Vehicle safety event prediction method and device, computer device and storage medium

Abstract

The application relates to a vehicle safety event prediction method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring vehicle safety event data, determining the statistical dimension type of a safety event in the vehicle safety event data; calculating the growth rate of the number of safety events in a preset statistical time period based on the vehicle safety event data; calculating the weight value of the safety events in the preset statistical time period; determining the training sample of a safety event prediction model based on the growth rate of the number of safety events and the weight value of the safety events, wherein the safety event prediction model comprises a machine learning algorithm for periodic prediction based on a time sequence; performing periodic prediction training on the safety event prediction model by taking the training sample as the input of the safety event prediction model, thereby obtaining a trained safety event prediction model; and outputting the safety event prediction result of a preset prediction period based on the trained safety event prediction model. The method can accurately and at low cost predict safety events.

Description

Technical Field

[0001] This application relates to the field of vehicle safe driving technology, and in particular to a method, apparatus, computer equipment, storage medium and computer program product for predicting vehicle safety events. Background Technology

[0002] With the development of autonomous driving technology, accurately predicting vehicle safety events during vehicle operation can ensure safe driving. For non-sudden safety events, the system can provide relatively stable defense; however, for sudden and rapidly increasing vehicle safety events, the defense effectiveness of the vehicle protection system is poor.

[0003] Traditional technologies use machine learning to predict vehicle safety incidents, but they are not effective for predicting vehicle safety incidents with strong periodicity. In some cases, they can only be combined with human defense, or take the highest intensity defense measures at all times, which is costly and wastes a lot of resources. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, device, computer equipment, computer-readable storage medium, and computer program product that can accurately and cost-effectively predict vehicle security incidents, addressing the problems of low accuracy in predicting security incidents and inability to effectively defend against attacks.

[0005] Firstly, this application provides a method for predicting vehicle safety events, the method comprising:

[0006] Acquire vehicle safety incident data and determine the statistical dimension types of safety incidents within the data;

[0007] Based on vehicle safety incident data, calculate the growth rate of the number of safety incidents within a preset statistical time period;

[0008] Calculate the weight values ​​of security events within a preset statistical time period;

[0009] The training samples for the security incident prediction model are determined based on the growth rate of the number of security incidents and the weight values ​​of the security incidents. The security incident prediction model includes a machine learning algorithm for periodic prediction based on time series.

[0010] The training samples are used as input to the security event prediction model for periodic prediction training to obtain the trained security event prediction model.

[0011] The trained security event prediction model outputs security event prediction results for a preset prediction period.

[0012] In one embodiment, calculating the weight value of security events within a preset statistical time period includes:

[0013] Based on the frequency of security events occurring in each statistical dimension of the statistical dimension type, calculate the weight value of security events within a preset statistical time period.

[0014] In one embodiment, calculating the weight value of security events within a preset statistical time period further includes:

[0015] The weight value of security events within a preset statistical time period is calculated by combining the growth rate of the number of security events.

[0016] In one embodiment, training samples for a security event prediction model are determined based on the growth rate of the number of security events and the weight values ​​of the security events. The security event prediction model includes a machine learning algorithm for periodic prediction based on time series data, comprising:

[0017] Set a first preset threshold and a second preset threshold, and determine the training samples for the security event prediction model based on the first preset threshold, the second preset threshold, the growth rate, and the weight value;

[0018] Among them, the growth rate of the number of security events in the training samples of the security event prediction model is greater than the first preset threshold, and the weight value of the security event is greater than the second preset threshold.

[0019] In one embodiment, after determining the training samples for a security event prediction model based on the growth rate of the number of security events and the weight values ​​of the security events, and after the security event prediction model includes a machine learning algorithm for periodic prediction based on time series, the method further includes:

[0020] Based on the statistical dimension type, the training samples of the security event prediction model are aggregated to obtain the aggregated training samples of the security event prediction model.

[0021] The training samples of the aggregated security event prediction model are used as input to the security event prediction model for periodic prediction training to obtain the trained security event prediction model.

[0022] In one embodiment, the security event prediction model is periodically trained using training samples as input to obtain the trained security event prediction model, including:

[0023] Training security event prediction models based on different time series granularities;

[0024] The security incident prediction model includes a trend term, a periodic term, and an error term.

[0025] Secondly, this application also provides a vehicle safety event prediction device. The device includes:

[0026] The acquisition unit is used to acquire vehicle safety event data and determine the statistical dimension type of the safety events in the vehicle safety event data;

[0027] The calculation unit is used to calculate the growth rate of the number of safety events within a preset statistical time period based on vehicle safety event data.

[0028] Calculate the weight values ​​of security events within a preset statistical time period;

[0029] The training samples for the security incident prediction model are determined based on the growth rate of the number of security incidents and the weight values ​​of the security incidents. The security incident prediction model includes a machine learning algorithm for periodic prediction based on time series.

[0030] The training unit is used to perform periodic prediction training using training samples as input to the security event prediction model, so as to obtain the trained security event prediction model.

[0031] The prediction unit is used to output the prediction results of security events for a preset prediction period based on the trained security event prediction model.

[0032] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0033] Acquire vehicle safety incident data and determine the statistical dimension types of safety incidents within the data;

[0034] Based on vehicle safety incident data, calculate the growth rate of the number of safety incidents within a preset statistical time period;

[0035] Calculate the weight values ​​of security events within a preset statistical time period;

[0036] The training samples for the security incident prediction model are determined based on the growth rate of the number of security incidents and the weight values ​​of the security incidents. The security incident prediction model includes a machine learning algorithm for periodic prediction based on time series.

[0037] The training samples are used as input to the security event prediction model for periodic prediction training to obtain the trained security event prediction model.

[0038] The trained security event prediction model outputs security event prediction results for a preset prediction period.

[0039] Fourthly, this application also provides a computer-readable storage medium. This computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0040] Acquire vehicle safety incident data and determine the statistical dimension types of safety incidents within the data;

[0041] Based on vehicle safety incident data, calculate the growth rate of the number of safety incidents within a preset statistical time period;

[0042] Calculate the weight values ​​of security events within a preset statistical time period;

[0043] The training samples for the security incident prediction model are determined based on the growth rate of the number of security incidents and the weight values ​​of the security incidents. The security incident prediction model includes a machine learning algorithm for periodic prediction based on time series.

[0044] The training samples are used as input to the security event prediction model for periodic prediction training to obtain the trained security event prediction model.

[0045] The trained security event prediction model outputs security event prediction results for a preset prediction period.

[0046] Fifthly, this application also provides a computer program product. This computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0047] Acquire vehicle safety incident data and determine the statistical dimension types of safety incidents within the data;

[0048] Based on vehicle safety incident data, calculate the growth rate of the number of safety incidents within a preset statistical time period;

[0049] Calculate the weight values ​​of security events within a preset statistical time period;

[0050] The training samples for the security incident prediction model are determined based on the growth rate of the number of security incidents and the weight values ​​of the security incidents. The security incident prediction model includes a machine learning algorithm for periodic prediction based on time series.

[0051] The training samples are used as input to the security event prediction model for periodic prediction training to obtain the trained security event prediction model.

[0052] The trained security event prediction model outputs security event prediction results for a preset prediction period.

[0053] The aforementioned vehicle safety incident prediction method, device, computer equipment, storage medium, and computer program product determine the statistical dimension type of vehicle safety incidents based on the acquired vehicle safety incident data; calculate the growth rate and weight value of vehicle safety incidents; and determine the training samples for the safety incident prediction model based on the calculated growth rate and weight value of the number of safety incidents. Scattered or low-relevance data in the vehicle safety incident data are filtered out. These training samples are used as input to the safety incident prediction model for periodic prediction training, thereby achieving the prediction of periodic vehicle safety incidents. The prediction model of this application is based on time series for periodic prediction, and can obtain safety incident prediction models trained, for example, with daily or annual time series. Combining prediction models trained with different time series provides flexibility, greatly improves the accuracy of vehicle safety incident prediction, and effectively saves manpower and system costs. Attached Figure Description

[0054] Figure 1 This is an application environment diagram of the vehicle safety event prediction method in one embodiment;

[0055] Figure 2 Here is a flowchart of a vehicle safety event prediction method in one embodiment;

[0056] Figure 3 Here is a flowchart of a vehicle safety event prediction method in another embodiment;

[0057] Figure 4 This is a structural diagram of a vehicle safety event prediction device in one embodiment;

[0058] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] The vehicle safety event prediction method provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Server 104 acquires vehicle safety event data, determines the statistical dimension type of the safety events in the data, calculates the growth rate of the number of safety events within a preset statistical time period based on the data, calculates the weight values ​​of the safety events within the preset statistical time period, determines the training samples for a safety event prediction model based on the growth rate and weight values, the model including a machine learning algorithm for periodic prediction based on time series, trains the model using the training samples as input, and outputs the safety event prediction results for a preset prediction period based on the trained model. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can be electric vehicles, smart in-vehicle devices, smart speakers, smart TVs, smart air conditioners, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0061] In one embodiment, such as Figure 2 As shown, a vehicle safety event prediction method is provided, which is applied to... Figure 1 Taking server 104 as an example, the following steps are included:

[0062] Step 202: Obtain vehicle safety event data and determine the statistical dimension type of the safety events in the vehicle safety event data.

[0063] Vehicle security event data is collected in real-time by vehicle IDS (Intrusion Detection System) devices and can be obtained from message queues (MQ), databases, and distributed file systems. Vehicle security event data describes security events that occur during vehicle operation through statistical dimensions.

[0064] For example, security incident statistics dimensions can include security incident type, security incident attack area, and security incident attack severity. The security incident attack area can be based on provincial or municipal regional divisions, the security incident type can be a host-based attack or a network-based attack, and the security incident attack severity can be categorized into three levels: Level 1, Level 2, and Level 3, corresponding to severe, moderate, and non-severe, respectively.

[0065] Step 204: Based on vehicle safety incident data, calculate the growth rate of the number of safety incidents within a preset statistical time period.

[0066] The growth rate of the number of security incidents refers to the rate at which security incidents occur. A higher growth rate indicates a faster increase in the number of security incidents. The growth rate of the number of security incidents can be calculated by measuring the frequency of security incidents in the current statistical period relative to the previous statistical period.

[0067] For example, based on the analysis of vehicle safety incident data, the probabilities F1 and F0 of a level 1 safety incident occurring within the first statistical time period T1 and within the previous statistical time period T0 of the first statistical time period T1 are obtained. By calculating the ratio of F1 to F0, the growth rate of the number of level 1 safety incidents can be obtained.

[0068] This method is used to calculate the growth rate of the number of safety events for each statistical dimension within a preset statistical time period.

[0069] Step 206: Calculate the weight value of security events within the preset statistical time period.

[0070] In some embodiments, the weight value of a security event can refer to the proportion of a security event that occurs. The weight value of a security event can be calculated based on the statistical dimension type of the security event, obtaining the weight of the security event in different dimensions within each statistical dimension type. A higher weight value indicates that this type of security event requires close attention from staff.

[0071] For example, the proportion of security events under each statistical dimension can be calculated, or the weight of security events can be calculated using methods such as TF-PDF (termfrequency–proportional document frequency, statistical method).

[0072] Step 208: Determine the training samples for the security event prediction model based on the growth rate of the number of security events and the weight values ​​of the security events. The security event prediction model includes a machine learning algorithm for periodic prediction based on time series.

[0073] Based on the calculated growth rate of the number of safety incidents and the weight values ​​of safety incidents, the acquired vehicle safety incident data is filtered according to the statistical dimension type of safety incidents to obtain training samples for the safety incident prediction model.

[0074] Since security attacks on vehicles often have a periodicity, for example, the number of security incidents reported by vehicles at night is often less than that during the day. When statistics are collected on an hourly basis, the time of occurrence of security incidents is related to the time of day. Therefore, the trained security incident prediction model includes machine learning algorithms that make periodic predictions based on time series, which can accurately predict security incidents.

[0075] Step 210: Use the training samples as input to perform periodic prediction training to obtain the trained security event prediction model.

[0076] In training security incident prediction models, different security incident prediction models can be obtained based on actual needs, the statistical dimension type of security incidents, or different time series.

[0077] Step 212: Output the security event prediction results for the preset prediction period based on the trained security event prediction model.

[0078] By using a trained safety incident prediction model to predict vehicle safety incidents, the predicted mean, upper bound, and lower bound of the number of safety incidents occurring within a future time series statistical period can be obtained. By combining different statistical dimensions of safety incidents, the number of one or more types of safety incidents occurring in a specific area can be predicted, or the severity of safety incidents can be predicted, providing a reference for prevention or threat assessment.

[0079] In the aforementioned vehicle safety incident prediction method, the statistical dimension types of safety incidents are determined based on the acquired vehicle safety incident data. Data filtering, prediction model training, and prediction calculations are then performed based on each statistical dimension. When acquiring training samples of vehicle safety incident data, the growth rate and weight of safety incidents under each statistical dimension are first calculated to filter out irrelevant data that could cause errors. Based on the obtained training data, periodic predictions are performed using time series data to obtain a safety incident prediction model. This model can be flexibly combined with different time series to improve the accuracy of safety incident predictions. It can also track and prevent security incident attack threats, thereby enhancing vehicle information security preventative measures, reducing the risk of vehicle information systems being compromised, and effectively saving manpower and system costs.

[0080] In one embodiment, calculating the weight value of security events within a preset statistical time period includes: calculating the weight value of security events within a preset statistical time period based on the frequency of occurrence of security events in each statistical dimension of the statistical dimension type.

[0081] Specifically, the weight value of a security event can be calculated based on the frequency of its occurrence, which can be done using TF-PDF.

[0082] For example, to obtain the frequency of security events occurring within a statistical time period, the calculation method is as follows:

[0083]

[0084]

[0085] In formula (1), W(d) i,t ) indicates that during the statistical time period T i Internal, statistical dimension t i The weight value of the safety status on vehicle c, where i can be a day or an hour; C represents the number of vehicles that reported safety incidents; F kc, Indicates t i Statistical dimensions in T i The frequency of occurrence within a statistical time period, N c, Indicates t i The total number of security incidents occurring on vehicle c is counted in the statistical dimension; |F kc, | represents t i The frequency of security events in vehicle c is standardized according to statistical dimensions; K represents the total number of security events that occur in vehicle c. Indicates vehicle c on t i The statistical dimension of security incident occurrences is the PDF (proportional document frequency). PDF is a t i Statistical dimensions in T i The frequency of security incidents within a time period accounts for a certain percentage of the statistical dimension t. i The percentage of total security incidents is an exponential growth rate. Security incidents that occur more frequently on the same dimension have a larger PDF (Primary Data Point) value; the PDF increases exponentially instead of linearly, thus increasing the weight of high-frequency security incidents.

[0086] In one embodiment, calculating the weight value of security events within a preset statistical time period further includes: calculating the weight value of security events within the preset statistical time period by combining the growth rate of the number of security events.

[0087] The method for calculating the weights of security incidents is optimized by incorporating the growth rate of the number of security incidents. Since the growth rate of the number of security incidents is positively correlated with the weights of security incidents, including the growth rate of the number of security incidents in the weight calculation formula may yield more accurate training data for the security incident prediction model.

[0088] The calculation method is as follows:

[0089]

[0090]

[0091] Formula (2) is an improvement on Formula (1), R i,t (D) represents the growth rate of the number of security incidents.

[0092] In one embodiment, the training samples of a security event prediction model are determined based on the growth rate and weight values. The security event prediction model includes a machine learning algorithm for periodic prediction based on time series, comprising: setting a first preset threshold and a second preset threshold; and determining the training samples of the security event prediction model based on the first preset threshold, the second preset threshold, the growth rate, and the weight values; wherein the growth rate of security events in the training samples of the security event prediction model is greater than the first preset threshold, and the weight value of the occurrence of security events is greater than the second preset threshold.

[0093] When predicting safety incidents, different users may have different needs, resulting in different prediction outcomes. By setting preset thresholds and classifying and filtering vehicle safety incident data, different training samples are obtained to train different prediction models, enabling the prediction of safety incidents under different needs.

[0094] For example, a first preset threshold is set for the growth rate of the number of safety events, and a second preset threshold is set for the weight value of the safety events. Based on the first and second preset thresholds, a safety event in the vehicle safety event data is considered to meet the current judgment criteria when both the growth rate of the number of safety events is greater than the first preset threshold and the weight value of the safety event is greater than the second preset threshold. The resulting safety event dataset is then used as training samples.

[0095] The vehicle safety incident data under all statistical dimensions are evaluated, and different training samples are obtained according to different dimensions.

[0096] In this embodiment, vehicle safety event data is classified and filtered by calculating the growth rate of the number of safety events and the weight value of the safety events. This identifies safety events that occur frequently within a certain statistical time period, filters out scattered or irrelevant data, improves the accuracy of the safety event prediction model, and allows for customization of thresholds according to user needs, making it very flexible.

[0097] In one embodiment, after determining the training samples of the security event prediction model based on the growth rate of the number of security events and the weight values ​​of the security events, and the security event prediction model includes a machine learning algorithm for periodic prediction based on time series, the method further includes: aggregating the training samples of the security event prediction model according to the statistical dimension type to obtain the aggregated training samples of the security event prediction model; and using the aggregated training samples of the security event prediction model as input to perform periodic prediction training to obtain the trained security event prediction model.

[0098] When predicting security incidents, it may be necessary to make a comprehensive judgment based on multiple statistical dimensions. The training samples of each statistical dimension can be aggregated, and then the aggregated training samples can be used as input to the security incident prediction model for periodic prediction training to obtain the trained security incident prediction model.

[0099] For example, safety incidents occurring at the same location or of the same type can be aggregated to obtain aggregated training samples. Alternatively, vehicle safety incident data from multiple statistical dimensions can be aggregated to obtain training samples from multiple statistical dimensions. For instance, the aggregation of training samples for a safety incident prediction model can be achieved using the union method.

[0100] In this embodiment, training samples from multiple statistical dimensions are aggregated according to the classification conditions envisioned by the user and then input into the prediction model for training. They can be divided according to different statistical dimensions such as the attack area of ​​the security incident, the type of security incident, and the severity of the security incident attack. The aggregated training samples are used as the data source of the security incident prediction model, which can make the output of the prediction model meet the user's needs.

[0101] In one embodiment, periodic prediction training is performed using training samples as input to a security event prediction model to obtain a trained security event prediction model, including: training the security event prediction model according to different time series granularities; the security event prediction model includes a trend term, a periodic term, and an error term.

[0102] Time series analysis involves arranging security events in chronological order according to their statistical values. The granularity of a time series refers to the time interval between points in the time series, which can be hourly, daily, monthly, quarterly, or yearly. Different granularities of time series allow for the prediction of security events within different statistical periods. For example, training a prediction model with an hourly time series can predict security events with strong periodicity within a single day; training a model with a daily time series can predict security events with strong trends, such as weekly or yearly events.

[0103] When training a security prediction model based on time series data, the model includes a trend term, a periodic term, and an error term. The trend term represents the non-periodic occurrence trend of security events, the periodic term represents the periodic occurrence trend of security events, and the error term represents abnormal errors that cannot be described by the model. In this embodiment, the trend term, periodic term, and error term are fitted to train the prediction model. The periodic term can be simulated using Fourier series to represent the periodic changes in the time series.

[0104] This embodiment differs from the traditional Prohet algorithm in that, since security incidents do not involve holidays, the prediction model fitted in this embodiment does not include a holiday term. The optimized prediction model in this embodiment is robust, not only predicting the trend of security incident occurrences but also calculating indicators such as upper and lower bounds, thus improving the accuracy of security incident prediction.

[0105] As an improvement to this embodiment, when predicting security events, different time series granularities can be set simultaneously to train security event prediction models, resulting in multiple security event prediction models. The flexible combination of these multiple prediction models improves the accuracy of security event prediction, thereby better enabling the tracking and prevention of security events.

[0106] For example, a first security event prediction model is obtained by training the model using hours as the time series, and a second security event prediction model is obtained by training the model using days as the time series. The first security event prediction model can predict and analyze security events with strong periodicity within a day, while the second security event prediction model can predict and analyze security events with strong trends within a week or a year. Combining the first and second security event prediction models can take into account both periodic and trending security events, resulting in better prediction accuracy.

[0107] Figure 3 The diagram shown is a flowchart of a vehicle safety event prediction method in one embodiment. Figure 3 As shown, in one embodiment, vehicle safety event prediction includes the following steps:

[0108] Step 302: Obtain vehicle safety event data.

[0109] Vehicle safety event data collected in real time by vehicle IDS devices can be obtained from message queues (MQ), databases, or distributed file systems.

[0110] Determine the statistical dimension types of security events in the vehicle security event data. The determined statistical dimension types include security event type, security event attack area, and security event attack severity.

[0111] Step 304: Determine whether the growth rate of the number of security incidents is greater than the first preset threshold.

[0112] Because different regions, different types of security incidents, and security incidents of varying severity possess different characteristics, different security incident prediction models need to be designed for analysis and prediction when forecasting security incidents.

[0113] Based on different statistical dimension types, the growth rate of the number of safety events is calculated separately. The calculated growth rate is then judged according to a first threshold. Vehicle safety event datasets that meet the criteria are combined into a first safety event dataset, and the process continues to step 306; otherwise, vehicle safety event data is reacquired. This includes the following steps:

[0114] (A1) Calculate the growth rate of the number of security incidents based on different statistical dimension types.

[0115] Three statistical dimensions are set: security incident type, security incident attack area, and security incident attack severity. This is achieved through d... i It means that d i =(t i1 ,t i2 ,...,t in ), where t i1 ,t i2 ,...,t in This represents the different statistical dimensions under the i-th dimension.

[0116] Calculate t respectively i The growth rate of the number of security incidents under the statistical dimension, that is, the calculation within the current statistical period T. i The inner period relative to the previous statistical period T i-1 growth rate R i,t :

[0117]

[0118] In formula (3), D represents the value based on d. i Calculate the result set under different dimensions, F i,t T represents i The frequency of occurrence of F in the vehicle safety event data log under the statistical dimension t within the statistical period. i-1,t This indicates that in the previous statistical period T i-1 The frequency of security incidents; when no security incident occurs, the frequency is zero. F i-1,t +1 prevents the denominator from being zero, resulting in the calculated R. i,t The larger the value, the stronger T i-1 To T i The faster the growth rate of the number of security incidents within the statistical period.

[0119] (A2) Set a first preset threshold, and make a judgment based on the first preset threshold to obtain the first security event data set under different statistical dimensions.

[0120] Set Δ1 as the first preset threshold, and determine the growth rate of the number of security events based on the first preset threshold, satisfying R. i,t When the value is greater than Δ1, the data set of the first safety event under different statistical dimensions is obtained, and the process proceeds to step 306. When the growth rate of the number of safety events is not greater than the first preset threshold, the vehicle safety event data is obtained again in step 302.

[0121] Step 306: Determine whether the weight value of the security event is greater than the second preset threshold.

[0122] t i Security events in statistical dimensions within statistical period T i A higher proportion of such events indicates that they should be given sufficient attention. Based on the frequency of safety events in each statistical dimension, the weight of each safety event within a preset statistical time period is calculated. The weight of each safety event is then determined according to a second preset threshold. Safety events meeting the threshold are grouped into a second safety event dataset, and the process proceeds to step 308; otherwise, it returns to step 302 to obtain vehicle safety event data. This includes the following steps:

[0123] (B1) Calculate the weight value of security events based on different statistical dimensions.

[0124] Based on the growth rate of the number of security incidents, the security incidents that occurred most frequently are calculated using the following method:

[0125]

[0126]

[0127] In formula (4), W(d) i,t ) indicates that during the statistical time period T i Internal, statistical dimension t i The weight value of the safety status on vehicle c, where i can be a day or an hour; C represents the number of vehicles that reported safety incidents; F kc, Indicates t i Statistical dimensions in T i The frequency of occurrence within a statistical time period, N c, Indicates t i The total number of security incidents occurring on vehicle c is counted in the statistical dimension; |F kc, | represents t i The frequency normalization of security events in vehicle c is defined by statistical dimensions; K represents the total number of security events occurring in vehicle c; Ri,t (D) represents the growth rate of the number of security incidents.

[0128] (B2) Set a second preset threshold, and make a judgment based on the second preset threshold to obtain a second security event data set under different dimensions.

[0129] Set Δ2 as the second preset threshold, and determine the weight value of the calculated security event based on the second preset threshold, satisfying W(d i,t When the weight value of the safety event is greater than Δ2, the second set of safety event data under different statistical dimensions is obtained, and the process proceeds to step 308. When the weight value of the safety event is not greater than the second preset threshold, the vehicle safety event data is obtained again in step 302.

[0130] The second set of security incident data obtained at this point is used as training samples for the security incident prediction model. This set is denoted as B. i,t ={C i, C i, ,...,C i,}, where C i,tn This represents the set of the nth security events in statistical dimension t within time i.

[0131] As another implementation of this embodiment, when calculating the weight value of a security event, it can also be calculated directly using the TF-PDF method as described in the aforementioned formula (1), without combining the growth rate of the number of security events.

[0132] Step 308: Aggregate training samples based on statistical dimensions.

[0133] Aggregate security events with the same statistical dimension using a single or multiple statistical dimensions. For example, aggregate the data sets of all security event types and all severity levels in the same security event attack area.

[0134] For example, aggregation can be performed through a union operation, such as performing a union operation on the sets of security events with statistical dimensions t1 and t2 within time i, to obtain:

[0135] B i,(t1∩t2) ={C i,(t1∩t2)1 C i,(t1∩t2)2 ,...,C i,(t1∩t2)n} (5)

[0136] In formula (5), C i,(t1∩t2) Indicates in T i The clustering value of the union of security events under statistical dimensions t1 and t2 within a statistical time period, with n C's. i,(t1∩t2) Cluster values ​​are composed of T i Set B of security events occurring within a statistical time periodi,(t1∩t2) The clustered security event dataset will be used as training samples for the security event prediction model.

[0137] Step 310: Train the security incident prediction model.

[0138] The aggregated training samples are used as input to the security incident prediction model for periodic prediction training, resulting in the trained security incident prediction model. The security incident prediction model includes a periodic machine learning algorithm based on time series data.

[0139] By training a prediction model with different prediction granularities for different prediction time series, and constructing the trend term, periodic term, and error term of the prediction model, a security event prediction model can be built using Prophet training. This prediction model is represented as follows:

[0140] y(t)=g(t)+s(t)+ε t (6)

[0141] In formula (6), g(t) represents the trend term; s(t) represents the periodic term, using Fourier series to simulate the periodic changes of the time series; ε t This indicates the error term.

[0142] This embodiment trains prediction models using hours and days as time series prediction granularities, respectively, and includes the following steps:

[0143] (C1) Train the security event prediction model with the hour as the prediction time series to obtain the first security event prediction model.

[0144] The first security event prediction model, trained on an hourly time series basis, predicts the number of events that may occur under specified conditions in the future. Table 1 shows the input parameters for training the security event prediction model.

[0145] In Table 1, the parameter `daily_seasonality` is set to `true`, `Hour(i)` is the timestamp of the security event, and `category` represents the type of security event under multiple statistical dimensions of `t1` and `t2` or a single conditional dimension type, such as a certain network-type security event occurring in a certain area. `value` is the number of security events after clustering. In `Hour(i)+n`, `n` is the number of training samples. During model training, a binary search method is used to import the aggregated training samples in batches. By using a quantity of `n / 2` for half-probability prediction, the prediction error term ∈ [the original text is missing]. t For example, if there are 10,000 data points, dividing them into 5,000 data points per training run and training them twice can effectively reduce the error rate of the prediction algorithm.

[0146] Table 1

[0147] daily_seasonality category value Hour(i) C(t1∩t2) <![CDATA[Count(C i,(t1∩t2)1 )]]> Hour(i)+1 C(t1∩t2) <![CDATA[Count(C i,(t1∩t2)2 )]]> Hour(i)+n C(t1∩t2) <![CDATA[Count(C i,(t1∩t2)3 )]]>

[0148] (C2) Train the security event prediction model with the week as the prediction time series to obtain the second security event prediction model.

[0149] As shown in formula (6) above, g(t) represents the trend term. Since there is no upper limit to the trend of security events, a piecewise linear model is adopted, which does not impose any upper limit on the trend.

[0150] s(t) represents the periodic term. Since time series may contain various periodic trends such as daily, weekly, monthly, and yearly cycles, Fourier series can be used to approximate this periodic attribute. The specific method for using Fourier series to simulate the periodic changes of time series is as follows:

[0151]

[0152] In formula (7), N represents the Fourier series, P represents the period of the time series, and P = 7 indicates a period of one week. N represents the number of corresponding periods that are desired to be used in the prediction model. A larger value of N can fit a more complex periodic function, but a larger value of N can also lead to overfitting. For a series with a period of one week, i.e., when P = 7, N can be set to 3.

[0153] (C3) The security event prediction model is trained with the year as the prediction time series to obtain the third security event prediction model.

[0154] When training a security event prediction model with an annual prediction time series, the method is basically the same as that in step (C2). The difference is that the prediction is based on an annual cycle, and P = 365.25 and N = 10 in formula (7).

[0155] A safety incident prediction model trained based on vehicle safety incident data can predict the mean, lower bound, and upper bound of the number of safety incidents occurring within a certain time series in the future. Combined with category filtering conditions, it can predict the number of times a certain type or multiple types of safety incidents will occur in a certain area.

[0156] Step 312: Predict security events.

[0157] The trained security event prediction model outputs security event prediction results for a preset prediction period.

[0158] Based on different time series granularities, the parameters of the prediction models are set respectively, and the first, second, and third security event prediction models are trained to obtain them. The training outputs the number of security events and their upper and lower boundary values ​​within the time series range of hours, weeks, and years. The prediction results obtained from different time series are combined and analyzed to achieve accurate prediction of security events.

[0159] The vehicle safety incident prediction method disclosed in this embodiment can identify sudden safety incidents. It calculates the growth rate of the number of safety incidents and the weight value of safety incidents by processing the acquired data to obtain training samples for the prediction model, and trains the prediction model based on the training samples.

[0160] When constructing predictive models, a first safety event prediction model, built using hourly time series, is used to predict the occurrence patterns of safety events with strong periodicity within a single day. A second safety event prediction model, built using weekly time series, and a third safety event prediction model, built using annual time series, are used to predict the occurrence patterns of safety events with strong trends, such as weekly or annual events. By flexibly combining these three models, information such as the timing and status of potentially concentrated future safety events can be obtained, allowing for effective early intervention and providing a reference for threat tracking and prevention. In vehicle safety event prediction, this can predict the timing and corresponding status of future safety events, effectively reducing vehicle safety risks.

[0161] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0162] Based on the same inventive concept, this application also provides a vehicle safety event prediction device for implementing the vehicle safety event prediction method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more safety event prediction device embodiments provided below can be found in the limitations of the safety event prediction method described above, and will not be repeated here.

[0163] In one embodiment, such as Figure 4 As shown, a vehicle safety event prediction device is provided, including: an acquisition unit 402, a calculation unit 404, a training unit 406, and a prediction unit 408, wherein:

[0164] The acquisition unit 402 is used to acquire vehicle safety event data and determine the statistical dimension type of the safety events in the vehicle safety event data;

[0165] Calculation unit 404 is used to calculate the growth rate of the number of safety events within a preset statistical time period based on vehicle safety event data;

[0166] Calculate the weight values ​​of security events within a preset statistical time period;

[0167] The training samples for the security incident prediction model are determined based on the growth rate of the number of security incidents and the weight values ​​of the security incidents. The security incident prediction model includes a machine learning algorithm for periodic prediction based on time series.

[0168] Training unit 406 is used to perform periodic prediction training with training samples as input to the security event prediction model to obtain the trained security event prediction model.

[0169] The prediction unit 408 is used to output the prediction results of security events for a preset prediction period based on the trained security event prediction model.

[0170] In one embodiment, the calculation unit 404 calculates the weight value of security events within a preset statistical time period, including: calculating the weight value of security events within the preset statistical time period based on the frequency of occurrence of security events in each statistical dimension of the statistical dimension type.

[0171] In one embodiment, the calculation unit 404 calculates the weight value of security events within a preset statistical time period, and further includes: calculating the weight value of security events within the preset statistical time period in combination with the growth rate of the number of security events.

[0172] In one embodiment, the calculation unit 404 determines the training samples of the security event prediction model based on the growth rate of the number of security events and the weight values ​​of the security events. The security event prediction model includes a machine learning algorithm for periodic prediction based on time series, comprising: setting a first preset threshold and a second preset threshold, and determining the training samples of the security event prediction model according to the first preset threshold, the second preset threshold, the growth rate, and the weight values; wherein the growth rate of the number of security events in the training samples of the security event prediction model is greater than the first preset threshold, and the weight values ​​of the security events are greater than the second preset threshold.

[0173] In one embodiment, after the calculation unit 404 determines the training samples of the security event prediction model based on the growth rate of the number of security events and the weight values ​​of the security events, and the security event prediction model includes a machine learning algorithm for periodic prediction based on time series, the method further includes: aggregating the training samples of the security event prediction model according to the statistical dimension type to obtain the aggregated training samples of the security event prediction model; using the aggregated training samples of the security event prediction model as input to the security event prediction model for periodic prediction training to obtain the trained security event prediction model.

[0174] In one embodiment, the training unit 406 uses training samples as input to the security event prediction model to perform periodic prediction training to obtain the trained security event prediction model, including: training the security event prediction model according to different time series granularities; the security event prediction model includes a trend term, a periodic term, and an error term.

[0175] Each module in the aforementioned vehicle safety event prediction device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0176] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores vehicle safety event data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a vehicle safety event prediction method.

[0177] Those skilled in the art will understand that Figure 5 The structures shown are merely block diagrams of some structures related to the present application and do not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements. In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0178] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0179] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0180] It should be noted that the user information and vehicle information (including but not limited to vehicle equipment information, user personal information, etc.) and vehicle safety event data (including but not limited to raw data, stored data, predicted data, executed data, etc. used for analysis) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0181] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0182] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0183] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for predicting vehicle safety events, characterized in that, The method includes: Acquire vehicle safety event data and determine the statistical dimension type of the safety events in the vehicle safety event data; Based on the vehicle safety incident data, calculate the growth rate of the number of safety incidents within a preset statistical time period; Calculate the weight value of security events within the preset statistical time period; wherein, the weight value of the security event is the weight of the security event occurring in different dimensions of each statistical dimension type, and the calculation of the weight value of security events within the preset statistical time period includes: calculating the weight value of the security event within the preset statistical time period based on the frequency of occurrence of security events in each statistical dimension of the statistical dimension type; The training samples for the security event prediction model are determined based on the growth rate of the number of security events and the weight values ​​of the security events. The security event prediction model includes a machine learning algorithm for periodic prediction based on time series. The training samples are used as input to the security event prediction model for periodic prediction training to obtain the trained security event prediction model. The trained security event prediction model outputs security event prediction results for a preset prediction period.

2. The method according to claim 1, characterized in that, The calculation of the weight value of security events within the preset statistical time period further includes: The weight value of the security event within the preset statistical time period is calculated based on the growth rate of the number of security events.

3. The method according to claim 1, characterized in that, The training samples for the security event prediction model are determined based on the growth rate of the number of security events and the weight values ​​of the security events. The security event prediction model includes a machine learning algorithm for periodic prediction based on time series data, comprising: Set a first preset threshold and a second preset threshold, and determine the training samples of the security event prediction model based on the first preset threshold, the second preset threshold, the growth rate of the number of security events, and the weight value of the security events; In the training samples of the security event prediction model, the growth rate of the number of security events is greater than the first preset threshold, and the weight value of the security event is greater than the second preset threshold.

4. The method according to claim 1, characterized in that, The method involves determining training samples for a security event prediction model based on the growth rate of the number of security events and the weight values ​​of the security events. The security event prediction model includes a machine learning algorithm for periodic prediction based on time series data. The method further includes: Based on the statistical dimension type, the training samples of the security event prediction model are aggregated to obtain the aggregated training samples of the security event prediction model. The training samples of the aggregated security event prediction model are used as input to the security event prediction model for periodic prediction training to obtain the trained security event prediction model.

5. The method according to claim 1, characterized in that, The step of periodically training the security event prediction model using the training samples as input to obtain the trained security event prediction model includes: The security event prediction model is trained according to different time series granularities; The security event prediction model includes a trend term, a periodic term, and an error term.

6. A vehicle safety event prediction device, characterized in that, The device includes: The acquisition unit is used to acquire vehicle safety event data and determine the statistical dimension type of the safety events in the vehicle safety event data. The calculation unit is used to calculate the growth rate of the number of safety events within a preset statistical time period based on the vehicle safety event data. Calculate the weight value of security events within the preset statistical time period; wherein, the weight value of the security event is the weight of the security event occurring in different dimensions of each statistical dimension type, and the calculation of the weight value of security events within the preset statistical time period includes: calculating the weight value of the security event within the preset statistical time period based on the frequency of occurrence of security events in each statistical dimension of the statistical dimension type; The training samples for the security event prediction model are determined based on the growth rate of the number of security events and the weight values ​​of the security events. The security event prediction model includes a machine learning algorithm for periodic prediction based on time series. The training unit is used to perform periodic prediction training using the training samples as input to the security event prediction model, so as to obtain the trained security event prediction model. The prediction unit is used to output the prediction results of security events for a preset prediction period based on the trained security event prediction model.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images