Abstract:

For the dynamic interaction problem of safety and security in complex cyber-physical systems, the existing S&S co-analysis methods have insufficient depth and accuracy in analyzing the attack-fault interaction at the component level, making it difficult to comprehensively identify integrated risk scenarios and accurately quantify risks. This leads to potential contradictions in subsequent risk mitigation measures, thereby reducing the effectiveness of comprehensive risk assessment. This paper proposed a safety and security co-analysis and assessment method for intelligent connected vehicles based on ontology and attack-fault tree (Onto-AFT). By constructing an ontology model of the hierarchical dependency relationship between business, function, and component, it standardized the representation of the macroscopic functional architecture and microscopic component interaction logic of cyber-physical systems. Using the Datalog language, dynamic interaction rules for system components, functions, attacks, and faults were designed to achieve joint reasoning of attack paths and fault propagation paths and quantification of failure risks. This method combined the systematic knowledge representation ability of ontology with the multi-logic gate expression ability of attack-fault trees, supporting failure path reasoning in complex interaction scenarios (such as attacks triggering faults, redundant components suppressing failures), and integrating CVSS vulnerability scores and failure rate data to achieve dynamic risk calculation. Experimetation on the autonomous emergency braking system of intelligent connected vehicles, experiments prove that compared with traditional safety and security co-analysis and evaluation methods, Onto-AFT significantly improves the comprehensiveness of risk identification and quantification accuracy, and has high scalability with dynamic rule updates.

Key words: cyber-physical system, safety and security, ontology, risk assessment