Research on the Open Source Components Security of Intelligent Connected Vehicles Based on SCA

The booming development of intelligent connected vehicles (ICVs) is accompanied by numerous security incidents, so the security research on ICVs has become more and more active. However, on the basis of combing the existing literature, this study finds that the security research of ICVs has the status quo of broad perspective, qualitative description and little domestic research. Based on the core viewpoint of "software defined vehicles", the first study of open source component security research based on the samples of domestically produced ICVs parts and software component analysis is carried out. The study found that firstly, open source components are widely used in ICVs parts, and each ICV uses 112 open source components on average. Secondly, open source components contain a large number of vulnerabilities, with high risk and serious vulnerabilities accounting for nearly 50% of the total, and the components that have been used more often contain more vulnerabilities. Thirdly, it is found that most of the vulnerabilities are caused by a small number of common weaknesses and some mitigation measures are proposed for the vulnerability management of open source components from the perspective of common weaknesses. The study can increase the importance of open source components in the security research of ICVs and provide a reference for the governance of open source components.