Abnormality detection method and device, equipment, storage medium, product and vehicle

Abstract

The invention provides an anomaly detection method and device, equipment, a storage medium, a product and a vehicle, the method is applied to the vehicle, the vehicle comprises a plurality of state machines, setting information of each state machine is determined based on a preset abnormal behavior pattern library, and the abnormal behavior pattern library comprises at least one abnormal behavior detection rule. The state table of each state machine comprises a normal state and an abnormal state; the method comprises the following steps: acquiring first information, wherein the first information comprises vehicle control information; when it is determined that first information corresponds to a first state transition event of a first state machine, an event processing function corresponding to the first state transition event is called, and the first state machine is transited to a first state from a current state; and when it is determined that the first state is an abnormal state, executing an exception handling process. According to the invention, the accuracy and efficiency of vehicle anomaly detection can be improved, and the method has high adaptability and expandability.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an anomaly detection method, device, equipment, storage medium, product and vehicle. Background Art

[0002] With the rapid development of intelligent transportation systems and the continuous improvement of vehicle automation technology, the safety and reliability of vehicles have become the focus of people's attention. In order to ensure the stability and safety of vehicles during driving, it is particularly important to detect abnormal behaviors of vehicles in a timely and accurate manner.

[0003] In traditional vehicle anomaly detection, it usually relies on manual experience and simple diagnostic tools. This method is not only inefficient, but also easily affected by human factors, making it difficult to ensure the accuracy and consistency of diagnosis. With the widespread use of electronic control units (ECUs) and on-board sensors, the functionality and complexity of vehicles are increasing, and the status information is becoming richer and more complex. The various potential anomalies and risks faced by vehicles are also increasing. Traditional diagnostic methods can no longer meet the needs of modern vehicles. Summary of the invention

[0004] In view of this, the embodiments of the present application are committed to providing an anomaly detection method, apparatus, equipment, storage medium, product and vehicle, which perform vehicle anomaly detection based on a state machine and an abnormal behavior pattern library, which can not only improve the accuracy and efficiency of vehicle anomaly detection, but also has strong adaptability and scalability.

[0005] According to a first aspect of an embodiment of the present application, there is provided an abnormality detection method, which is applied to a vehicle, wherein the vehicle includes a plurality of state machines, the setting information of each state machine includes a state table, a state transition event table, and an event processing function table, the setting information of each state machine is determined based on a preset abnormal behavior pattern library, the abnormal behavior pattern library includes at least one abnormal behavior detection rule, and the state table of each state machine includes a normal state and an abnormal state;

[0006] The method comprises:

[0007] Acquiring first information, wherein the first information includes vehicle control information;

[0008] When it is determined that the first information corresponds to a first state transition event of the first state machine, calling an event processing function corresponding to the first state transition event to transition the first state machine from a current state to a first state;

[0009] When it is determined that the first state is an abnormal state, an abnormality handling process is executed.

[0010] Optionally, the method further includes: determining a state machine and a state transition event corresponding to the first information according to the first information and a first mapping table, wherein the first mapping table includes event information corresponding to each state transition event of each state machine.

[0011] Optionally, the first information includes identification information and content information, and the setting information of each state machine also includes an event information identification set. Determining the state machine and state transition event corresponding to the first information according to the first information and the first mapping table includes:

[0012] Matching the identification information of the first information with the event information identification set corresponding to each state machine;

[0013] When it is determined that the identification information of the first information matches the event information identification set corresponding to the first state machine, the first state transition event of the first state machine corresponding to the first information is determined based on the first information and the first mapping table corresponding to the first state machine, and the first mapping table includes the information identification and content information of the event information corresponding to each state transition event of each state machine.

[0014] Optionally, the state table of the first state machine also includes a listening state;

[0015] When the current state of the first state machine is a normal state, and the first state transition event belongs to a preset first mutually exclusive event pair, the first state is a listening state, the first mutually exclusive event pair includes at least two mutually exclusive events, the state transition event associated with the listening state includes the remaining mutually exclusive events in the first mutually exclusive event pair except the first state transition event, and the event processing function corresponding to the state transition event associated with the listening state is used to migrate the first state machine from the listening state to the abnormal state;

[0016] The method further comprises:

[0017] obtaining second information;

[0018] When it is determined that the second information corresponds to the second state transition event of the first state machine, the event processing function corresponding to the second state transition event is called to migrate the first state machine from the listening state to the abnormal state, and execute the abnormal handling process. The second state transition event belongs to the state transition event associated with the listening state.

[0019] Optionally, the state table of the first state machine also includes a suspicious state;

[0020] When the current state of the first state machine is a normal state and the first state transition event belongs to a preset suspicious event set, the first state is a suspicious state.

[0021] Optionally, the first information is vehicle bus message information, and / or the exception handling process includes at least one of outputting alarm information, blocking IP and isolating the host.

[0022] According to a second aspect of an embodiment of the present application, there is provided an abnormality detection device, which is applied to a vehicle, wherein the vehicle comprises a plurality of state machines, the setting information of each state machine comprises a state table, a state transition event table and an event processing function table, the setting information of each state machine is determined based on a preset abnormal behavior pattern library, the abnormal behavior pattern library comprises at least one abnormal behavior detection rule, and the state table of each state machine comprises a normal state and an abnormal state;

[0023] The device comprises:

[0024] A first unit is used to obtain first information, wherein the first information includes vehicle control information;

[0025] The second unit is configured to, when determining that the first information corresponds to a first state transition event of the first state machine, call an event processing function corresponding to the first state transition event to transition the first state machine from a current state to a first state;

[0026] The third unit is used to execute an exception handling process when it is determined that the first state is an abnormal state.

[0027] According to a third aspect of an embodiment of the present application, there is provided an electronic device, including a memory and a processor;

[0028] The memory is connected to the processor and is used to store programs;

[0029] The processor is used to implement the abnormality detection method as described in any one of the first aspects of the embodiments of the present application by running the program in the memory.

[0030] According to a fourth aspect of an embodiment of the present application, a storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the anomaly detection method as described in any one of the first aspects of the embodiments of the present application is implemented.

[0031] According to a fifth aspect of an embodiment of the present application, a computer program product is provided, comprising computer program instructions, which, when executed by a processor, enable the processor to implement the anomaly detection method as described in any one of the first aspects of the embodiments of the present application.

[0032] According to a sixth aspect of an embodiment of the present application, a vehicle is provided, comprising:

[0033] A vehicle body and multiple state machines, the setting information of each state machine includes a state table, a state transition event table and an event processing function table, the setting information of each state machine is determined based on a preset abnormal behavior pattern library, the abnormal behavior pattern library includes at least one abnormal behavior detection rule, and the state table of each state machine includes a normal state and an abnormal state.

[0034] The anomaly detection method provided by the present application introduces a state machine and a preset abnormal behavior pattern library, and creates setting information for each state machine based on the abnormal behavior model library. On the one hand, it can process and analyze various types of vehicle information in real time, reduce data processing time, and thus identify abnormal behavior in a short time, thereby improving detection efficiency; on the other hand, the abnormal behavior pattern library contains abnormal behavior detection rules, and through precise state machine configuration, the possibility of false alarms and missed alarms is reduced, thereby improving detection accuracy; on the other hand, when abnormal behavior is detected, the state machine can immediately migrate to an abnormal state and trigger an abnormal handling process. This rapid response mechanism helps to respond to network attacks in a timely manner and reduce the impact of attacks on vehicles and driving safety; on the other hand, the abnormal behavior pattern library can be continuously updated with the emergence of new security threats to maintain the advancement of the detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0036] Figure 1 A schematic diagram of the structure of a vehicle provided in an embodiment of the present application.

[0037] Figure 2 A flowchart of an anomaly detection method provided in an embodiment of the present application.

[0038] Figure 3 A flowchart of another anomaly detection method provided in an embodiment of the present application.

[0039] Figure 4 A flowchart of another anomaly detection method provided in an embodiment of the present application.

[0040] Figure 5 A schematic diagram of the structure of an anomaly detection device provided in an embodiment of the present application.

[0041] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The technical solution of the embodiment of the present application is suitable for use in scenarios where the vehicle state needs to be finely monitored and abnormal processing is required, covering vehicle production lines in the manufacturing industry, experimental vehicles in the field of scientific research, test vehicles for autonomous driving and intelligent transportation systems, and ground support vehicles in the field of aerospace, etc. In these application scenarios, the vehicle system is equipped with multiple state machines, and the setting information of each state machine is carefully configured in advance based on a preset abnormal behavior pattern library, including a state table, a state transition event table, and an event processing function table, to ensure that each state machine can accurately identify and respond to abnormal states. By implementing the technical solution of the present application, the vehicle system can obtain vehicle information such as control information in real time, and call the corresponding event processing function based on this information to achieve accurate migration of the state machine. When it is detected that the state machine enters an abnormal state, the system will immediately trigger the abnormal processing process, thereby effectively preventing the occurrence of potential faults and ensuring the safe operation of the vehicle. In addition, the method of the present application can also significantly improve the abnormal detection efficiency and accuracy of the vehicle system, and reduce the waste of resources and safety hazards caused by false alarms or missed alarms. By optimizing the configuration of the state machine and the abnormal processing process, the overall performance and reliability of the vehicle system can be further improved, providing strong technical support for vehicle applications in various fields.

[0043] The technical solution provided in the embodiments of the present application can be exemplarily applied to hardware devices such as processors, electronic devices, servers (including cloud servers), or packaged into software programs to be run. When the hardware device executes the processing of the technical solution of the embodiments of the present application, or the above-mentioned software program is run, the automatic splitting of the target task and the automatic calling of the application program interface required for the task can be achieved to complete the purpose of the target task. The embodiments of the present application only exemplarily introduce the specific processing of the technical solution of the present application, and do not limit the specific implementation form of the technical solution of the present application. Any technical implementation form that can execute the processing of the technical solution of the present application can be adopted by the embodiments of the present application.

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] Before introducing this application solution, the relevant technologies are first introduced:

[0046] With the rapid development of intelligent transportation systems and the continuous improvement of vehicle automation technology, the safety and reliability of vehicles have become the focus of people's attention. In order to ensure the stability and safety of vehicles during driving, it is particularly important to detect abnormal behaviors of vehicles in a timely and accurate manner.

[0047] In traditional vehicle anomaly detection, it usually relies on manual experience and simple diagnostic tools. This method is not only inefficient, but also easily affected by human factors, making it difficult to ensure the accuracy and consistency of diagnosis. With the widespread use of electronic control units (ECUs) and on-board sensors, the functionality and complexity of vehicles are increasing, and the status information is becoming richer and more complex. The various potential anomalies and risks faced by vehicles are also increasing. Traditional diagnostic methods can no longer meet the needs of modern vehicles.

[0048] Taking vehicle network security anomaly detection as an example, with the continuous improvement of automobile informationization and intelligence, the Internet of Vehicles system has become an indispensable part of modern automobiles. However, the widespread application of this system has also brought severe information security challenges. Vehicles are vulnerable to network security threats from all parties, causing various abnormal behaviors and seriously endangering driving safety. At present, there is a lack of mature abnormal behavior detection and analysis methods in the field of automobile information security intrusion detection. At present, the industry's practice is usually to conduct comprehensive detection based on the signal specifications of automobile companies, historical data and expert experience. Although this method can discover some security issues to a certain extent, it has many limitations. For example, the detection efficiency is low and it is difficult to process a large amount of complex data in a short time; the accuracy is insufficient, and it is easy to falsely report or miss abnormal events; the response speed is slow, and it is difficult to respond to the ever-changing network attacks in a timely manner.

[0049] In view of this, the embodiments of the present application are committed to providing an anomaly detection method, device, equipment, storage medium, product and vehicle, which perform vehicle anomaly detection based on a state machine and an abnormal behavior pattern library, which can not only improve the accuracy and efficiency of vehicle anomaly detection, but also has strong adaptability and scalability, which are described in detail one by one in the following embodiments.

[0050] Exemplary Systems

[0051] For ease of understanding, the implementation environment of the anomaly detection method provided in the embodiment of the present application is first exemplarily introduced. Figure 1 , Figure 1 A schematic diagram of the structure of a vehicle provided in an embodiment of the present application, and the abnormality detection method provided in the present application can be exemplarily applied to the vehicle.

[0052] like Figure 1As shown, the vehicle includes a vehicle body and a plurality of state machines. The setting information of each state machine includes a state table, a state transition event table, and an event processing function table. The setting information of each state machine is determined based on a preset abnormal behavior pattern library. The abnormal behavior pattern library includes at least one abnormal behavior detection rule. The state table of each state machine includes a normal state and an abnormal state.

[0053] As an optional implementation, a state machine linked list is used to store and manage multiple state machines. The state machine linked list consists of multiple nodes, each node corresponds to a state machine, and contains all the setting information of the state machine, such as a state table, a state transition event table, and an event processing function table. Furthermore, each node also includes a pointer to the next node, that is, each node in the state machine linked list is connected to the next node through the pointer it contains. Exemplarily, when the entire state machine linked list needs to be accessed, it can start from the head node in the linked list and access each state machine in the linked list in turn until the end of the linked list is reached.

[0054] The abnormal behavior pattern library can be understood as a database or knowledge base that integrates multiple abnormal behavior detection rules. Each abnormal behavior detection rule is constructed based on one or more combinations of historical data, expert knowledge, industry standards, and machine learning algorithms, which can provide accurate abnormal detection judgment basis for the vehicle's abnormal detection system, so as to timely discover and handle potential abnormal situations during vehicle operation.

[0055] The abnormal behavior pattern library defines various possible abnormal behavior patterns, such as abnormal speed changes, unstable engine parameters, abnormal brake system responses, abnormal simultaneous occurrence of mutually exclusive events, etc. Each detection rule defines the identification conditions for specific abnormal behaviors, including but not limited to parameter thresholds, time series patterns, spatial position changes, etc. These rules are implemented through logical expressions or algorithms, and can automatically determine whether the vehicle status deviates from the normal range.

[0056] Optionally, in order to adapt to changes in the vehicle operating environment and the emergence of new abnormal behaviors, the abnormal behavior pattern library has the ability to be dynamically updated. Exemplarily, by regularly analyzing historical data (including various parameters and indicators of vehicles in normal and abnormal states) and expert knowledge, the machine learning algorithm is trained to automatically identify and predict new abnormal behavior patterns.

[0057] There are multiple state machines deployed inside the vehicle, each of which is responsible for monitoring the operating status or functional module of a specific aspect of the vehicle. These state machines are independent of each other but work together to form a vehicle state monitoring network. Each state machine has independent setting information, including a state table, a state transition event table, and an event processing function table, which together define the behavior logic of the state machine. Among them, the state table defines all the states that the state machine may be in. The state transition event table lists all events that can trigger the state machine to transfer from the current state to another state. These events may come from vehicle control information, sensor data, user input, etc., and are the basis for the state machine to perform state transitions. For each state transition event, there is a corresponding event processing function, which defines how the state machine should respond when the event occurs, including state transition logic and necessary operation instructions. The event processing function table associates the state transition event with the specific event processing function.

[0058] The setting information of each state machine is established based on the abnormal behavior detection rules in the abnormal behavior pattern library.

[0059] Specifically, based on the rules and data in the abnormal behavior pattern library, define all possible states of each state machine, including at least normal and abnormal states, to ensure that each state has a clear meaning and trigger conditions, and then organize the defined states into a state table to facilitate subsequent state management and migration. The normal state means that the system or component runs smoothly and as expected, and can be considered as normal; the abnormal state indicates potential problems or failures.

[0060] Optionally, the state table of the state machine may also include a monitoring state, a suspicious state, a blocking state, etc., which will be explained in subsequent contents and will not be described in detail here.

[0061] Furthermore, various possible events or conditions within the monitoring range are analyzed, such as control information reception, sensor data changes, user input, etc., to identify events that can trigger state transitions. The identified state transition events are organized into an event table and associated with the state table, and the conditions for each state transition event to trigger state transitions are defined.

[0062] Furthermore, the detection rules in the abnormal behavior pattern library are mapped to the corresponding state machine event processing logic, which contains the logic of state update and abnormal handling measures. This usually involves the following steps: Analyze each abnormal behavior detection rule in the abnormal behavior pattern library to understand its identification conditions, characteristic parameters and abnormal behavior description; associate the identification conditions in the abnormal behavior detection rules with the defined events to determine which events may trigger the execution of the rules; define the state transition logic based on the execution results of the rules. If the rule determines that the vehicle enters an abnormal state, it triggers the transition from the current state to the abnormal state.

[0063] Furthermore, each established state machine is integrated into the vehicle system and subjected to functional and performance tests to ensure that it can work in conjunction with other system components.

[0064] Furthermore, new data and abnormal situations are continuously collected during the operation of the vehicle. Based on the new data and abnormal situations, the rules in the abnormal behavior pattern library are optimized and adjusted. Then, based on the rule optimization results and vehicle operation requirements, the state machine is updated and improved to improve its detection performance and accuracy.

[0065] During vehicle operation, the vehicle system generates various data, which may come from various sensors, ECU (Electronic Control Unit), vehicle information system and external data sources such as cloud servers, APP, etc. Each data source may provide data on different aspects such as vehicle status, driving behavior, environmental information, etc.

[0066] These data are collected in real time and transmitted to the vehicle's state machine module through preset interfaces and protocols. The state machine module processes and analyzes these data in real time through preset state sets and state transition rules. Whenever new data is generated and input into the state machine, the state machine will determine whether to trigger state transition based on the current state, input events, and rules in the abnormal behavior pattern library. If the data indicates that the current state of the vehicle is abnormal or has potential risks, the state machine will respond quickly and execute the corresponding state transition and exception handling logic, thereby achieving real-time monitoring and effective management of the vehicle's status.

[0067] As for the specific anomaly detection method, it will be explained in subsequent embodiments and will not be described in detail here.

[0068] As an optional implementation method, TBOX / IVI is used to transmit the state machine to the CAN gateway. In addition to transmitting the setting information of the state machine, when transmitting the state machine, auxiliary information such as the length of each state machine, the length of the ID list, the length of the state table, the length of the event table, and the length of the state transition table also need to be transmitted to the CAN gateway to facilitate the parsing of the CAN gateway program. When there are multiple state machines in the system, multiple state machine information needs to be transmitted, and information such as the number of state machines and the total length of all state machines needs to be transmitted. By transmitting this detailed information, it can be ensured that the CAN gateway has enough information to correctly parse the behavior of the state machine and update the current state of the state machine according to the received CAN messages and events.

[0069] As an optional implementation method, the abnormal behavior pattern library is transmitted to the CAN gateway by using TBOX / IVI to update the abnormal behavior pattern library in the CAN gateway.

[0070] Exemplary Methods

[0071] Figure 2 The flowchart of an anomaly detection method provided in the embodiment of the present application is shown in FIG. The anomaly detection method provided in the embodiment can be exemplarily applied to Figure 1 Vehicles in. Figure 2 As shown, the method includes steps S201-S203:

[0072] S201. Acquire first information, where the first information includes vehicle control information.

[0073] The first information can be understood as a series of data and information collected and generated in real time from the vehicle itself and its surrounding environment during the operation of the vehicle, covering information such as the vehicle's operating status, operating instructions, environmental changes, and possible faults or abnormal prompts.

[0074] The first information includes vehicle control information, which can be understood as control information directly related to vehicle driving and operation generated during the operation of the vehicle, usually provided by various control systems and / or sensors of the vehicle, and used to describe the current operation status of the vehicle and the driver's operation intention. Optionally, the vehicle control information includes, but is not limited to, driving status information (such as vehicle speed, steering angle, brake status, etc.), power system information (such as engine speed, throttle opening, battery power, motor speed, etc.), body control information (such as light status, wiper status, air conditioning settings, door and window status, etc.), safety system information (such as seat belt status, airbag status, anti-lock brake system (ABS) status, etc.), advanced driver assistance system information (such as environmental perception information provided by sensors such as radar and cameras, etc.), and other information. One or more.

[0075] Optionally, the first information may also include other data related to vehicle operation, such as data from the vehicle information system, external environment data (such as temperature, humidity, road conditions, etc.), etc., which is not limited in this application.

[0076] Optionally, the first information and / or vehicle control information includes information on the interaction between the vehicle system and the outside world, including but not limited to cloud docking, external communications, firewalls, APPs, APIs and other component data.

[0077] Optionally, the first information is obtained through sensor acquisition, ECU integration, vehicle network communication, external data source access, etc.

[0078] Optionally, data aggregation is performed by assembling data packets through vehicle probes.

[0079] Optionally, the first information obtained usually needs to be preprocessed, such as denoising, calibration, formatting, including data extraction, conversion, loading, deduplication and merging, etc., to facilitate subsequent analysis and detection.

[0080] As an optional implementation manner, the first information is vehicle bus message information.

[0081] The vehicle bus is the main network for internal communication in the vehicle, and is responsible for data transmission between various modules in the vehicle.

[0082] In vehicle systems, whether it is information from sensors, ECUs or other control modules, it ultimately needs to be transmitted through some form of communication protocol. Bus messages, as the specific implementation of these communication protocols, carry the underlying transmission tasks of various information. When information is sent to the bus, it is encapsulated into one or more bus messages. These messages contain information such as the source address, destination address, data content, and checksum to ensure the correct transmission and reception of information. At the receiving end, the state machine parses these bus messages, extracts the information, and processes or responds as needed.

[0083] Information related to vehicle operation, control, and status monitoring can be transmitted in the form of bus messages, including but not limited to basic information such as engine status, vehicle speed, steering angle, brake status, lighting control, and higher-level driver assistance system information, such as radar, camera and other sensor data.

[0084] Since bus messages carry communication data between various vehicle systems, potential security threats or abnormal behaviors can be detected by monitoring and analyzing these messages.

[0085] Taking abnormal behavior detection in the Internet of Vehicles as an example, by analyzing bus messages, the communication status of various systems and components inside the vehicle can be obtained, thereby discovering potential security threats or abnormal behaviors.

[0086] S202: When it is determined that the first information corresponds to a first state transition event of the first state machine, an event processing function corresponding to the first state transition event is called to transition the first state machine from a current state to a first state.

[0087] Before executing step S202, it is necessary to determine whether the first information corresponds to a state transition event in each state machine, and which state transition event of which state machine it corresponds to. Figure 3 As shown, the method further includes step S301:

[0088] S301. Determine a state machine and a state transition event corresponding to the first information according to the first information and a first mapping table, wherein the first mapping table includes event information corresponding to each state transition event of each state machine.

[0089] The first mapping table is a predefined data structure, which records the event information corresponding to each state transition event of each state machine.

[0090] The event information can be understood as data elements that directly meet the triggering conditions of the state transition event, which may include specific values, signal patterns, data combinations or logical conditions, etc. In the first mapping table, each state transition event of each state machine is associated with its corresponding event information. When the first information matches the event information of a state transition event, the state transition event will be triggered.

[0091] The first mapping table is constructed based on the abnormal behavior pattern library to ensure that the behavior characteristics of the vehicle in various states can be accurately reflected. Optionally, the first mapping table is also constructed based on the design specifications of the vehicle.

[0092] Specifically, after obtaining the first information, the system will compare the first information with the event information in the first mapping table, and the comparison process may involve matching in multiple dimensions, etc. If the first information completely matches a certain event information in the mapping table or satisfies certain matching conditions, the system will determine the state transition event associated with the event information and the state machine corresponding to the state transition event as the state machine and state transition event corresponding to the first information, that is, the first state machine and the first state transition event. If the first information does not match any event information in the mapping table, the system may adopt a default processing strategy, such as recording unmatched information, sending a warning, or entering a safe mode, etc.

[0093] As an optional implementation, the first information includes identification information and content information, and the setting information of each state machine also includes an event information identification set. Step S301 "determining the state machine and state transition event corresponding to the first information according to the first information and the first mapping table" includes steps A1-A2:

[0094] A1. Match the identification information of the first information with the event information identification set corresponding to each state machine.

[0095] In this implementation, the first information includes two parts: identification information and content information. The identification information is used to uniquely identify the type or source of the first information, which may be a specific code, number or identifier. The content information includes specific data or content of the first information, such as actual values ​​of vehicle control information such as vehicle speed and steering angle.

[0096] Exemplarily, when the first information is a CAN message, the first information includes an ID field and a Date field of the CAN message, wherein the ID field serves as identification information of the CAN message, and each CAN message has a unique ID that identifies the source and destination of the message; the Date field stores the specific content of the message, which usually includes specific control commands or parameters, so as to accurately identify events.

[0097] The setting information of each state machine includes an event information identification set, which contains the identification of event information corresponding to all possible state transition events under the state machine. The event information identification set is used to quickly match the identification information of the first information, so as to determine the state machine corresponding to the first information.

[0098] Specifically, after obtaining the first information, the identification information of the first information is matched with the event information identification set corresponding to each state machine. This matching process can be a simple search, hash mapping, or a more complex pattern matching algorithm. If the identification information of the first information matches an identification in the event information identification set of a state machine (such as the identification information of the first information is the same as a certain identification), then the system determines the state machine corresponding to the first information (i.e., the first state machine).

[0099] As an optional implementation method, when multiple state machines are stored and managed in the form of a state machine linked list, when the first information is received, first enter the first node of the linked list, match the identification information of the first information with the event information identification set of the state machine corresponding to the first node of the state machine linked list, if it matches, enter step A2, if not, enter the next node in the state machine linked list, match the identification information of the first information with the time information identification set of the state machine corresponding to the next node, if it matches, enter step A2, if not, enter the next node in the state machine linked list, and repeat the above operations until a state machine matching the identification information of the first information is found, and enter step A2.

[0100] A2. When it is determined that the identification information of the first information matches the event information identification set corresponding to the first state machine, the first state transition event of the first state machine corresponding to the first information is determined based on the first information and the first mapping table corresponding to the first state machine, and the first mapping table includes the information identification and content information of the event information corresponding to each state transition event of each state machine.

[0101] After determining the first state machine, the system further determines the state transition event corresponding to the first information according to the content information of the first information and the first mapping table corresponding to the first state machine.

[0102] Optionally, the system will compare the content information of the first information with the event information of all possible state transition events of the first state machine in the first mapping table. If the content information of the first information matches the event information of a state transition event of the first state machine, the system will determine the state transition event as the state transition event corresponding to the first information (i.e., the first state transition event).

[0103] Optionally, the first mapping table contains information identifiers and content information of event information corresponding to each state transition event. The system will match the identification information of the first information with the information identifiers of all possible state transition events of the first state machine in the first mapping table, and / or match the content information of the first information with the event information of all possible state transition events of the first state machine in the first mapping table to determine the state transition event corresponding to the first information (i.e., the first state transition event).

[0104] This implementation method greatly reduces the amount of calculation when the system processes the first information through pre-matching of identification information, and improves the efficiency of determining the state machine and state transition events.

[0105] Further, after determining in step S301 that the first information corresponds to the first state transition event of the first state machine, step S202 is executed to call the event processing function corresponding to the first state transition event to migrate the first state machine from the current state to the first state.

[0106] According to the above content, in the design of the state machine, each state transition event is associated with an event processing function, which defines how the state machine should respond when the state transition event occurs.

[0107] After the first state transition event is triggered, the event processing function corresponding to the first state transition event will be called to migrate the first state machine from the current state to another new state. This new state is the first state, which is determined according to the definition of the first state transition event and the logic of the event processing function.

[0108] The migration process includes updating the internal state representation of the state machine, performing any necessary operations related to the state migration, etc. These operations may include updating the state variables of the state machine, triggering other events related to the state migration, or notifying other system components that the state of the state machine has changed.

[0109] S203: When it is determined that the first state is an abnormal state, execute an abnormality handling process.

[0110] Before executing step S203, the system has acquired the first information through step S201, and determined the state machine (i.e., the first state machine) and the state transition event corresponding to the first information through step S202 (which may include the previous step S301 and its optional implementation methods A1 and A2), thereby migrating the first state machine from the current state to the first state.

[0111] In step S203, the system determines whether the latest state (i.e., the first state) of the first state machine after state migration is an abnormal state. This determination is usually made based on the state table of the state machine, which clearly defines the normal state and the abnormal state. By comparing the current state with the abnormal state defined in the state table, it can be determined whether the first state of the first state machine is an abnormal state.

[0112] If the first state is determined to be an abnormal state, the system will immediately trigger the abnormality handling process.

[0113] The exception handling process may include multiple steps, such as recording abnormal information, sending warnings to drivers, limiting vehicle functions, starting fault diagnosis programs, etc. The specific exception handling measures depend on the type and severity of the abnormality and the design specifications and safety requirements of the vehicle, which are not limited in this application. Optionally, the exception handling process includes at least one of outputting alarm information, blocking IP, and isolating the host.

[0114] In some cases, after executing the exception handling process, the system may try to restore the state machine to a normal state, or take other measures to mitigate the impact of the abnormal state. This may involve resetting the state of the state machine, reinitializing related parameters, or performing other recovery operations.

[0115] The anomaly detection method provided by the present application introduces a state machine and a preset abnormal behavior pattern library, and creates setting information for each state machine based on the abnormal behavior model library. On the one hand, it can process and analyze various types of vehicle information in real time, reduce data processing time, and thus identify abnormal behavior in a short time, thereby improving detection efficiency; on the other hand, the abnormal behavior pattern library contains abnormal behavior detection rules, and through precise state machine configuration, the possibility of false alarms and missed alarms is reduced, thereby improving detection accuracy; on the other hand, when abnormal behavior is detected, the state machine can immediately migrate to an abnormal state and trigger an abnormal handling process. This rapid response mechanism helps to respond to network attacks in a timely manner and reduce the impact of attacks on vehicles and driving safety; on the other hand, the abnormal behavior pattern library can be continuously updated with the emergence of new security threats to maintain the advancement of the detection method.

[0116] As an optional implementation manner, the state table of the first state machine also includes a listening state.

[0117] When the current state of the first state machine is a normal state, and the first state transition event belongs to a preset first mutually exclusive event pair, the first state is a listening state, the first mutually exclusive event pair includes at least two mutually exclusive events, the state transition event associated with the listening state includes the remaining mutually exclusive events in the first mutually exclusive event pair except the first state transition event, and the event processing function corresponding to the state transition event associated with the listening state is used to migrate the first state machine from the listening state to the abnormal state.

[0118] like Figure 4 As shown, after the first state machine is migrated from the current state to the listening state, the method further includes steps S401-S402:

[0119] S401. Obtain second information.

[0120] S402. When it is determined that the second information corresponds to the second state transition event of the first state machine, call the event processing function corresponding to the second state transition event, migrate the first state machine from the listening state to the abnormal state, and execute the abnormal processing process. The second state transition event belongs to the state transition event associated with the listening state.

[0121] In this implementation, the state table of the first state machine, in addition to the normal state and the abnormal state, also adds a monitoring state, and the monitoring state is used to monitor the occurrence of a specific event pair (ie, the first mutually exclusive event pair).

[0122] The first mutually exclusive event pair includes at least two mutually exclusive events, which are logically mutually exclusive, that is, they cannot occur at the same time. When the mutually exclusive events in the mutually exclusive event pair occur at the same time, the vehicle is in an abnormal state.

[0123] If the first state transition event belongs to a preset first mutually exclusive event pair, then when the event occurs, the first state machine will not directly transition to the abnormal state, but will first enter the listening state.

[0124] When the first state machine is in the listening state, it is associated with a set of state transition events, which includes the remaining mutually exclusive events in the first mutually exclusive event pair except the first state transition event. The event processing functions corresponding to the state transition events associated with the listening state are designed to be able to migrate the first state machine from the listening state to the abnormal state. These event processing functions may contain additional logic for processing the mutually exclusive events detected in the listening state and triggering the abnormal handling process.

[0125] In the listening state, the first state machine will continuously monitor the remaining mutually exclusive events in the first mutually exclusive event pair except the first state transition event. If any of these associated state transition events occurs in the listening state, the first state machine will immediately migrate from the listening state to the abnormal state.

[0126] Specifically, in this implementation, when the first state is the monitoring state, during the monitoring state, the system will continue to obtain vehicle control information, which is referred to as second information.

[0127] If the state transition event corresponding to the second information belongs to the state transition event associated with the listening state (i.e., the remaining mutually exclusive events corresponding to the first mutually exclusive event), the system will call the event processing function corresponding to the event. This event processing function will migrate the first state machine from the listening state to the abnormal state. Once the first state machine migrates to the abnormal state, the system will immediately execute the abnormal processing process.

[0128] Exemplarily, the first state machine is responsible for monitoring the vehicle's braking system, and the first mutually exclusive event pair includes two mutually exclusive events: "brake overheating" and "brake oil pressure is too low". When the system detects brake overheating (i.e., the first state transition event), it will migrate the first state machine from the normal state to the listening state. In the listening state, the system will continue to monitor whether the brake oil pressure is too low. If the brake oil pressure is indeed too low (i.e., the second state transition event), the system will immediately migrate the first state machine from the listening state to the abnormal state, and execute the corresponding exception handling process, such as sending a warning to the driver, starting the backup brake system, etc.

[0129] This implementation method, by introducing the concepts of monitoring state and mutually exclusive event pairs, enables the system to detect abnormal situations more accurately, especially in certain complex scenarios, by monitoring the occurrence of mutually exclusive events, potential problems can be discovered earlier. On the other hand, the existence of the monitoring state enables the system to adopt a more cautious and conservative strategy when facing uncertain or ambiguous information, thereby avoiding misjudgments or missed judgments. On the other hand, this optional implementation method is particularly suitable for vehicle systems that require high reliability and safety, such as the decision-making and control systems of autonomous vehicles, on-board safety systems, etc. In summary, this optional implementation method enhances the flexibility and accuracy of the anomaly detection method by introducing the monitoring state and mutually exclusive event pairs, and provides a higher level of safety protection for the vehicle system.

[0130] As an optional implementation, the state table of the first state machine also includes a suspicious state;

[0131] When the current state of the first state machine is a normal state and the first state transition event belongs to a preset suspicious event set, the first state is a suspicious state.

[0132] In this implementation, the state table of the first state machine, in addition to the normal state and the abnormal state, also adds a suspicious state, which is a special state used to identify events that may have problems but have not yet been determined.

[0133] The suspicious event set is a preset event set that contains state transition events that are considered suspicious and require additional attention.

[0134] When the current state of the first state machine is normal and the state transition event corresponding to the first information belongs to a preset suspicious event set, the system will transition the first state machine to a suspicious state by calling an event processing function corresponding to the first state transition event.

[0135] In the suspicious state, the first state machine will continue to monitor the first information of the vehicle to determine whether there are further abnormal signs.

[0136] The suspicious state is a temporary state. The system will decide whether to migrate the state to the abnormal state or restore it to the normal state based on the subsequent monitoring results. If the subsequent monitoring results show that there is indeed an abnormality, the system will trigger the corresponding state migration event, migrate the first state machine from the suspicious state to the abnormal state, and execute the abnormality handling process. If the subsequent monitoring results show that there is no abnormality, or the impact of the suspicious event has been eliminated, the system will trigger the state recovery event and restore the first state machine from the suspicious state to the normal state.

[0137] Exemplarily, the first state machine is responsible for monitoring the tire pressure of the vehicle, and the suspicious event set includes the event of "slight drop in tire pressure". When the system detects a slight drop in tire pressure (i.e., the first state transition event), it will migrate the first state machine from the normal state to the suspicious state. In the suspicious state, the system will continue to monitor the changes in tire pressure. If the tire pressure continues to drop and reaches the abnormal threshold, the system will immediately migrate the first state machine from the suspicious state to the abnormal state and execute the corresponding abnormal handling process. If the tire pressure remains stable or returns to normal levels, the system will trigger a state recovery event to restore the first state machine from the suspicious state to the normal state.

[0138] This implementation provides additional layers and flexibility to the anomaly detection method by introducing suspicious states and suspicious event sets, allowing the system to more flexibly handle events that have potential risks but have not yet been clearly determined to be abnormal, so as to take preventive measures in advance and improve the safety and reliability of the vehicle. At the same time, the introduction of suspicious states also helps to reduce false positives and false negatives and improve the accuracy of anomaly detection.

[0139] Exemplary Devices

[0140] Corresponding to the above-mentioned abnormality detection method, an embodiment of the present application also provides an abnormality detection device, which is applied to a vehicle, wherein the vehicle includes multiple state machines, and the setting information of each state machine includes a state table, a state transition event table, and an event processing function table. The setting information of each state machine is determined based on a preset abnormal behavior pattern library, and the abnormal behavior pattern library includes at least one abnormal behavior detection rule, and the state table of each state machine includes a normal state and an abnormal state. Figure 5 is a schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present application, such as Figure 5 As shown, the abnormality detection device provided in the embodiment of the present application includes:

[0141] The first unit 501 is used to obtain first information, where the first information includes vehicle control information;

[0142] The second unit 502 is used to call the event processing function corresponding to the first state transition event when it is determined that the first information corresponds to the first state transition event of the first state machine, and transition the first state machine from the current state to the first state;

[0143] The third unit 503 is configured to execute an exception handling process when it is determined that the first state is an abnormal state.

[0144] The abnormality detection device provided by the present application introduces a state machine and a preset abnormal behavior pattern library, and creates setting information for each state machine based on the abnormal behavior model library. On the one hand, it can process and analyze various types of vehicle information in real time, reduce data processing time, and thus identify abnormal behavior in a short time, thereby improving detection efficiency; on the other hand, the abnormal behavior pattern library contains abnormal behavior detection rules, and through precise state machine configuration, the possibility of false alarms and missed alarms is reduced, thereby improving detection accuracy; on the other hand, when abnormal behavior is detected, the state machine can immediately migrate to an abnormal state and trigger an abnormal handling process. This rapid response mechanism helps to respond to network attacks in a timely manner and reduce the impact of attacks on vehicles and driving safety; on the other hand, the abnormal behavior pattern library can be continuously updated with the emergence of new security threats to maintain the advancement of the detection method.

[0145] Optionally, the device further comprises:

[0146] The fourth unit is used to determine the state machine and state transition event corresponding to the first information according to the first information and a first mapping table, wherein the first mapping table includes event information corresponding to each state transition event of each state machine.

[0147] Optionally, the first information includes identification information and content information, the setting information of each state machine also includes an event information identification set, and the fourth unit can be specifically used to:

[0148] Matching the identification information of the first information with the event information identification set corresponding to each state machine;

[0149] When it is determined that the identification information of the first information matches the event information identification set corresponding to the first state machine, the first state transition event of the first state machine corresponding to the first information is determined based on the first information and the first mapping table corresponding to the first state machine, and the first mapping table includes the information identification and content information of the event information corresponding to each state transition event of each state machine.

[0150] Optionally, the state table of the first state machine also includes a listening state;

[0151] When the current state of the first state machine is a normal state, and the first state transition event belongs to a preset first mutually exclusive event pair, the first state is a listening state, the first mutually exclusive event pair includes at least two mutually exclusive events, the state transition event associated with the listening state includes the remaining mutually exclusive events in the first mutually exclusive event pair except the first state transition event, and the event processing function corresponding to the state transition event associated with the listening state is used to migrate the first state machine from the listening state to the abnormal state;

[0152] The device also includes:

[0153] A fifth unit is used to obtain second information;

[0154] The sixth unit is used to call the event processing function corresponding to the second state transition event of the first state machine when it is determined that the second information corresponds to the second state transition event, migrate the first state machine from the listening state to the abnormal state, and execute the abnormal handling process. The second state transition event belongs to the state transition event associated with the listening state.

[0155] Optionally, the state table of the first state machine also includes a suspicious state;

[0156] When the current state of the first state machine is a normal state and the first state transition event belongs to a preset suspicious event set, the first state is a suspicious state.

[0157] Optionally, the first information is vehicle bus message information, and / or the exception handling process includes at least one of outputting alarm information, blocking IP and isolating the host.

[0158] The anomaly detection device provided in this embodiment belongs to the same application concept as the anomaly detection method provided in the above embodiments of this application, can execute the anomaly detection method provided in any of the above embodiments of this application, and has the corresponding functional modules and beneficial effects of executing the anomaly detection method. For technical details not fully described in this embodiment, please refer to the specific processing content of the anomaly detection method provided in the above embodiments of this application, which will not be repeated here.

[0159] The functions implemented by the above first unit 501, the second unit 502 and the third unit 503 may be implemented by the same or different processors, respectively, and the embodiment of the present application is not limited thereto.

[0160] It should be understood that the units in the above devices can be implemented in the form of a processor calling software. For example, the device includes a processor, the processor is connected to a memory, and instructions are stored in the memory. The processor calls the instructions stored in the memory to implement any of the above methods or realize the functions of each unit of the device, wherein the processor can be a general-purpose processor, such as a CPU or a microprocessor, etc., and the memory can be a memory in the device or a memory outside the device. Alternatively, the units in the device can be implemented in the form of hardware circuits, and the functions of some or all units can be realized by designing the hardware circuits. The hardware circuit can be understood as one or more processors; for example, in one implementation, the hardware circuit is an ASIC, and the functions of some or all of the above units are realized by designing the logical relationship of the components in the circuit; for another example, in another implementation, the hardware circuit can be implemented by PLD, taking FPGA as an example, which can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by the configuration file, so as to realize the functions of some or all of the above units. All units of the above devices can be implemented in the form of a processor calling software, or in the form of hardware circuits, or in part by a processor calling software, and the remaining part is implemented in the form of hardware circuits.

[0161] In an embodiment of the present application, a processor is a circuit with the ability to process signals. In one implementation, the processor may be a circuit with the ability to read and run instructions, such as a CPU, a microprocessor, a GPU, or a DSP; in another implementation, the processor may implement certain functions through the logical relationship of a hardware circuit, and the logical relationship of the hardware circuit is fixed or reconfigurable, such as a hardware circuit implemented by an ASIC or PLD, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the hardware circuit configuration can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as an NPU, TPU, DPU, etc.

[0162] It can be seen that each unit in the above device can be one or more processors (or processing circuits) configured to implement the above method, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0163] In addition, all or part of the units in the above device can be integrated together, or can be implemented independently. In one implementation, these units are integrated together and implemented in the form of a SOC. The SOC may include at least one processor for implementing any of the above methods or implementing the functions of each unit of the device. The type of the at least one processor may be different, for example, including a CPU and an FPGA, a CPU and an artificial intelligence processor, a CPU and a GPU, etc.

[0164] Exemplary Electronic Devices

[0165] The present application also provides an electronic device for use in a vehicle, wherein the vehicle includes a plurality of state machines, and the setting information of each state machine includes a state table, a state transition event table, and an event processing function table. The setting information of each state machine is determined based on a preset abnormal behavior pattern library, and the abnormal behavior pattern library includes at least one abnormal behavior detection rule. The state table of each state machine includes a normal state and an abnormal state. Figure 6 As shown, the device includes:

[0166] Memory 200 and processor 210;

[0167] The memory 200 is connected to the processor 210 and is used to store programs;

[0168] The processor 210 is used to implement the abnormality detection method disclosed in any of the above embodiments by running the program stored in the memory 200.

[0169] Specifically, the above-mentioned abnormality detection device may further include: a bus, a communication interface 220 , an input device 230 and an output device 240 .

[0170] The processor 210, the memory 200, the communication interface 220, the input device 230 and the output device 240 are connected to each other via a bus.

[0171] A bus may include a pathway that transfers information between components of a computer system.

[0172] The processor 210 may be a general-purpose processor, such as a general-purpose central processing unit (CPU), a microprocessor, etc., or an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the scheme of the present invention. It may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0173] The processor 210 may include a main processor, and may also include a baseband chip, a modem, and the like.

[0174] The memory 200 stores a program for executing the technical solution of the present invention, and may also store an operating system and other key services. Specifically, the program may include a program code, and the program code includes a computer operation instruction. More specifically, the memory 200 may include a read-only memory (ROM), other types of static storage devices that can store static information and instructions, a random access memory (RAM), other types of dynamic storage devices that can store information and instructions, a disk storage, a flash, and the like.

[0175] The input device 230 may include a device for receiving data and information input by a user, such as a keyboard, a mouse, a camera, a scanner, a light pen, a voice input device, a touch screen, a pedometer, or a gravity sensor.

[0176] Output device 240 may include devices that allow information to be output to a user, such as a display screen, printer, speaker, etc.

[0177] The communication interface 220 may include any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, a radio access network (RAN), a wireless local area network (WLAN), etc.

[0178] The processor 210 executes the program stored in the memory 200 and calls other devices, which can be used to implement each step of any anomaly detection method provided in the above embodiments of the present application.

[0179] An embodiment of the present application also proposes a chip, which includes a processor and a data interface. The processor reads and runs a program stored in a memory through the data interface to execute the anomaly detection method introduced in any of the above embodiments. The specific processing process and its beneficial effects can be found in the above-mentioned embodiment introduction of the anomaly detection method.

[0180] Exemplary computer program products and storage media

[0181] In addition to the above-mentioned methods and devices, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the anomaly detection method according to various embodiments of the present application described in any of the above-mentioned embodiments of this specification.

[0182] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0183] In addition, the embodiment of the present application may also be a storage medium on which a computer program is stored. The computer program is executed by a processor to execute the steps of the abnormality detection method according to various embodiments of the present application described in any of the above embodiments of this specification, and specifically the following steps may be implemented:

[0184] S201. Acquire first information, where the first information includes vehicle control information.

[0185] S202: When it is determined that the first information corresponds to a first state transition event of the first state machine, an event processing function corresponding to the first state transition event is called to transition the first state machine from a current state to a first state.

[0186] S203: When it is determined that the first state is an abnormal state, execute an abnormality handling process

[0187] For the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0188] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0189] The steps in the methods of each embodiment of the present application can be adjusted in order, combined and deleted according to actual needs, and the technical features recorded in each embodiment can be replaced or combined.

[0190] The modules and sub-modules in the devices and terminals of the various embodiments of the present application can be combined, divided and deleted according to actual needs.

[0191] In the several embodiments provided in the present application, it should be understood that the disclosed terminals, devices and methods can be implemented in other ways. For example, the terminal embodiments described above are only schematic, for example, the division of modules or submodules is only a logical function division, and there may be other division methods in actual implementation, for example, multiple submodules or modules can be combined or integrated into another module, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0192] The modules or submodules described as separate components may or may not be physically separated, and the components of the modules or submodules may or may not be physical modules or submodules, that is, they may be located in one place, or they may be distributed on multiple network modules or submodules. Some or all of the modules or submodules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0193] In addition, each functional module or submodule in each embodiment of the present application may be integrated into one processing module, or each module or submodule may exist physically separately, or two or more modules or submodules may be integrated into one module. The above-mentioned integrated modules or submodules may be implemented in the form of hardware or in the form of software functional modules or submodules.

[0194] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0195] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly by hardware, software units executed by a processor, or a combination of the two. The software units may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0196] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0197] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An anomaly detection method, characterized in that: Applied to a vehicle, the vehicle includes a plurality of state machines, the setting information of each state machine includes a state table, a state transition event table and an event processing function table, the setting information of each state machine is determined based on a preset abnormal behavior pattern library, the abnormal behavior pattern library includes at least one abnormal behavior detection rule, and the state table of each state machine includes a normal state and an abnormal state; The method comprises: Acquiring first information, wherein the first information includes vehicle control information; When it is determined that the first information corresponds to a first state transition event of the first state machine, calling an event processing function corresponding to the first state transition event to transition the first state machine from a current state to a first state; When it is determined that the first state is an abnormal state, an abnormality handling process is executed.

2. The method according to claim 1, characterized in that The method further comprises: The state machine and the state transition event corresponding to the first information are determined according to the first information and a first mapping table, wherein the first mapping table includes event information corresponding to each state transition event of each state machine.

3. The method according to claim 2, characterized in that The first information includes identification information and content information, and the setting information of each state machine also includes an event information identification set; Determining, according to the first information and the first mapping table, a state machine and a state transition event corresponding to the first information, including: Matching the identification information of the first information with the event information identification set corresponding to each state machine; When it is determined that the identification information of the first information matches the event information identification set corresponding to the first state machine, the first state transition event of the first state machine corresponding to the first information is determined based on the first information and the first mapping table corresponding to the first state machine, and the first mapping table includes the information identification and content information of the event information corresponding to each state transition event of each state machine.

4. The method according to claim 1, characterized in that: The state table of the first state machine also includes a listening state; When the current state of the first state machine is a normal state, and the first state transition event belongs to a preset first mutually exclusive event pair, the first state is a listening state, the first mutually exclusive event pair includes at least two mutually exclusive events, the state transition event associated with the listening state includes the remaining mutually exclusive events in the first mutually exclusive event pair except the first state transition event, and the event processing function corresponding to the state transition event associated with the listening state is used to migrate the first state machine from the listening state to the abnormal state; The method further comprises: obtaining second information; When it is determined that the second information corresponds to the second state transition event of the first state machine, the event processing function corresponding to the second state transition event is called to migrate the first state machine from the listening state to the abnormal state, and execute the abnormal handling process. The second state transition event belongs to the state transition event associated with the listening state.

5. The method according to claim 1, characterized in that The state table of the first state machine also includes a questionable state; When the current state of the first state machine is a normal state and the first state transition event belongs to a preset suspicious event set, the first state is a suspicious state.

6. The method according to any one of claims 1 to 5, characterized in that: The first information is vehicle bus message information, and / or the exception handling process includes at least one of outputting alarm information, blocking IP, and isolating the host.

7. An abnormality detection device, characterized in that: Applied to a vehicle, the vehicle includes a plurality of state machines, the setting information of each state machine includes a state table, a state transition event table and an event processing function table, the setting information of each state machine is determined based on a preset abnormal behavior pattern library, the abnormal behavior pattern library includes at least one abnormal behavior detection rule, and the state table of each state machine includes a normal state and an abnormal state; The device comprises: A first unit is used to obtain first information, wherein the first information includes vehicle control information; The second unit is configured to, when determining that the first information corresponds to a first state transition event of the first state machine, call an event processing function corresponding to the first state transition event to transition the first state machine from a current state to a first state; The third unit is used to execute an exception handling process when it is determined that the first state is an abnormal state.

8. An electronic device, characterized in that: including memory and processor; The memory is connected to the processor and is used to store programs; The processor is used to implement the anomaly detection method as described in any one of claims 1 to 6 by running the program in the memory.

9. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the anomaly detection method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The method comprises computer program instructions, which, when executed by a processor, enable the processor to implement the anomaly detection method according to any one of claims 1 to 6.

11. A vehicle, characterized in that: include: A vehicle body and multiple state machines, the setting information of each state machine includes a state table, a state transition event table and an event processing function table, the setting information of each state machine is determined based on a preset abnormal behavior pattern library, the abnormal behavior pattern library includes at least one abnormal behavior detection rule, and the state table of each state machine includes a normal state and an abnormal state.

Images