Vehicle time series event mining method, device, equipment and storage medium
By performing time series analysis on vehicle operation data, using prefix projection algorithm to mine frequently occurring time series, determine the associated event set of abnormal events, solving the problem that the existing auto fault self-diagnosis system cannot be fully detected, and realizing timely and accurate detection and alarm of faults.
Patent Information
- Application Number
- CN202111654949.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-12-30
- Publication Date
- 2025-08-12
- Estimated Expiration
- 2041-12-30
AI Technical Summary
The existing auto fault self-diagnosis system cannot detect all faults, causing the fault to further deteriorate and affecting the safety and reliability of the car.
Through time series analysis based on exception events, the prefix projection algorithm is used to mine the frequently occurring time series sets, determine the associated event sets of exception events, and generate an alarm signal to repair the fault in a timely manner.
It improves the accuracy of fault detection, reduces the workload of staff, reduces user losses, and achieves timely and accurate alarms for abnormal events.
Smart Images

Figure CN114528499B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of vehicle data processing technology, and in particular relates to a vehicle time series event mining method, device, equipment and storage medium. Background Art
[0002] Cars have become an indispensable means of transportation in our daily lives. As the number of people using cars increases, the problem of car failures is becoming increasingly serious. As a result, the auto repair industry has begun to develop to ensure the safe operation of cars and bring many conveniences to people's lives. However, this industry still has many shortcomings.
[0003] The automobile fault self-diagnosis system cannot detect all problems during automobile fault detection, which may cause the fault to worsen. Summary of the Invention
[0004] The present invention aims to solve at least one of the technical problems in the related art to a certain extent. To this end, one object of the present invention is to provide a vehicle time series event mining method, device, equipment and storage medium.
[0005] In order to solve the above technical problems, the embodiments of the present invention provide the following technical solutions:
[0006] A vehicle time series event mining method, comprising:
[0007] Based on abnormal events, determine the event set to be mined and processed;
[0008] Processing the event set to be mined and processed to obtain processing results;
[0009] Processing the processing results based on a prefix projection algorithm to determine a frequently occurring time series set;
[0010] The frequently occurring time series set is determined as the time series associated event set of the abnormal event.
[0011] Optionally, determining an event to be mined and processed based on an abnormal event includes:
[0012] Determining the time when the abnormal event occurred;
[0013] Determining a target time period based on the time when the abnormal event occurs;
[0014] The events occurring within the target time period are determined as the event set to be mined and processed.
[0015] Optionally, processing the event set to be mined and processed to obtain a processing result includes:
[0016] The event set to be mined and processed is arranged in a time series and hierarchical manner to obtain a result of the time series and hierarchical arrangement.
[0017] Optionally, performing a time series hierarchical arrangement on the event set to be mined and processed to obtain a result of the time series hierarchical arrangement includes:
[0018] Determine based on a preset algorithm whether any two events to be mined and processed in the set of events to be mined and processed occur at the same time;
[0019] If the two events to be mined and processed occur at the same time, the time series of the two events to be mined and processed are the same;
[0020] Based on the time series, a result of hierarchical arrangement of the time series is obtained; wherein the result of hierarchical arrangement of the time series is a time series set.
[0021] The preset algorithm includes a coincidence algorithm or a start time difference algorithm.
[0022] Optionally, processing the processing result based on a prefix projection algorithm to determine a frequently occurring time series set includes:
[0023] The prefix projection algorithm processes the time series set based on a support threshold;
[0024] Determine the time series whose support is greater than or equal to the support threshold as the target time series;
[0025] Based on the target time series, the frequently occurring time series set is obtained.
[0026] Optionally, the prefix projection algorithm processes the time series set based on a preset support threshold, including:
[0027] Preset the i-th prefix with a length of one; where i is a positive integer;
[0028] The prefix projection is based on the i-th prefix with a length of one, obtaining a j-th sub-time series set containing the i-th prefix with a length of one; wherein j is a positive integer;
[0029] The prefix projection processes the j-th sub-time series set based on the support threshold.
[0030] Optionally, determining the time series having a support greater than or equal to the support threshold as the target time series includes:
[0031] The time series whose support of the j-th sub-time series set is greater than or equal to the support threshold is determined as the j-th sub-target time series.
[0032] Optionally, obtaining the frequently occurring time series set based on the target time series includes:
[0033] Based on the j-th sub-goal time series, the j+1-th sub-goal time series, and the j+2-th sub-goal time series, the frequently occurring time series set is obtained.
[0034] An embodiment of the present invention further provides a vehicle time series event mining device, comprising:
[0035] A first determination module is used to determine an event set to be mined and processed based on abnormal events;
[0036] An acquisition module, configured to process the event set to be mined and processed and obtain a processing result;
[0037] a processing module, configured to process the processing results based on a prefix projection algorithm to determine a frequently occurring time series set;
[0038] The second determining module is configured to determine the frequently occurring time series set as the time series associated event set of the abnormal event.
[0039] An embodiment of the present invention further provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the above-mentioned method when executing the computer program.
[0040] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the method described above.
[0041] The embodiments of the present invention have the following technical effects:
[0042] The above technical solution of the present invention, 1) records the time when the abnormal event occurs, and based on the time when the abnormal event occurs, determines the target time period, and then obtains the events that occur within the target time period. The processing of abnormal events based on existing technology reduces the workload of staff and improves the accuracy of data.
[0043] 2) The event set to be mined and processed is arranged in a time-series layered manner based on time, which can more accurately and quickly determine the associated events of the abnormal items.
[0044] 3) The obtained time series set is processed based on the prefix projection algorithm, and the time series whose support threshold meets the support threshold are determined as frequently occurring time series, and the time series whose support does not meet the support threshold are deleted, which reduces the amount of calculation and realizes the correlation between the time series and the abnormal event based on the number of frequent occurrences of the time series in the target time period before the abnormal event occurs, that is, the time series in the target time period before the abnormal event occurs is determined as the suspected cause of the abnormal event.
[0045] 4) The anomaly can be analyzed based on the associated events of the acquired abnormal event, without the need to analyze non-associated events, which greatly reduces the amount of calculation. At the same time, timely and accurate alarms can be issued based on the abnormal analysis results of the associated events, reducing user losses.
[0046] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS
[0047] Figure 1 1 is a flow chart of a vehicle time series event mining method provided by an embodiment of the present invention;
[0048] Figure 2 It is a structural diagram of a vehicle time series event mining device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0049] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.
[0050] During the actual use of a car, there will be different states, different behaviors, and different events. Before certain abnormal events occur, the frequency of related events will be different from the frequency under normal circumstances. This type of event can be considered to be related to abnormal events.
[0051] Based on the above analysis, an embodiment of the present invention provides a vehicle time series event mining system, including: a processor, a memory, and an alarm;
[0052] The system communicates with multiple vehicles in real time over the network to obtain vehicle operation data in real time and store it in memory for subsequent data processing.
[0053] When an abnormality occurs in the vehicle operation, the system calls the event set stored in the memory that occurred some time before the abnormal event occurred;
[0054] The system sends the retrieved event set that occurred some time before the abnormal event to the processor for processing;
[0055] The processor processes the received event set based on the prefix and support threshold based on the preset algorithm model and outputs the frequently occurring event set;
[0056] The processor feeds back the output frequently occurring event set to the system; the system determines the frequently occurring event set as a time-series correlation event set of abnormal events;
[0057] The system can perform anomaly analysis based on a set of time-series related events, determine the actual cause of the anomaly, generate a control signal based on the actual cause, and then send the control signal to the alarm to control the alarm to sound an alarm.
[0058] like Figure 1 As shown, an embodiment of the present invention provides a vehicle time series event mining method, which is applied to the above system, including:
[0059] Step S1: Based on abnormal events, determine the event set to be mined and processed;
[0060] Specifically, determining the events to be mined and processed based on abnormal events includes:
[0061] Determine the time when the (target / to be investigated) abnormal event occurs;
[0062] Determining a target time period based on the time when the abnormal event occurs;
[0063] The events occurring within the target time period are determined as the event set to be mined and processed.
[0064] In actual application scenarios, the system obtains the operating data of multiple vehicles in real time to facilitate real-time processing of vehicle abnormal events and reduce the impact of vehicle abnormalities on users.
[0065] Specifically, the duration of the target time period is preset, for example, one hour, two hours, or 30 minutes.
[0066] The duration of the target time period can be adjusted according to actual needs, and the embodiment of the present invention does not specifically limit this;
[0067] When the system obtains an abnormal event, the system obtains the timestamp of the abnormal time, and determines the start time of the target time period based on the timestamp of the abnormal event and the length of the preset target time period.
[0068] The system obtains all events within the target time period.
[0069] The embodiments of the present invention record the time when abnormal events occur, determine the target time period based on the time when the abnormal events occur, and then obtain the events that occur within the target time period. The processing of abnormal events based on existing technologies reduces the workload of staff and improves the accuracy of data.
[0070] Step S2: Process the event set to be mined and obtain the processing result;
[0071] Specifically, processing the event set to be mined and processed to obtain processing results includes:
[0072] The event set to be mined and processed is arranged in a time series hierarchical manner to obtain a result of the time series hierarchical arrangement.
[0073] Furthermore, the step of performing a hierarchical temporal arrangement on the event set to be mined and processed and obtaining a result of the hierarchical temporal arrangement includes:
[0074] Determine based on a preset algorithm whether any two events to be mined and processed in the set of events to be mined and processed occur at the same time;
[0075] If the two events to be mined and processed occur at the same time, the time series of the two events to be mined and processed are the same;
[0076] Based on the time series, a result of hierarchical arrangement of the time series is obtained; wherein the result of hierarchical arrangement of the time series is a time series set.
[0077] The preset algorithm includes a coincidence algorithm or a start time difference algorithm.
[0078] Specifically, the event set to be mined and processed is sorted in the chronological order of the occurrence of the event set to be mined and processed, and the events that occur simultaneously in the event set to be mined and processed are determined by the overlap determination method of the occurrence duration or the difference method of the starting time of the event set to be mined and processed, and the events that occur simultaneously occupy the same sequential position.
[0079] For example: four events A, B, C, and D are arranged in the order of B, (A, C), D. Event A and event C in the brackets are events that occur at the same time and occupy the same sequential positions, that is, there is no order in the brackets. The number of layers of the time sequence layered arrangement can be defined as needed, for example: two layers, three layers (there are brackets in brackets), or four layers, etc. The embodiment of the present invention takes two layers as an example.
[0080] Furthermore, the duration of the two events to be mined and processed is divided by the duration of the shorter of the two events to obtain the percentage of overlap, which is the overlap ratio. If the overlap ratio exceeds a threshold (for example, 80%), the two events are considered to have occurred simultaneously. The new (virtual) start time (the average of the two event start times) and end time (the average of the two event end times) are calculated to obtain the new (virtual) event duration. The same operation is continued for the simultaneous events using the new (virtual) event until no events meet the conditions.
[0081] In actual application scenarios, based on the coincidence algorithm, the results of time series hierarchical arrangement are obtained;
[0082] Specifically, the start timestamp and the stop timestamp of each event to be mined and processed are obtained, and the duration of each event to be mined and processed is determined, with the overlap threshold preset to 80%;
[0083] Compare the durations of the events to be mined and processed in the event set to be mined and processed in pairs, determine the overlap between each two events to be mined and processed, compare each overlap with the overlap threshold, and when the overlap is greater than the overlap threshold, determine the two events to be mined and processed corresponding to the overlap as two events that occurred simultaneously;
[0084] Then, the average of the start timestamps of the two events is obtained as the new start time of the two events;
[0085] Get the average of the deadline timestamps of the two events and use it as the new deadline time for the two events.
[0086] Through the above processing, the first sub-time series set is obtained;
[0087] Processing the first sub-time series set based on the coincidence algorithm to obtain a second sub-time series set;
[0088] The calculation process stops when the data of the previous sub-time series set is the same as that of the next sub-time series set, and the time series hierarchical arrangement result is obtained.
[0089] Furthermore, when the start time of two events is less than a certain threshold, the two events are regarded as occurring simultaneously and a new (virtual) start time (the average of the start times of the two events) is calculated and the search for simultaneously occurring events is continued according to the new (virtual) start time until no event meets the conditions.
[0090] Specifically, obtain the start timestamp of each event to be mined and processed, determine the difference between each start timestamp, and preset the difference threshold to be 30S (10S, 20S, etc.);
[0091] Compare the starting timestamps of the events to be mined in the event set to be mined and processed in pairs, determine the difference between each two starting timestamps, compare each difference with the difference threshold, and when the difference is less than or equal to the difference threshold, determine the two events to be mined and processed corresponding to the difference as two events that occurred simultaneously;
[0092] Then, the average of the start timestamps of the two events is obtained as the new start time of the two events.
[0093] Through the above processing, the first sub-time series set is obtained;
[0094] Processing the first sub-time series set based on the coincidence algorithm to obtain a second sub-time series set;
[0095] The calculation process stops when the data of the previous sub-time series set is the same as that of the next sub-time series set, and the time series hierarchical arrangement result is obtained.
[0096] In the embodiment of the present invention, the acquired event set to be mined and processed is arranged in a time-series hierarchical manner based on time, so that the associated events of the abnormal parts can be determined more accurately and quickly.
[0097] Step S3: Processing the processing results based on a prefix projection algorithm to determine a frequently occurring time series set;
[0098] Specifically, processing the processing result based on the prefix projection algorithm to determine the frequently occurring time series set includes:
[0099] The prefix projection algorithm processes the time series set based on a support threshold;
[0100] Determine the time series whose support is greater than or equal to the support threshold as the target time series;
[0101] Based on the target time series, the frequently occurring time series set is obtained.
[0102] The support threshold can be preset according to actual needs. For example, the support threshold can be 1, 2, or 3.
[0103] In actual application scenarios, the preset support threshold is 2.
[0104] Furthermore, the prefix projection algorithm processes the time series set based on a preset support threshold, including:
[0105] Preset the i-th prefix with a length of one; where i is a positive integer;
[0106] The prefix projection is based on the i-th prefix with a length of one, obtaining a j-th sub-time series set containing the i-th prefix with a length of one; wherein j is a positive integer;
[0107] The prefix projection processes the j-th sub-time series set based on the support threshold.
[0108] Specifically, as shown in Table 1, the prefix is a subsequence in front of the time series. For example, a time series is<a(abc)(ac)d(cf)> , there is more than one prefix, the first prefix can be , the second prefix is <aa>, the third prefix is <(ab)>, etc.
[0109] Table 1
[0110] Prefix Suffix (prefix projection) <(abc)(ac)d(cf)> <aa> < / aa> <(_bc)(ac)d(cf)> <ab> < / ab> <(_c)(ac)d(cf)>
[0111] Furthermore, determining the time series whose support is greater than or equal to the support threshold as the target time series includes:
[0112] The time series whose support of the j-th sub-time series set is greater than or equal to the support threshold is determined as the j-th sub-target time series.
[0113] Furthermore, based on the target time series, obtaining the frequently occurring time series set includes:
[0114] Based on the j-th sub-goal time series, the j+1-th sub-goal time series, the j+2-th sub-goal time series, etc., the frequently occurring time series set is obtained.
[0115] Specifically, the target time series may contain multiple sub-target time series with different prefixes.
[0116] In an actual application scenario, for example, as shown in Table 2, the system obtains real-time operating data of four vehicles; wherein ID is the identification of the vehicle, and LHG1, LHG2, LHG3, and LHG4 are the identifications of four different vehicles respectively.
[0117] a, b, c, d, e, f, and g are the events to be mined and processed. Sequence is the events to be mined and processed that occurred on each vehicle, arranged in chronological order. The events in brackets are not in order and are considered to occur simultaneously.
[0118] Table 2
[0119] ID sequence LHG1 <a(abc)(ac)d(cf)> LHG2 <(ad)c(bc)(ae)> LHG3 <(ef)(ab)(df)cb> LHG4 <eg(af)cbc>
[0120] In the embodiment of the present invention, the preset support threshold is 0.5. There are 4 vehicles, and 4 multiplied by 0.5 equals 2. Therefore, the frequent item must appear at least twice to meet the requirement.
[0121] First, we select all prefixes of length 1 and calculate their support. As shown in Table 3, we can see that only the event g to be mined does not meet the support threshold and only appears once. Therefore, we remove g from all time series (only LHG4 contains event g. After removing g, the sequence becomes<e(af)cbc> ). Table 3
[0122] <c> < / c> <d> < / d> <e> < / e> <f> < / f> <g> < / g> 4 4 4 3 3 3 1
[0123] As shown in Table 4, the suffix corresponding to each prefix in Table 3 is:
[0124] Table 4
[0125]
[0126] Then, continue to mine frequently occurring time series. Specifically, mine from the above suffixes that are greater than or equal to the support threshold. <d>Let’s continue digging by taking the following suffix as an example. The same goes for other prefixes:
[0127] Table 5
[0128] <d> < / d> <d(cf)> <c(bc)(ae)> <(_f)cb>
[0129] Specifically, select <d>All the following prefixes with a length of one are included, and the support is calculated, as shown in Table 5:
[0130] Table 5
[0131] <c> < / c> <d> < / d> <e> < / e> <f> < / f> <_f> 1 2 3 0 1 1 1
[0132] Based on Table 3, we can see that only and <c>If the support threshold is met and mining continues, we can get Table 6:
[0133] Table 6
[0134] <db> < / db> <dc> < / dc> <_f> <(_c)(ae)> <(bc)(ae)>
[0135] Based on Table 6, we can see <db>There is only one suffix, and none of them meet the support threshold, so no more mining is done. <dc>:
[0136] Specifically, select <dc>All the following prefixes with a length of one are calculated, and the support is shown in Table 7:
[0137] <c> < / c> <e> < / e> <_f> 1 2 1 1 1
[0138] only The support threshold is satisfied, so we get Table 8:
[0139] Table 8
[0140] <dcb> < / dcb> <(_c)(ace)>
[0141] Finally, the frequently occurring time series set mined with prefix d includes <d> , <db> , <dc> , <dcb>.
[0142] An embodiment of the present invention processes the acquired time series set based on the prefix projection algorithm, determines the time series whose support threshold meets the support threshold as the frequently occurring time series, and deletes the time series whose support does not meet the support threshold, thereby reducing the amount of calculation and realizing the determination of the correlation between the time series and the abnormal event based on the number of frequent occurrences of the time series in the target time period before the abnormal event occurs, that is, determining the time series in the target time period before the abnormal event occurs as the suspected cause of the abnormal event.
[0143] Step S4: determining the frequently occurring time series set as the time series associated event set of the abnormal event.
[0144] Specifically, after obtaining a set of time-series related events, the system can perform an anomaly analysis based on the related events and obtain an anomaly analysis result; the system issues an alarm based on the anomaly analysis result and sends the anomaly analysis result to maintenance personnel for timely repair.
[0145] The embodiments of the present invention can analyze anomalies based on the associated events of the acquired abnormal events, without the need to analyze non-associated events, which greatly reduces the amount of calculation. At the same time, timely and accurate alarms can be issued based on the abnormal analysis results of the associated events, reducing user losses.
[0146] like< / dcb> < / dc> < / db> < / d> < / dc> < / dc> < / db> < / c> < / d> < / d> < / aa> Figure 2 As shown, an embodiment of the present invention further provides a vehicle time series event mining device 200, comprising:
[0147] A first determining module 201 is configured to determine an event set to be mined and processed based on abnormal events;
[0148] An acquisition module 202 is configured to process the event set to be mined and obtain a processing result;
[0149] A processing module 203 is configured to process the processing result based on a prefix projection algorithm to determine a frequently occurring time series set;
[0150] The second determining module 204 is configured to determine the frequently occurring time series set as the time series associated event set of the abnormal event.
[0151] Optionally, determining an event to be mined and processed based on an abnormal event includes:
[0152] Determining the time when the abnormal event occurred;
[0153] Determining a target time period based on the time when the abnormal event occurs;
[0154] The events occurring within the target time period are determined as the event set to be mined and processed.
[0155] Optionally, processing the event set to be mined and processed to obtain a processing result includes:
[0156] The event set to be mined and processed is arranged in a time series hierarchical manner to obtain a result of the time series hierarchical arrangement.
[0157] Optionally, performing a time series hierarchical arrangement on the event set to be mined and processed to obtain a result of the time series hierarchical arrangement includes:
[0158] Determine based on a preset algorithm whether any two events to be mined and processed in the set of events to be mined and processed occur at the same time;
[0159] If the two events to be mined and processed occur at the same time, the arrangement order of the two events to be mined and processed is the same;
[0160] Based on the time series, a result of hierarchical arrangement of the time series is obtained; wherein the result of hierarchical arrangement of the time series is a time series set.
[0161] The preset algorithm includes a coincidence algorithm or a start time difference algorithm.
[0162] Optionally, processing the processing result based on a prefix projection algorithm to determine a frequently occurring time series set includes:
[0163] The prefix projection algorithm processes the time series set based on a support threshold;
[0164] Determine the time series whose support is greater than or equal to the support threshold as the target time series;
[0165] Based on the target time series, the frequently occurring time series set is obtained.
[0166] Optionally, the prefix projection algorithm processes the time series set based on a preset support threshold, including:
[0167] Preset the i-th prefix with a length of one; where i is a positive integer;
[0168] The prefix projection is based on the i-th prefix with a length of one, obtaining a j-th sub-time series set containing the i-th prefix with a length of one; wherein j is a positive integer;
[0169] The prefix projection processes the j-th sub-time series set based on the support threshold.
[0170] Optionally, determining the time series having a support greater than or equal to the support threshold as the target time series includes:
[0171] The time series whose support of the j-th sub-time series set is greater than or equal to the support threshold is determined as the j-th sub-target time series.
[0172] Optionally, obtaining the frequently occurring time series set based on the target time series includes:
[0173] Based on the j-th sub-goal time series, the j+1-th sub-goal time series, the j+2-th sub-goal time series, etc., the frequently occurring time series set is obtained.
[0174] An embodiment of the present invention further provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the above-mentioned method when executing the computer program.
[0175] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the method described above.
[0176] In addition, other structures and functions of the device according to the embodiment of the present invention are known to those skilled in the art and are not described here in detail to reduce redundancy.
[0177] It should be noted that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic device), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing it in another suitable manner if necessary, and then storing it in a computer memory.
[0178] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.
[0179] Throughout this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples" indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
[0180] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore should not be understood as limiting the present invention.
[0181] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features being referred to. Thus, a feature identified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, for example, two, three, etc., unless otherwise specifically defined.
[0182] In the present invention, unless otherwise specified or limited, the terms "installed," "connected," "connect," "fixed," and the like should be understood broadly. For example, they may refer to fixed or detachable connections, or integration; mechanical or electrical connections; direct or indirect connections through an intermediary; and internal communication between two components or interaction between two components, unless otherwise specified. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.
[0183] In the present invention, unless otherwise expressly specified or limited, a first feature being "above" or "below" a second feature may mean that the first and second features are in direct contact, or that the first and second features are in indirect contact through an intermediary. Furthermore, a first feature being "above," "above," or "above" a second feature may mean that the first feature is directly above or diagonally above the second feature, or simply means that the first feature is at a higher level than the second feature. A first feature being "below," "below," or "below" a second feature may mean that the first feature is directly below or diagonally below the second feature, or simply means that the first feature is at a lower level than the second feature.
[0184] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.
Claims
1. A vehicle time series event mining method, characterized in that: include: Based on abnormal events, determine the event set to be mined and processed; Processing the event set to be mined and processed to obtain processing results; Processing the processing results based on a prefix projection algorithm to determine a frequently occurring time series set; Determine the frequently occurring time series set as the time series associated event set of the abnormal event; Determining the events to be mined and processed based on the abnormal events includes: Determining the time when the abnormal event occurred; Determining a target time period based on the time when the abnormal event occurs; Determining the events occurring within the target time period as the event set to be mined and processed; The processing of the event set to be mined and processed to obtain a processing result includes: Performing a time series hierarchical arrangement on the event set to be mined and processed, and obtaining a result of the time series hierarchical arrangement; The step of performing a hierarchical temporal arrangement on the event set to be mined and processed, and obtaining a result of the hierarchical temporal arrangement, includes: Determine based on a preset algorithm whether any two events to be mined and processed in the set of events to be mined and processed occur at the same time; If the two events to be mined and processed occur at the same time, the time series of the two events to be mined and processed are the same; Based on the time series, a result of hierarchical arrangement of the time series is obtained; wherein the result of hierarchical arrangement of the time series is a time series set.
2. The method according to claim 1, characterized in that The preset algorithm includes a coincidence algorithm or a start time difference algorithm.
3. The method according to claim 1, characterized in that Processing the processing result based on the prefix projection algorithm to determine a frequently occurring time series set includes: The prefix projection algorithm processes the time series set based on a support threshold; Determine the time series whose support is greater than or equal to the support threshold as the target time series; Based on the target time series, the frequently occurring time series set is obtained.
4. The method according to claim 3, characterized in that The prefix projection algorithm processes the time series set based on a preset support threshold, including: Preset the i-th prefix with a length of one; where i is a positive integer; The prefix projection is based on the i-th prefix with a length of one, obtaining a j-th sub-time series set containing the i-th prefix with a length of one; wherein j is a positive integer; The prefix projection processes the j-th sub-time series set based on the support threshold.
5. The method according to claim 4, characterized in that Determining the time series having a support greater than or equal to the support threshold as a target time series includes: The time series whose support of the j-th sub-time series set is greater than or equal to the support threshold is determined as the j-th sub-target time series.
6. The method according to claim 5, characterized in that Based on the target time series, obtaining the frequently occurring time series set includes: Based on the j-th sub-goal time series, the j+1-th sub-goal time series, and the j+2-th sub-goal time series, the frequently occurring time series set is obtained.
7. A vehicle time series event mining device, characterized in that: include: A first determination module is used to determine an event set to be mined and processed based on abnormal events; An acquisition module, configured to process the event set to be mined and processed and obtain a processing result; a processing module, configured to process the processing results based on a prefix projection algorithm to determine a frequently occurring time series set; A second determining module is configured to determine the frequently occurring time series set as a time series associated event set of the abnormal event; Determining the events to be mined and processed based on the abnormal events includes: Determining the time when the abnormal event occurred; Determining a target time period based on the time when the abnormal event occurs; Determining the events occurring within the target time period as the event set to be mined and processed; The processing of the event set to be mined and processed to obtain a processing result includes: Performing a time series hierarchical arrangement on the event set to be mined and processed, and obtaining a result of the time series hierarchical arrangement; The step of performing a hierarchical temporal arrangement on the event set to be mined and processed, and obtaining a result of the hierarchical temporal arrangement, includes: Determine based on a preset algorithm whether any two events to be mined and processed in the set of events to be mined and processed occur at the same time; If the two events to be mined and processed occur at the same time, the time series of the two events to be mined and processed are the same; Based on the time series, a result of hierarchical arrangement of the time series is obtained; wherein the result of hierarchical arrangement of the time series is a time series set.
8. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the method according to any one of claims 1 to 6 when executing the computer program.
9. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 6.
Citation Information
Patent Citations
Multi-step attack characterization method based on time sequence correlation analysis
CN113179241A
Method for scalable mining of temporally correlated events
US20210334277A1