面向智能汽车的信息安全漏洞评分模型

于海洋; 陈秀真; 马进; 周志洪; 侯书凝

doi:10.11959/j.issn.2096-109x.2021096

您当前的位置：

首页 >

文章列表页 >

面向智能汽车的信息安全漏洞评分模型

学术论文 | 更新时间：2024-06-03

- 面向智能汽车的信息安全漏洞评分模型
- Information security vulnerability scoring model for intelligent vehicles
- 网络与信息安全学报 2022年8卷第1期页码：167-179
- 作者机构：
  
  1. 上海交通大学网络安全技术研究院，上海 200240
  2. 上海市信息安全综合管理技术重点实验室，上海 200240
- 作者简介：
  
  [ "于海洋（1996− ），男，山东泰安人，上海交通大学硕士生，主要研究方向为车联网信息安全、网络安全" ]
  [ "陈秀真（1977− ），女，山东聊城人，博士，上海交通大学副教授，主要研究方向为车联网信息安全、网络信息系统安全检测与评估、社交网络大数据分析" ]
  [ "马进（1977− ），女，山东滕州人，博士，上海交通大学高级工程师，主要研究方向为大数据与人工智能应用、车联网信息安全、网络空间安全综合管理新技术" ]
  [ "周志洪（1979− ），男，江西九江人，上海交通大学讲师，主要研究方向为密码应用、安全测评、车联网安全" ]
  [ "侯书凝（1998− ），女，江西抚州人，上海交通大学硕士生，主要研究方向为车联网信息安全" ]
- 基金信息：
  
  国家自然科学基金联合基金;The Joint Funds of the National Natural Science Foundation of China(U2003206);上海市工业强基专项;Shanghai industrial foundation project(GYQJ-2018-3-03)
- DOI：10.11959/j.issn.2096-109x.2021096
  中图分类号： TP393
- 网络首发：2022-02，
  
  纸质出版：2022-02-15
- 稿件说明：
移动端阅览
于海洋, 陈秀真, 马进, 等. 面向智能汽车的信息安全漏洞评分模型[J]. 网络与信息安全学报, 2022,8(1):167-179.

Haiyang YU, Xiuzhen CHEN, Jin MA, et al. Information security vulnerability scoring model for intelligent vehicles[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 167-179.
于海洋, 陈秀真, 马进, 等. 面向智能汽车的信息安全漏洞评分模型[J]. 网络与信息安全学报, 2022,8(1):167-179. DOI： 10.11959/j.issn.2096-109x.2021096.

Haiyang YU, Xiuzhen CHEN, Jin MA, et al. Information security vulnerability scoring model for intelligent vehicles[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 167-179. DOI： 10.11959/j.issn.2096-109x.2021096.

摘要

随着汽车智能化、网联化的发展，汽车中集成了越来越多的电子器件，数量庞大的硬件、固件和软件中隐藏着各种设计缺陷和漏洞，这从根本上导致了智能汽车信息安全问题。大量汽车漏洞的披露，严重影响了汽车安全，制约了智能汽车的广泛应用。漏洞管理是降低漏洞危害、改善汽车安全的有效手段。在漏洞管理流程中，漏洞评估是决定漏洞处置优先级的重要一环。但是，现有的漏洞评分系统不能合理地评估智能汽车安全漏洞。为了解决智能汽车漏洞评估不合理的问题，提出面向智能汽车的信息安全漏洞评分模型。基于通用漏洞评分系统（CVSS）漏洞评分原理，根据智能汽车的特点，优化了 CVSS 的攻击向量和攻击复杂度，并添加了财产安全、隐私安全、功能安全和生命安全4个指标来刻画漏洞可能对智能汽车造成的影响；结合机器学习的方法，对CVSS评分公式参数进行了调整，以使其更好地刻画智能汽车信息安全漏洞特点，适应调整后的指标权重。通过实例评估和统计系统特征分布发现，模型拥有更好的多样性和更稳定连续的特征分布，表明模型可以更好地对不同漏洞进行评分；并且基于模型评估得到的漏洞评分，应用层次分析法给出整车脆弱性评估，表征整车风险水平。所提模型相比现有模型可以更为合理地评价智能汽车中信息安全漏洞的严重程度，科学地评估整车或者部分系统的安全风险，为汽车漏洞的修复与加固提供依据。

Abstract

More and more electronic devices are integrated into the modern vehicles with the development of intelligent vehicles.There are various design flaws and vulnerabilities hidden in a large number of hardware

firmware and software.Therefore

the vulnerabilities of intelligent vehicles have become the most important factor affecting the vehicle safety.The safety of vehicles is seriously affected by the disclosure of a large number of vulnerabilities

and the wide application of smart cars is also restricted.Vulnerability management is an effective method to reduce the risk of vulnerabilities and improve vehicle security.And vulnerability scoring is one the important step in vulnerability management procedure.However

current method have no capability assessing automotive vulnerabilities reasonably.In order to handle this problem

a vulnerability scoring model for intelligent vehicles was proposed

which was based on CVSS.The attack vector and attack complexity were optimized

and property security

privacy security

functional safety and life safety were added to characterize the possible impact of the vulnerabilities according to the characteristics of intelligent vehicles.With the machine learning method

the parameters in CVSS scoring formula were optimized to describe the characteristics of intelligent vehicle vulnerabilities and adapt to the adjusted and new added weights.It is found in case study and statistics that the diversity and distribution of the model are better than CVSS

which means the model can better score different vulnerabilities.And then AHP is used to evaluate the vulnerability of the whole vehicle based on the vulnerability score of the model

a score is given representing the risk level of whole vehicle.The proposed model can be used to evaluate the severity of information security vulnerabilities in intelligent vehicles and assess the security risks of the entire vehicle or part of the system reasonably

which can provide an evidence for fixing the vulnerabilities or reinforcing the entire vehicle.

关键词

Keywords

references

田野 . 11部门联合发布《智能汽车创新发展战略》 [J ] . 智能网联汽车 , 2020 ( 2 ): 6 - 7 .

TIAN Y . 11 departments jointly released intelligent vehicle innovation and development strategy [J ] . Intelligent Connected Vehicles , 2020 ( 2 ): 6 - 7 .

ZHAO F , HUANG H Q , JIN H , et al . A hybrid ranking approach to estimate vulnerability for dynamic attacks [J ] . Computers ＆ Mathematics with Applications , 2011 , 62 ( 12 ): 4308 - 4321 .

KERAMATI M , . New vulnerability scoring system for dynamic security evaluation [C ] // Proceedings of 2016 8th International Symposium on Telecommunications (IST) . 2016 : 746 - 751 .

李舟 , 唐聪 , 胡建斌 , 等 . 面向SaaS云平台的安全漏洞评分方法研究 [J ] . 通信学报 , 2016 , 37 ( 8 ): 157 - 166 .

LI Z , TANG C , HU J B , et al . Vulnerabilities scoring approach for cloud SaaS [J ] . Journal on Communications , 2016 , 37 ( 8 ): 157 - 166 .

LIU Q X , ZHANG Y Q . VRSS:a new system for rating and scoring vulnerabilities [J ] . Computer Communications , 2011 , 34 ( 3 ): 264 - 273 .

SPANOS G , SIOZIOU A , ANGELIS L . WIVSS:a new methodology for scoring information systems vulnerabilities [C ] // Proceedings of the 17th Panhellenic Conference on Informatics . 2013 : 83 - 90 .

UR-REHMAN A , GONDAL I , KAMRUZZUMAN J , et al . Vulnerability modelling for hybrid IT systems [C ] // Proceedings of 2019 IEEE International Conference on Industrial Technology . 2019 : 1186 - 1191 .

UR-REHMAN A , GONDAL I , KAMRUZZAMAN J , et al . Vulnerability modelling for hybrid industrial control system networks [J ] . Journal of Grid Computing , 2020 , 18 ( 4 ): 863 - 878 .

BOZORGI M , SAUL L K , SAVAGE S , et al . Beyond heuristics:learning to classify vulnerabilities and predict exploits [C ] // Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining . 2010 : 105 - 114 .

ISO 26262 . Road vehicles-functional safety [S ] . 2011 .

EVITA . E-safety vehicle intrusion protected applications [S ] . 2011 .

LE V H , DEN-HARTOG J , ZANNONE N . Security and privacy for innovative automotive applications:a survey [J ] . Computer Communications , 2018 , 132 : 17 - 41 .

郭亚军 . 综合评价理论与方法 [M ] . 北京 : 科学出版社 , 2002 .

GUO Y J . Theory and method of comprehensive evaluation [M ] . Beijing : Science Press , 2002 .

刘琼 . 基于层次分析法的风险评估系统的研究与设计 [D ] . 西安:西安电子科技大学 , 2009 .

LIU Q . Study and design of the risk assessment system based on analytic hierarchy process [D ] . Xi'an:Xidian University , 2009 .

ZHANG Y J , DENG X Y , WEI D J , et al . Assessment of E-commerce security using AHP and evidential reasoning [J ] . Expert Systems with Applications , 2012 , 39 ( 3 ): 3611 - 3623 .

陈秀真 , 吴越 , 李建华 . 车载信息系统的安全测评体系及方法 [J ] . 信息安全学报 , 2017 , 2 ( 2 ): 15 - 23 .

CHEN X Z , WU Y , LI J H . System and approach of security testing and evaluation for invehicle information systems [J ] . Journal of Cyber Security , 2017 , 2 ( 2 ): 15 - 23 .

WANG R Y , GAO L , SUN Q , et al . An improved CVSS-based vulnerability scoring mechanism [C ] // Proceedings of 2011 Third International Conference on Multimedia Information Networking and Security . 2011 : 352 - 355 .

MELL P , SCARFONE K . Improving the common vulnerability scoring system [J ] . IET Information Security , 2007 , 1 ( 3 ): 119 .

谢丽霞 , 徐伟华 . 改进漏洞基础评分指标权重分配方法 [J ] . 计算机应用 , 2017 , 37 ( 6 ): 1630 - 1635 .

XIE L X , XU W H . Improved weight distribution method of vulnerability basic scoring index [J ] . Journal of Computer Applications , 2017 , 37 ( 6 ): 1630 - 1635 .

浏览量

688

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于人工智能的期货交易风险评估与预警方法

基于期望收益率攻击图的网络风险评估研究

基于证据理论物联网安全态势感知方法研究

基于多因素聚类选择的Android应用程序分类风险评估方法

政府开放数据的国家安全风险评估模型研究