Abnormal remote command detection method and device

Abstract

The present invention provides a method for detecting abnormal remote commands, comprising: obtaining remote commands on a vehicle; encoding the remote commands to obtain remote command codes; predicting the remote command codes of a previous period using a preset model to obtain a predicted value, and training the preset model of the remote commands based on the predicted value to obtain a trained model; inputting the current remote command into the trained model, and judging whether the remote command is abnormal based on the output result.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a method and device for detecting abnormal remote instructions. Background Art

[0002] Currently, there are few methods in the industry specifically for detecting abnormal remote control commands for connected vehicles.

[0003] The traditional method is to judge a single remote command, which cannot detect anomalies in the sequence of user remote commands and does not fully consider the order of commands. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide a method and apparatus for detecting abnormal remote commands, so as to solve the problem in the prior art that the relationship between remote commands is not considered.

[0005] In a first aspect, the present invention provides a method for detecting abnormal remote instructions, the method comprising:

[0006] Get remote commands on the vehicle;

[0007] Encoding the remote instruction to obtain a remote instruction code;

[0008] Using a preset model, the remote instruction code of the previous period is predicted to obtain a predicted value, and the model preset for the remote instruction is trained based on the predicted value to obtain a trained model;

[0009] Input the current remote command into the trained model and determine whether the remote command is abnormal based on the output results.

[0010] In a possible implementation, encoding the remote instruction to obtain the remote instruction code specifically includes:

[0011] The remote instruction is encoded by one-hot encoding to obtain a remote instruction code.

[0012] In one possible implementation, the remote instruction code of the previous period is predicted using a preset model to obtain a predicted value, and the preset model of the remote instruction is trained based on the predicted value. The trained model specifically includes:

[0013] The remote instruction code of the previous period is input into a preset model, and prediction is performed by the preset model to obtain a predicted value of the remote instruction code;

[0014] Continue to use the predicted value as input into the preset model to obtain the next predicted value;

[0015] The model is trained through the loss function, predicted value and next predicted value to obtain the trained model.

[0016] In a possible implementation, the loss function is cross entropy, and the model is trained using the loss function, the predicted value, and the next predicted value to obtain the trained model, specifically including:

[0017] Calculating the predicted value and the true value of the remote instruction code at the time corresponding to the predicted value through cross entropy to obtain a first gap value;

[0018] The next predicted value and the true value of the remote instruction encoding at the time corresponding to the next predicted value are calculated through cross entropy to obtain a second gap value;

[0019] When the first gap value and the second gap value tend to converge, the model training is completed and a trained model is obtained.

[0020] In one possible implementation, inputting the current remote command into the trained model and determining whether the remote command is abnormal based on the output result specifically includes:

[0021] Get the current remote command;

[0022] Encode the current remote instruction to obtain the current remote instruction code;

[0023] Input the current remote instruction code into the trained model to obtain the predicted value of the current remote instruction code;

[0024] When the difference between the predicted value and the true value of the current remote instruction encoding is not within the confidence interval of the Gaussian distribution, the current remote instruction is determined to be abnormal; wherein the difference is measured by the mean square error, and the mean square error is modeled as a Gaussian distribution.

[0025] In one possible implementation, the preset model is an LSTM model.

[0026] In a second aspect, the present invention provides a device for detecting abnormal remote instructions, the device comprising:

[0027] An acquisition module, configured to acquire remote instructions from a vehicle;

[0028] An encoding module, the encoding module is used to encode the remote instruction to obtain a remote instruction code;

[0029] A training module, the training module is used to predict the remote instruction code of the previous period through a preset model to obtain a predicted value, and train the preset model of the remote instruction based on the predicted value to obtain a trained model;

[0030] The judgment module is used to input the current remote instruction into the trained model and judge whether the remote instruction is abnormal based on the output result.

[0031] In a third aspect, the present invention provides a computer server comprising: a memory, a processor, and a transceiver;

[0032] The processor is configured to be coupled to the memory, read and execute instructions in the memory, so as to implement the abnormal remote instruction detection method according to the first aspect;

[0033] The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0034] In a fourth aspect, the present invention provides a chip system comprising a processor coupled to a memory, wherein the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the abnormal remote instruction detection method described in any one of the first aspects is implemented.

[0035] In a fifth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the abnormal remote instruction detection method described in any one of the first aspects.

[0036] By applying the abnormal remote instruction detection method provided by the present invention, a self-supervisory algorithm is utilized, which does not require manual labeling in massive unbalanced data. In addition, the sequence of user remote instructions is modeled based on a preset model. A model of an instruction sequence is constructed for each user, thereby modeling the behavior of the user's instruction operation and constructing a safe behavior portrait of the user's remote instruction operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A schematic diagram of a flow chart of a method for detecting abnormal remote commands provided in the first embodiment of the present invention;

[0038] Figure 2 This is a schematic diagram of remote commands;

[0039] Figure 3 This is a schematic diagram of remote command encoding;

[0040] Figure 4 A schematic diagram of the structure of an abnormal remote command detection device provided in the second embodiment of the present invention;

[0041] Figure 5 A schematic diagram of the computer server structure provided in the third embodiment of the present invention;

[0042] Figure 6 A schematic diagram of the chip system structure provided in the fourth embodiment of the present invention;

[0043] Figure 7 A schematic diagram of the computer-readable storage medium structure provided in Example 5 of the present invention. DETAILED DESCRIPTION

[0044] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the relevant invention are shown in the accompanying drawings.

[0045] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0046] Example 1

[0047] The first embodiment of the present invention provides a method for detecting abnormal remote instructions. The method is applied to the scenario of detecting abnormalities in remote instructions, such as Figure 1 As shown, this application includes the following steps:

[0048] Step 110, obtaining remote instructions on the vehicle;

[0049] Specifically, multiple remote commands are obtained on the vehicle, and there is a certain order between these remote commands. Figure 2 According to the analysis and statistics, the remote commands on the user's bicycle can include a total of 22 action commands. These commands have the following characteristics: Figure 2 in the order shown.

[0050] Step 120, encode the remote instruction to obtain a remote instruction code;

[0051] For remote instructions, follow Figure 2 Encode in the order of , using one-hot encoding, the encoding result is shown in Figure 3 It should be noted that one-hot encoding ensures that each instruction has only one 1 and the rest are 0.

[0052] Step 130: training the remote instruction code using a preset model to obtain a trained model;

[0053] Specifically, step 130 includes: taking the remote instruction code of the previous period as input, inputting it into a preset model, predicting it through the preset model, and obtaining a predicted value of the remote instruction code; continuing to take the predicted value as input, inputting it into the preset model, and obtaining the next predicted value; training the model through the loss function, the predicted value, and the next predicted value, and obtaining a trained model.

[0054] Among them, the loss function is cross entropy. The model is trained through the loss function, the predicted value and the next predicted value to obtain the trained model, which specifically includes: calculating the predicted value and the true value of the remote instruction code at the time corresponding to the predicted value through cross entropy to obtain a first gap value; calculating the next predicted value and the true value of the remote instruction code at the time corresponding to the next predicted value through cross entropy to obtain a second gap value; when the first gap value and the second gap value tend to converge, the model training is completed and the trained model is obtained.

[0055] The default model is a Long-Short Term Memory (LSTM) network. The first layer of the multi-layer LSTM network takes as input the one-hot encoded remote command code, which is the remote command code from the previous period. The second layer takes as input the hidden state h of the previous LSTM layer, and the final output is the predicted value of the remote command code.

[0056] Step 140: Input the current remote instruction into the trained model and determine whether the remote instruction is abnormal based on the output result.

[0057] Specifically, step 140 includes: obtaining the current remote instruction; encoding the current remote instruction to obtain the current remote instruction code; inputting the current remote instruction code into the trained model to obtain a predicted value of the current remote instruction code; when the difference between the predicted value and the true value of the current remote instruction code is not within the confidence interval of the Gaussian distribution, determining that the current remote instruction is abnormal; wherein the difference is measured by the mean square error, and the mean square error is modeled as a Gaussian distribution.

[0058] Specifically, after encoding the current remote instruction, the difference between the predicted value and the true value can be measured by the mean square error (MSE), which is modeled as a Gaussian distribution. Subsequently, if the difference is within the confidence interval of the Gaussian distribution, then the remote instruction is normal, otherwise it is abnormal.

[0059] For example, the current remote command is to lock the door with the remote control, and the code is Figure 3 As shown in the first row, when the predicted value is, for example, the remote control is locked, the code is Figure 3 The second row in the , but the true value is that the left front door is locked, that is Figure 3 From the 6th line in the output, we can see that the two are completely different, which indicates that the remote instruction sequence is abnormal.

[0060] By applying the abnormal remote instruction detection method provided by the present invention, a self-supervisory algorithm is utilized, which does not require manual labeling in massive unbalanced data. In addition, the sequence of user remote instructions is modeled based on a preset model. A model of an instruction sequence is constructed for each user, thereby modeling the behavior of the user's instruction operation and constructing a safe behavior portrait of the user's remote instruction operation.

[0061] Example 2

[0062] A second embodiment of the present invention provides an abnormal remote instruction detection device, which includes: an acquisition module 410, an encoding module 420, a training module 430 and a judgment module 440.

[0063] The acquisition module 410 is used to acquire remote instructions on the vehicle;

[0064] The encoding module 420 is used to encode the remote instruction to obtain the remote instruction code;

[0065] The training module 430 is used to predict the remote instruction code of the previous period through a preset model to obtain a predicted value, and train the model preset for the remote instruction based on the predicted value to obtain a trained model;

[0066] The judgment module 440 is used to input the current remote instruction into the trained model and judge whether the remote instruction is abnormal based on the output result.

[0067] Furthermore, the encoding module 420 encodes the remote instruction to obtain the remote instruction code, which specifically includes: encoding the remote instruction through one-hot encoding to obtain the remote instruction code.

[0068] Furthermore, the training module 430 predicts the remote instruction code of the previous time period through a preset model to obtain a predicted value, and trains the preset model of the remote instruction based on the predicted value to obtain the trained model, which specifically includes: taking the remote instruction code of the previous time period as input, inputting it into the preset model, and predicting it through the preset model to obtain the predicted value of the remote instruction code; continuing to input the predicted value as input into the preset model to obtain the next predicted value; training the model through the loss function, the predicted value and the next predicted value to obtain the trained model.

[0069] Furthermore, the loss function is cross entropy, and the training module 430 trains the model through the loss function, the predicted value and the next predicted value, and the trained model specifically includes: calculating the predicted value and the true value of the remote instruction code at the time corresponding to the predicted value through cross entropy to obtain a first gap value; calculating the next predicted value and the true value of the remote instruction code at the time corresponding to the next predicted value through cross entropy to obtain a second gap value; when the first gap value and the second gap value tend to converge, the model training is completed and the trained model is obtained.

[0070] Furthermore, the judgment module 440 inputs the current remote instruction into the trained model, and judges whether the remote instruction is abnormal based on the output result, specifically including: obtaining the current remote instruction; encoding the current remote instruction to obtain the current remote instruction code; inputting the current remote instruction code into the trained model to obtain a predicted value of the current remote instruction code; when the difference between the predicted value and the true value of the current remote instruction code is not within the confidence interval of the Gaussian distribution, determining that the current remote instruction is abnormal; wherein the difference is measured by the mean square error, and the mean square error is modeled as a Gaussian distribution.

[0071] Among them, the preset model is the LSTM model.

[0072] The device provided in the second embodiment of the present invention can execute the method steps in the above-mentioned method embodiment 1. Its implementation principle and technical effects are similar and will not be repeated here.

[0073] It should be noted that it should be understood that the division of the various modules of the above device is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. Moreover, these modules can all be implemented in the form of software called by a processing element; or they can all be implemented in the form of hardware; or some modules can be implemented in the form of software called by a processing element, and some modules can be implemented in the form of hardware. For example, the determination module can be a separately established processing element, or it can be integrated into a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called by a processing element of the above device to perform the functions of the above determination module. The implementation of other modules is similar. In addition, these modules can all or partly be integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed by the hardware integrated logic circuit in the processor element or by instructions in the form of software.

[0074] For example, the above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), one or more microprocessors (DSPs), or one or more field programmable gate arrays (FPGAs). For another example, when a module is implemented by scheduling program code through a processing element, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0075] In the above embodiments, all or part of the embodiments may be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The above-mentioned computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the above-mentioned computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, Bluetooth, microwave, etc.) means. The above-mentioned computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The above-mentioned available medium can be a magnetic medium (such as a floppy disk, hard disk, tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0076] Example 3

[0077] The third embodiment of the present invention provides a computer server, such as Figure 5 As shown, it includes: a memory, a processor and a transceiver;

[0078] The processor is configured to be coupled to the memory, read and execute instructions in the memory, and implement any one of the abnormal remote instruction detection methods provided in the first embodiment above;

[0079] The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0080] Example 4

[0081] The fourth embodiment of the present invention provides a chip system, such as Figure 6 As shown, it includes a processor, a coupling between the processor and a memory, the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, any one of the abnormal remote instruction detection methods provided in Example 1 is implemented.

[0082] Example 5

[0083] A fifth embodiment of the present invention provides a computer-readable storage medium, such as Figure 7 As shown, it includes a program or instruction, and when the program or instruction is run on a computer, it implements any abnormal remote instruction detection method provided in Example 1.

[0084] Professionals should also be further aware that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0085] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0086] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting abnormal remote instructions, characterized in that: The method comprises: Get remote commands on the vehicle; Encoding the remote instruction to obtain a remote instruction code; The remote instruction code of the previous period is predicted by a preset model to obtain a predicted value, and the preset model of the remote instruction is trained based on the predicted value to obtain a trained model; wherein the preset model models the sequence of the user's remote instructions; Input the current remote command into the trained model and determine whether the remote command is abnormal based on the output result; The method of predicting the remote instruction code of the previous period by using a preset model to obtain a predicted value, and training the preset model of the remote instruction according to the predicted value to obtain the trained model specifically includes: The remote instruction code of the previous period is input into a preset model, and the preset model is used to make a prediction to obtain a predicted value of the remote instruction code; Continue to use the predicted value as input into the preset model to obtain the next predicted value; The model is trained through the loss function, predicted value and next predicted value to obtain the trained model; The loss function is cross entropy, and the model is trained using the loss function, the predicted value, and the next predicted value to obtain the trained model. Specifically, the trained model includes: Calculating the predicted value and the true value of the remote instruction code at the time corresponding to the predicted value through cross entropy to obtain a first gap value; The next predicted value and the true value of the remote instruction encoding at the time corresponding to the next predicted value are calculated through cross entropy to obtain a second gap value; When the first gap value and the second gap value tend to converge, the model training is completed and a trained model is obtained.

2. The method according to claim 1, characterized in that The encoding of the remote instruction to obtain the remote instruction code specifically includes: The remote instruction is encoded by one-hot encoding to obtain a remote instruction code.

3. The method according to claim 1, characterized in that Inputting the current remote command into the trained model and determining whether the remote command is abnormal based on the output result specifically includes: Get the current remote command; Encode the current remote instruction to obtain the current remote instruction code; Input the current remote instruction code into the trained model to obtain the predicted value of the current remote instruction code; When the difference between the predicted value and the true value of the current remote instruction encoding is not within the confidence interval of the Gaussian distribution, the current remote instruction is determined to be abnormal; wherein the difference is measured by the mean square error, and the mean square error is modeled as a Gaussian distribution.

4. The method according to claim 1, wherein The preset model is the LSTM model.

5. An abnormal remote command detection device, characterized in that: The device comprises: An acquisition module, configured to acquire remote instructions from a vehicle; An encoding module, the encoding module is used to encode the remote instruction to obtain a remote instruction code; A training module, the training module is used to predict the remote instruction code of the previous period using a preset model to obtain a predicted value, and train the preset model of the remote instruction based on the predicted value to obtain a trained model; wherein the preset model models the sequence of the user's remote instructions; A judgment module, which is used to input the current remote instruction into the trained model and determine whether the remote instruction is abnormal based on the output result; The training module predicts the remote instruction code of the previous period through a preset model to obtain a predicted value, and trains the preset model of the remote instruction based on the predicted value. The trained model specifically includes: The remote instruction code of the previous period is input into a preset model, and the preset model is used to make a prediction to obtain a predicted value of the remote instruction code; Continue to use the predicted value as input into the preset model to obtain the next predicted value; The model is trained through the loss function, predicted value and next predicted value to obtain the trained model; The loss function is cross entropy, and the model is trained using the loss function, the predicted value, and the next predicted value to obtain the trained model. Specifically, the trained model includes: Calculating the predicted value and the true value of the remote instruction code at the time corresponding to the predicted value through cross entropy to obtain a first gap value; The next predicted value and the true value of the remote instruction encoding at the time corresponding to the next predicted value are calculated through cross entropy to obtain a second gap value; When the first gap value and the second gap value tend to converge, the model training is completed and a trained model is obtained.

6. A computer server, characterized in that: include: memory, processors, and transceivers; The processor is configured to be coupled to the memory, read and execute instructions in the memory, so as to implement the abnormal remote instruction detection method according to any one of claims 1 to 4; The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

7. A chip system, characterized in that: The invention comprises a processor coupled to a memory, wherein the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the abnormal remote instruction detection method according to any one of claims 1 to 4 is implemented.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the abnormal remote instruction detection method according to any one of claims 1 to 4.

Images