

[0105] Problem Modeling: Multi-Armed Gambling Machines (MAB) Arm: Each arm is a CDL script template; Reward: The reward obtained after executing a scenario; it can be defined as:

[0106] Where R is the risk score for the vulnerability discovered in the script. These are weighting coefficients. The reward function encourages the system to discover high-value vulnerabilities while also considering efficiency.

[0107] Reinforcement learning algorithm: UpperConfidenceBound (UCB) The UCB algorithm balances exploration (trying less frequently used scenarios) and exploitation (using the best available scenario).

[0108] Initialization: For each play i, execute once and record the reward. .

[0109] In each iteration t: Select script The selection criteria for execution are as follows:

[0110] in: :script The average reward up to time t.

[0111] :script The number of times it was selected.

[0112] Exploration coefficient, exploration coefficient The default value is 2.0, which is a commonly used empirical value for multi-armed slot machine problems. If you want the system to be more inclined to explore new scenarios, you can increase it to 3.0-4.0; if you want it to be more inclined to utilize high-value scenarios that have been discovered, you can decrease it to 1.0-1.5.

[0113] Execution script (t), receive a reward .

[0114] Updated statistics:

[0115]

[0116] Through continuous iteration, the system will gradually concentrate testing resources on CDL playbooks that have historically had higher average rewards (i.e., are more effective at discovering high-risk vulnerabilities).

[0117] Whenever the system discovers a new effective attack path (i.e., the complete link of "the functional impact of defects in the vehicle's entry components"), it automatically breaks it down into standardized CDL script fragments, which include elements such as triggering conditions, execution actions, and expected responses.

[0118] The newly generated script fragments are stored in the self-learning library to continuously enrich the test knowledge base, enabling the system's testing capabilities to evolve autonomously with vehicle model iterations and threat evolution.

[0119] In this embodiment, it also includes: Obtain the code change information and software bill of materials after the vehicle software upgrade to obtain the software change dataset; Analyze the software change dataset to obtain the set of affected electronic control units; Based on the test knowledge base, historical attack paths related to the affected electronic control unit are filtered to obtain incremental test scripts; Execute the incremental test script to obtain the targeted security regression verification results after the software upgrade.

[0120] Specifically, the principle of test case compression in incremental regression testing: Let the complete set of ECUs be... The full set of attack paths is .

[0121] After an OTA upgrade, the subset of ECUs affected by the code change is: .

[0122] According to the "Attack Pattern Repository", and The relevant historical attack paths are as follows .

[0123] Compression ratio It can be estimated as follows:

[0124] in, It is a coefficient for the number of new exploratory test cases for each affected ECU (usually ranging from 0.2 to 0.5), used to cover unknown vulnerabilities that may be introduced by the new code.

[0125] because and ,therefore, It can be reduced to 12%-18%, achieving efficient directional regression testing.

[0126] Specific Implementation Example 1: Discovery of Chain Attacks Targeting Intelligent Driving Domain Controllers 1. Deploy probe A to connect to the vehicle's Ethernet mirror port, and probe B to connect to the infotainment system ECU via JTAG interface to complete PTP microsecond-level synchronization; 2. Load the CDL script, and the A-end probe executes a malicious video file injection action, successfully obtaining initial access to the infotainment system (initial response data). 3. The condition gateway detects that the infotainment system ECU has entered privileged mode (preset trigger condition) and immediately dispatches the B-end probe to perform firmware dynamic analysis; 4. The B-end probe discovered that the infotainment system and the intelligent driving domain controller have an unnecessary CAN communication channel with a weak authentication mechanism. This channel is used to inject fake obstacle-free perception data (internal response data of the component) into the domain controller. 5. At the vehicle level, erroneous lane-changing commands were observed from the vehicle decision-making system (functional response data). 6. The data stitcher correlates malicious video injection, ECU privileged mode, forged perception data, and unexpected lane change events on the timeline to generate an attack tracing evidence chain; 7. Four-dimensional assessment: Accessibility 0.8 (remotely achievable), Component vulnerability 0.5 (CVSS 5.0), Coupling path length 2 (two-step attack), Functional safety impact 1.0 (ASILD); Overall risk value R = (0.8 × 0.5) × e -λ×2 ×1.0≈0.32, which is mapped to the ASILC level; 8. Generate a penetration testing report, indicating that the chain attack can cause vehicles to deviate from their lanes unexpectedly, and recommend immediately shutting down unnecessary cross-domain communication channels and strengthening authentication mechanisms.

[0127] Specific Implementation Example 2: LiDAR Sensor Spoofing Test Based on Reinforcement Learning 1. Deploy probe A to connect to the vehicle's CAN bus, and probe B to connect to the LiDAR signal simulator to complete clock synchronization; 2. In the initial stage, the system randomly selects 10 LiDAR point cloud deception scenarios to execute, most of which are filtered out by the perception algorithm, resulting in low reward values; 3. After 50 iterations, the UCB algorithm gradually converges to an intermittent deception mode superimposed with specific noise, which can effectively bypass the filtering mechanism of the target detection algorithm. 4. The condition gateway detects that the sensing system outputs an abnormal target detection result and schedules the B-end probe to continuously inject this deceptive signal; 5. At the vehicle level, it was observed that the AEB braking system failed to be triggered when there was a stationary obstacle in front of the vehicle; 6. The system encapsulates this new attack mode into a CDL script fragment, stores it in the self-learning library, and marks its functional safety impact as ASILD level.

[0128] Specific Implementation Example 3: Fast Regression Test After OTA Upgrade 1. The vehicle has completed an OTA upgrade, fixing the remote code execution vulnerability in the TBox; 2. The system automatically obtains code change information and SBOM, and analyzes and determines that the only affected ECU is the T-Box (ΔE={T-Box}); 3. Filter out all 12 historical attack paths related to TBox from the test knowledge base and generate an incremental test script containing 12 regression test cases and 2 exploratory test cases; 4. Execute incremental test scripts to verify that patched vulnerabilities are no longer exploitable and that no new security degradation has been introduced; 5. This regression test took 2.5 hours, and the number of test cases was only 15% of the total number of tests, which meets the rapid iteration requirements of agile development.

[0129] The numerical values ​​and results of the above embodiments are illustrative examples, and the actual test results depend on the specific environment, vulnerability distribution, and system configuration.

[0130] In other embodiments, a heterogeneous information security penetration testing system for autonomous driving trustworthiness is provided, and an autonomous driving trustworthiness heterogeneous information security penetration testing method based on any of the preceding embodiments is provided, including: The synchronization module is configured to deploy dual-port heterogeneous probes at the vehicle level and component level and complete clock synchronization, thereby building a test execution environment with cross-granularity timing alignment. The testing module is configured to perform condition-triggered cross-granularity collaborative tests through a collaborative orchestration engine based on the test execution environment, and obtain cross-granularity test response data. The matching module is configured to perform time-series correlation and event matching on the cross-granularity test response data based on a unified time benchmark, and construct an evidence chain for attack tracing. The evaluation module is configured to extract four-dimensional evaluation features from the attack tracing evidence chain, calculate a comprehensive risk value by combining the risk attenuation coefficient corresponding to the coupling path length, map the comprehensive risk value to a functional safety level, and output the information security penetration verification result.

[0131] In other embodiments, a terminal is provided, including a processor, an input device, an output device, and a memory, which are interconnected. The memory is used to store a computer program, which includes program instructions. The processor is configured to invoke the program instructions to execute an autonomous driving trustworthiness heterogeneous information security penetration testing method as described above.

[0132] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A method for heterogeneous granular information security penetration testing to assess the trustworthiness of autonomous driving systems, characterized in that... include: Deploy dual-port heterogeneous probes at the vehicle and component levels and complete clock synchronization to build a test execution environment with cross-granularity timing alignment; Based on the aforementioned test execution environment, condition-triggered cross-granularity collaborative tests are performed through a collaborative orchestration engine to obtain cross-granularity test response data; Based on a unified time benchmark, the cross-granularity test response data is correlated with time sequence and matched with events to construct an evidence chain for attack tracing. Four-dimensional evaluation features are extracted from the attack tracing evidence chain, and a comprehensive risk value is calculated by combining the risk attenuation coefficient corresponding to the coupling path length. The comprehensive risk value is then mapped to the functional safety level, and the information security penetration verification result is output.

2. The autonomous driving trustworthiness heterogeneous information security penetration testing method according to claim 1, characterized in that, Deploy dual-port heterogeneous probes at the vehicle and component levels and synchronize their clocks to build a test execution environment with cross-granularity timing alignment, including: Deploy vehicle-level probes that connect to the vehicle's external communication and diagnostic interfaces, as well as component-level probes that connect to the physical debugging interfaces of target components, to build a dual-port heterogeneous probe architecture. A master-slave clock synchronization link is established based on a precision clock synchronization protocol to obtain clock interaction message data; The clock deviation and clock drift parameters of each probe are obtained by calculating the clock interaction message data. The local clock of each probe is corrected based on the clock deviation and clock drift parameters to obtain a test execution environment with cross-granularity timing alignment.

3. The autonomous driving trustworthiness heterogeneous information security penetration testing method according to claim 1, characterized in that, Based on the aforementioned test execution environment, condition-triggered cross-granularity collaborative testing is performed to obtain cross-granularity test response data, including: The collaborative orchestration engine loads test scripts defined by a four-segment structure, schedules vehicle-level probes to perform penetration testing stimuli at the vehicle level, and obtains the initial response data of the vehicle system. Extract CAN message features, ECU diagnostic responses or error codes, and vehicle functional status from the initial response data, and calculate the trigger matching result according to any, all, or ordered combinations of the preset conditions in the test script. If the trigger matching result meets the trigger threshold and sequence constraints, then the component-level probe is scheduled to perform a deep penetration operation on the target component to obtain the internal response data of the component; Based on the preset state range to which the response data inside the component belongs, it is determined whether to continue executing the first type of vehicle-level test action, switch to executing the second type of vehicle-level test action, or terminate the current test step; wherein, the first type of vehicle-level test action includes continuing to send verification messages, and the second type of vehicle-level test action includes switching to send boundary test messages; If the triggering condition is not met within the preset timeout period, the penetration test stimulus at the whole vehicle level will be re-executed according to the preset number of retries, and the process of feature extraction and matching result calculation will be returned. The current test step will be terminated after the maximum number of retries is reached. Functional response data generated throughout the entire testing process is collected at the vehicle level. The initial response data, component internal response data, and functional response data are integrated to obtain cross-granularity test response data.

4. The autonomous driving trustworthiness heterogeneous information security penetration testing method according to claim 1, characterized in that, Based on a unified time benchmark, the cross-granularity test response data is subjected to time-series correlation and event matching to construct an attack attribution evidence chain, including: Set a time tolerance threshold at the microsecond level to obtain data matching and filtering conditions; Based on the data matching and filtering conditions, the cross-granularity test response data is filtered to obtain time-matched vehicle-level test data and component-level test data; By establishing a causal correspondence between time-matched vehicle-level network events and component-level internal state events, an attack tracing evidence chain is constructed, from the attack entry point to component defects and then to functional impact.

5. The autonomous driving trustworthiness heterogeneous information security penetration testing method according to claim 1, characterized in that, Four-dimensional evaluation features are extracted from the attack attribution evidence chain, and a comprehensive risk value is calculated by combining the risk attenuation coefficient corresponding to the coupling path length, including: The relevant features of security threats are extracted from the attack attribution evidence chain to obtain a four-dimensional evaluation feature set; The four-dimensional evaluation feature set is quantitatively calculated to obtain the entry accessibility score, component vulnerability score, coupling path length score, and functional safety impact score, respectively. The risk attenuation coefficient is calculated using the coupling path length as a variable and an exponential attenuation function. The comprehensive risk value is calculated by combining the scores from the four dimensions with the risk decay coefficient.

6. The autonomous driving trustworthiness heterogeneous information security penetration testing method according to claim 1, characterized in that, The comprehensive risk value is mapped to the functional safety level, and the information security penetration testing results are output, including: Obtain the preset mapping relationship between comprehensive risk value and functional safety level to obtain the level conversion rule; The comprehensive risk value is converted according to the level conversion rules to obtain the corresponding functional safety level; By combining the attack attribution evidence chain with the functional security level, the information security penetration test results are obtained.

7. The autonomous driving trustworthiness heterogeneous information security penetration testing method according to claim 1, characterized in that, Also includes: Different cross-granularity test scripts are modeled as arms of a multi-armed gambling machine, and the execution effect of the test scripts is used as the reward value to obtain the basic reinforcement learning model. The reinforcement learning basic model is solved using a reinforcement learning algorithm, and the optimal test script is dynamically selected to obtain the optimized test strategy. The new and effective attack paths are standardized and encapsulated to obtain reusable test script fragments. The reusable test script fragments are used to update the test knowledge base, resulting in an iterated test knowledge base.

8. The autonomous driving trustworthiness heterogeneous information security penetration testing method according to claim 7, characterized in that, Also includes: Obtain the code change information and software bill of materials after the vehicle software upgrade to obtain the software change dataset; The software change dataset is analyzed to obtain the set of affected electronic control units; Based on the aforementioned test knowledge base, historical attack paths related to the affected electronic control unit are filtered to obtain incremental test scripts; Execute the incremental test script to obtain the targeted security regression verification results after the software upgrade.

9. A heterogeneous granularity information security penetration testing system for autonomous driving trustworthiness, characterized in that, A penetration testing method for autonomous driving trustworthiness with heterogeneous information security, based on any one of claims 1 to 8, includes: The synchronization module is configured to deploy dual-port heterogeneous probes at the vehicle level and component level and complete clock synchronization, thereby building a test execution environment with cross-granularity timing alignment. The testing module is configured to perform condition-triggered cross-granularity collaborative tests through a collaborative orchestration engine based on the test execution environment, and obtain cross-granularity test response data. The matching module is configured to perform time-series correlation and event matching on the cross-granularity test response data based on a unified time benchmark, and construct an evidence chain for attack tracing. The evaluation module is configured to extract four-dimensional evaluation features from the attack tracing evidence chain, calculate a comprehensive risk value by combining the risk attenuation coefficient corresponding to the coupling path length, map the comprehensive risk value to a functional safety level, and output the information security penetration verification result.

10. A terminal, characterized in that, The system includes a processor, an input device, an output device, and a memory, which are interconnected. The memory stores a computer program, which includes program instructions. The processor is configured to invoke the program instructions to execute a heterogeneous information security penetration testing method for autonomous driving trustworthiness as described in any one of claims 1 to 8.

Images