Unsupervised vehicle network anomaly detection method and system based on physical invariant subspace
Through an unsupervised method based on physical invariant subspace, the Kalman variational autoencoder and iterative reweighted least squares state estimator are used to solve the interpretability and accuracy of the Internet of Vehicles anomaly detection, and effective sensor threat detection in complex environments is achieved.
Patent Information
- Application Number
- CN202311602258.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-11-28
- Publication Date
- 2025-09-02
- Estimated Expiration
- 2043-11-28
AI Technical Summary
The existing deep learning-based Internet of Vehicle anomaly detection methods lack interpretability and accuracy, and it is difficult to effectively detect sensor threats under system uncertainty and noise disturbances. Traditional methods cannot cope with complex and variable anomalies.
An unsupervised Internet of Vehicles' anomaly detection method based on physical invariant subspace is adopted, and a Kalman variational autoencoder and iterative reweighted least squares state estimator are used, and an abnormality detector is combined with an abnormality detector to perform adaptive non-parametric accumulation summation, and a discrete time-invariant model is constructed for abnormal detection.
It improves the interpretability and accuracy of abnormal detection, can effectively identify sensor abnormalities in complex environments, and provides interpretability and efficient detection of detection results.
Smart Images
Figure CN117612277B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of vehicle network anomaly detection, and relates to an unsupervised vehicle network anomaly detection method and system based on physical invariant subspace. Background Art
[0002] The Internet of Vehicles (IoV) system tightly couples information technology with physical processes, creating physical attacks beyond traditional cyberattacks. Attackers can manipulate vehicle networks without direct access to any physical components, impacting system performance and jeopardizing the security of the entire system. Such attacks include electromagnetic interference, radio frequency interference, and side-channel attacks. Furthermore, autonomous vehicles rely heavily on various sensor data for navigation and decision-making on the road. However, sensors such as lidar, ultrasonic sensors, and cameras must operate in complex and dynamic environments, which can lead to sensor failures or erroneous readings, compromising their detection accuracy and ability to interpret the vehicle's surroundings.
[0003] Model-based detection methods rely on predefined models of physical systems or mathematical representations of what is considered "normal" behavior. Models are used to capture the relationships between inputs, outputs, and internal states, expressed using mathematical equations, physical laws, and linear invariant analysis techniques. Once created, these models can be used to generate expected system behavior under normal conditions. Comparing the expected behavior with the system's actual behavior can identify anomalous behavior. System identification is a control system engineering approach that learns and analyzes the dynamic behavior of a system. It involves collecting data from the system and using mathematical models to understand and predict its behavior. Data-based detection methods use statistical and machine learning techniques to analyze system data and identify patterns. They are capable of processing complex data using unsupervised learning techniques. However, deep learning models require extensive training data to accurately classify or predict, while publicly available vehicle network data is sparse and contains only a small number of attack data points. Furthermore, existing deep learning-based methods lack interpretability, making it difficult to logically infer the accuracy of the algorithm or the legitimacy of detected anomalies. Furthermore, the complexity and uncertainty of the sensor operating environment make traditional detection methods unable to detect complex and changing anomalies.
[0004] In view of this, the main purpose of the present invention is to solve the problems of interpretability and detectability of detection methods for sensor threats in the presence of system uncertainty and noise disturbances. The present invention adopts an unsupervised anomaly detection method based on physical invariant subspace to improve the interpretability of the algorithm and the accuracy and reliability of anomaly detection. Summary of the Invention
[0005] In response to the problems existing in existing deep learning-based anomaly detection technology, the present invention provides an unsupervised vehicle network anomaly detection method and system based on physical invariant subspace, which has explainability and high detection efficiency and accuracy.
[0006] To achieve the above object, the technical solution of the present invention is as follows:
[0007] According to a first aspect of this specification, there is provided an unsupervised vehicle network anomaly detection method based on a physical invariant subspace, the method comprising:
[0008] Collect time series data of vehicle driving status through on-board sensors and perform data preprocessing on the collected data;
[0009] A Kalman variational autoencoder with a subspace extraction layer is used to train the preprocessed data to reconstruct a compact behavior sequence with feature correlation that satisfies physical laws to capture the normal pattern of multivariate temporal behavior sequences.
[0010] The state of the reconstructed behavior sequence is estimated using a state estimator based on iterative reweighted least squares.
[0011] Anomaly detector is used to perform adaptive non-parametric cumulative summation of the state difference between the state predicted by the state estimator and the state observed by the sensor for anomaly detection.
[0012] Furthermore, the time series data is transmitted in real time in the vehicle network to form a discrete time-invariant model to describe the dynamic behavior of the vehicle. The discrete time-invariant model is expressed as follows:
[0013]
[0014]
[0015] in, Represent the state vector, control input vector and output vector at time k respectively; A, B, C represent the state transfer matrix, input matrix and measurement matrix respectively; represents independent and identically distributed noise, is a positive definite symmetric matrix; n, c, and m represent the dimensions of the system's state vector, control input vector, and output vector, respectively.
[0016] Furthermore, the data preprocessing is specifically as follows: Perform deviation normalization and sliding window segmentation to obtain a series of sequences {x t-T ,x t-T+1 ,…,x t}, recorded as sequence or Where n represents the number of sample points, t represents the starting time point of the sliding window, and x t Represents the state vector at the starting time point of the sliding window.
[0017] Furthermore, the Kalman variational autoencoder includes three components: encoder network Subspace extraction layer and decoder network in, represents sample data, Indicates that it contains x t The latent variables of the features, is the hidden variable z t The subspace representation extracted after linear transformation, is the behavior sequence output by the decoder network, φ and θ are the encoder and decoder network parameters respectively, is the latent variable introduced in the autoencoder, in represents the latent variable b t The importance of the i-th physical property of the motion state, b t The overall importance of β t Indicates that the Kalman variational autoencoder takes the sequence x t-T:t That is x t And the sample data of the previous T consecutive observation moments are used as input to reconstruct The specific steps are:
[0018] (1) The encoder network takes the input sample data sequence x t-T:t Mapped to the latent variable sequence z t-T:t On, denoted as {z t},{z t} obey the posterior distribution
[0019] (2) Subspace extraction layer Extract z t The important correlation features in the feature subspace representation are obtained
[0020] (3) Decoder network learns an approximation of the prior distribution Representing the subspace Map back to the original data space.
[0021] Furthermore, the subspace extraction layer uses a robust sparse subspace extraction model with latent variables to decompose the data matrix into a low-rank matrix and a sparse matrix. The optimization function is expressed as:
[0022]
[0023] subject to P T P=I d
[0024] in, and express with b t The sequence composed of the i-th dimension of is the principal component analysis loading matrix, is the regression sparse matrix; represents the sum of the L2 norms of all rows of the matrix; the parameter λ weighs the measurement accuracy and the principal component extraction accuracy, η is the regularization parameter, I d It is a d×d unit matrix, where d represents the dimension of the unit matrix.
[0025] Furthermore, the objective function of the Kalman variational autoencoder is a variational lower bound, which is defined as the expected log-likelihood of the probability distribution in the autoencoder with respect to the posterior distribution and the sum of the negative KL divergence between the posterior distribution and the prior distribution of the latent variable, expressed as follows:
[0026]
[0027] Among them, u t is the control input sequence after data preprocessing, φ1 is the encoder network parameter without subspace extraction, φ2 is the encoder network parameter after subspace extraction, θ1 and θ2 are the decoder network parameters; and is a Gaussian distribution, indicating that given u t Under the condition of t or The prior distribution of Represents the log-likelihood of the decoder network output data, through the latent variable z t and Reconstruct the input data, the decoder network is controlled by parameters θ1 and θ2; D KL (·) represents the KL divergence; the first term of the objective function is the negative reconstruction loss term, and the second and third terms are regularization terms.
[0028] Furthermore, the reconstructed sequence is reassembled into the original state vector through the reverse sliding window segmentation step, where the state vector at time k after reorganization is expressed as The state estimation is performed by iteratively reweighted least squares fitting, and the weights of the observation sequence are continuously adjusted to obtain the best fitting parameters. The specific steps are as follows:
[0029] (1) Establish a state estimator based on iterative reweighted least squares, which is expressed as follows:
[0030]
[0031] Among them, W k is a diagonal matrix whose elements are w k ;
[0032] (2) Minimize the sum of squared errors J k : in is the observation sequence;
[0033] (3) Calculate the residual vector r k :
[0034] (4) Adjust the weight factor w k : Adjust the weight factor according to the size of the residual at each iteration;
[0035] (5) Determine whether it converges: After each iteration, k The value of determines whether it converges. If it converges, it returns as the final estimate of the state vector.
[0036] Furthermore, the anomaly detector uses a statistical decision metric of an adaptive non-parametric cumulative sum to perform anomaly detection, and the detection steps are as follows:
[0037] (1) Formalize the statistical decision metric of anomaly detectors:
[0038]
[0039] in, is the attack vector, represents the state vector at time i, D k Represents the cumulative value in all time windows l before time k, and takes the maximum value among them, Indicates the observed The probability density function of Indicates the observed attack state The probability density function of
[0040] The statistical decision quantity is expressed as:
[0041]
[0042] Among them, σ i is the standard deviation of the i-th observation, r i is the residual vector of the i-th observation;
[0043] Or expressed recursively:
[0044]
[0045] in, is a k The predicted value of ARL0 represents the average time interval that the system maintains a normal state when there are no abnormalities;
[0046] (2) Using exponentially weighted moving average statistics to predict the attack vector a one step ahead k Make a prediction:
[0047]
[0048] Among them, a min Indicates the minimum measurable offset, θ(e k ) is a monotonic function that represents the relationship between the weighted average of new observations and the prediction error;
[0049] (3) Anomaly detection decision: When the statistical decision amount The anomaly detector issues an alarm when , where δ is the detection threshold of the sensor.
[0050] Furthermore, the training and testing of the Kalman variational autoencoder are specifically as follows: first, the autoencoder is trained on a dataset of normal data sequences to learn the network parameters of the autoencoder, and then the trained autoencoder is used to encode new data points into a low-dimensional latent space representation, and then the threshold-based DTW similarity measurement method is used to test the autoencoder.
[0051] According to a second aspect of this specification, there is provided an unsupervised vehicle network anomaly detection system based on a physical invariant subspace implemented using the method described in the first aspect, the system comprising:
[0052] The data acquisition and preprocessing module collects time series data of the vehicle's driving status through on-board sensors and performs data preprocessing on the collected data;
[0053] A Kalman variational autoencoder with a subspace extraction layer is used to train the preprocessed data to reconstruct a compact behavior sequence with feature correlation that satisfies physical laws to capture the normal pattern of multivariate temporal behavior sequences;
[0054] A state estimator based on iterative reweighted least squares is used to perform state estimation on the behavior sequence reconstructed by the Kalman variational autoencoder;
[0055] The anomaly detector is used to perform adaptive non-parametric cumulative summation on the state difference between the state predicted by the state estimator and the state observed by the sensor to obtain an anomaly detection result.
[0056] Compared with the prior art, the present invention has the following advantages:
[0057] 1. The present invention introduces a subspace extraction layer into the Kalman variational autoencoder, which enables the autoencoder model to better capture and identify subspaces related to anomaly detection.
[0058] 2. The present invention interprets and understands the input data by constructing an interpretable subspace and utilizing physically invariant properties. Each dimension in the subspace corresponds to a specific feature or attribute in the input data, which can better understand and represent the structure and meaning of the data and provide interpretability for the prediction results of the autoencoder model.
[0059] 3. The present invention separates spatial representation and action recognition and uses a Gaussian state space model to process potential dynamic information and uncertainty, thereby improving the accurate prediction of vehicle state and motion information.
[0060] In summary, the present invention is used for anomaly detection in the Internet of Vehicles, using a Kalman variational autoencoder with a subspace extraction layer to capture the features and patterns most relevant to normal behavior, thereby improving the accuracy and interpretability of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0061] Figure 1 It is a flowchart of the workflow of the method of the present invention;
[0062] Figure 2(a) and Figure 2(b) are the mean square error (MSE) and mean absolute error (MAE) of the reconstruction results when different hyperparameters are selected;
[0063] Figure 3(a) and Figure 3(b) are the reconstruction effects of the velocity features and acceleration features of the test set respectively. DETAILED DESCRIPTION
[0064] In order to better understand the technical solution of the present application, the embodiments of the present application are described in detail below with reference to the accompanying drawings.
[0065] It should be clear that the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0066] The terms used in the embodiments of the present application are for the purpose of describing specific embodiments only and are not intended to limit the present application. The singular forms "a", "an", "the" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise.
[0067] This paper proposes an unsupervised vehicle network anomaly detection method based on physical invariant subspace, such as Figure 1 As shown, the specific steps include:
[0068] Step 1: Collect time series data of the vehicle's driving status (such as position, speed, acceleration, and steering angle) through multiple sensors installed on the vehicle; perform data preprocessing on the collected data;
[0069] Step 2: Use a Kalman Variational Autoencoder (KVAE) with a Subspace Extraction (SSE) layer to train the data preprocessed in step 1 to reconstruct a compact behavior sequence with feature correlation that satisfies physical laws and captures the normal pattern of the multivariate temporal behavior sequence;
[0070] Step 3: Use the state estimator based on iterative reweighted least squares to perform state estimation on the behavior sequence reconstructed in step 2;
[0071] Step 4: Use the anomaly detector to perform adaptive non-parametric cumulative summation of the state difference between the state predicted by the state estimator and the state observed by the sensor to perform anomaly detection.
[0072] The following description further provides some embodiments of each step that meets the requirements of this application.
[0073] In step 1, time series data is transmitted in real time in the vehicle network to form a discrete time-invariant model to describe the dynamic behavior of the vehicle. The discrete time-invariant model is expressed as follows:
[0074]
[0075]
[0076] in, Denote the state vector, control input vector, and output vector at time k respectively. A, B, and C denote the state transfer matrix, input matrix, and measurement matrix respectively. represents independent and identically distributed noise. is a positive definite symmetric matrix. n, c, and m represent the dimensions of the system’s state vector, control input vector, and output vector, respectively.
[0077] In step 1, data preprocessing is to collect data Perform deviation normalization and sliding window segmentation to obtain a series of sequences {x t-T ,x t-T+1 ,…,x t}, which can be recorded as a sequence or Where n represents the number of sample points, t represents the starting time point of the sliding window (t≥T), and x t Represents the state vector at the starting time point of the sliding window.
[0078] In step 2, the Kalman variational autoencoder KVAE specifically includes three components: encoder network Subspace extraction layer and decoder network in, represents sample data, Indicates that it contains x t The latent variables of the features, is the hidden variable z t The subspace representation extracted after linear transformation, is the behavior sequence output by the decoder network, φ and θ are the encoder and decoder network parameters respectively, is the latent variable introduced in the Kalman variational autoencoder and is used as the input of the IRLS state estimation algorithm. t The calculation formula is as follows:
[0079]
[0080] Among them, the probability represents the latent variable b t The importance of the i-th physical property of the motion state, b t The overall importance of β t express,
[0081] The Kalman variational autoencoder takes the sequence x t-T:t That is x t And the sample data of the previous T consecutive observation moments are used as input to reconstruct The specific steps are:
[0082] (1) The encoder network takes the input sample data sequence x t-T:t Mapped to the latent variable sequence z t-T:t On, denoted as {z t},{z t} obey the posterior distribution
[0083] (2) Subspace extraction layer Extract z t The important related features in , discard the redundant features, and obtain the subspace representation of the features
[0084] (3) Decoder network learns an approximation of the prior distribution Representing the subspace Map back to the original data space.
[0085] because is independent of the input data, the latent variable z t The prior distribution of is usually a multivariate standard Gaussian distribution with mean 0 and variance z as the unit matrix t ~Ν(0,I). Posterior distribution is a Gaussian distribution whose mean and variance depend on the input data and are calculated as follows:
[0086]
[0087] Among them, φ1 is the encoder network parameter without subspace extraction, γ is the weight coefficient of the mixed Gaussian distribution, Represents the mean and variance of the principal component information, represents the mean and variance of noise or outliers, I a It is a unit array.
[0088] In step 2, the subspace extraction layer uses the robust sparse subspace extraction (PMV) model with latent variables to decompose the data matrix into a low-rank matrix and a sparse matrix. The low-rank matrix contains the main structural information of the data, while the sparse matrix contains the outliers or noise information in the data. The optimization function of PMV is expressed as:
[0089]
[0090] subject to P T P=I d
[0091] in, and express with b t The sequence composed of the i-th dimension of is the principal component analysis loading matrix, is the regression sparse matrix. It represents the sum of the L2 norms of all rows of the matrix. Specifically, for a matrix S, its L2 norm is defined as the square root of the sum of the squares of the elements in each row, such as ||S i ||2 represents the square root of the sum of the squares of all elements in the i-th row of the matrix S. The parameter λ weighs the measurement accuracy and the principal component extraction accuracy, η is the regularization parameter, and I d It is a d×d unit matrix, where d represents the dimension of the unit matrix.
[0092] In step 2, the objective function of the Kalman variational autoencoder is the variational lower bound, which is defined as the expected log-likelihood of the probability distribution in the autoencoder with respect to the posterior distribution and the sum of the negative Kullback-Leibler (KL) divergence between the posterior distribution and the prior distribution of the latent variable, expressed as follows:
[0093]
[0094] Among them, u t is the control input sequence after data preprocessing, φ2 is the encoder network parameter extracted through the subspace, and θ1 and θ2 are the decoder network parameters. and is a Gaussian distribution, indicating that given u t Under the condition of t or The prior distribution of .
[0095] The first term of the objective function is the negative reconstruction loss term, denoted as The second and third terms are regularization terms, denoted as Right now Represents the log-likelihood of the decoder network output data, through the latent variable z t and Reconstruct the input data, and the decoder network is controlled by parameters θ1 and θ2. KL (·) represents the KL divergence, which is used to measure the “distance” or “difference” of one probability distribution relative to another probability distribution.
[0096] Since the original state more directly shows the dynamic behavior of the car, it can better utilize physical constraints for state estimation. In step 3, the reconstructed sequence is first split into two parts by the inverse sliding window. Recombined into the original state vector, where the state vector at time k after reorganization is expressed as
[0097] In step 3, the IRLS algorithm performs state estimation by iterative weighted least squares fitting, continuously adjusting the weights of the observation sequence to obtain the optimal fitting parameters. The state estimation steps are as follows:
[0098] (1) Establishing a state estimator: The formula of the iteratively reweighted least squares (IRLS) state estimation algorithm is as follows:
[0099]
[0100] Among them, W kis a diagonal matrix whose elements are w k .
[0101] (2) Minimize the sum of squared errors J k : in is the observation sequence.
[0102] (3) Calculate the residual vector r k :
[0103] (4) Adjust the weight factor w k : The IRLS algorithm adjusts the weight factor according to the size of the residual at each iteration. The commonly used adjustment method is: σ k is the standard deviation of the k-th observation.
[0104] (5) Determine whether it converges: After each iteration, k The value of determines whether it converges. If it converges, it returns as the final estimate of the state vector.
[0105] In step 4, the anomaly detector uses the statistical decision metric of the adaptive nonparametric cumulative sum (AN-CUSUM) to detect anomalies. The detection steps are as follows:
[0106] (1) Formalize the statistical decision metric of the AN-CUSUM detector:
[0107]
[0108] in, is the attack vector, represents the state vector at time i, D k Represents the cumulative value in all time windows l before time k, and takes the maximum value among them, Indicates the observed The probability density function of Indicates the observed attack state The probability density function of
[0109] Then the statistical decision quantity can be expressed as:
[0110]
[0111] Among them, σ i is the standard deviation of the i-th observation, r i is the residual vector of the i-th observation.
[0112] D k It can also be written recursively:
[0113]
[0114] in, is a k The predicted value of ARL0 represents the average time interval that the system remains in a normal state when there are no abnormalities.
[0115] (2) Using exponentially weighted moving average statistics to predict the attack vector a one step ahead k Make a prediction:
[0116]
[0117] Among them, a min Indicates the minimum measurable offset, θ(e k ) is a monotonic function that represents the relationship between the weighted average of new observations and the prediction error, and can be expressed in the form of a Huber score function:
[0118]
[0119] where ε∈[0,1] is a smoothing constant and ζ≥0 is a threshold constant.
[0120] (3) Anomaly detection decision: When the statistical decision amount The AN-CUSUM detector issues an alarm when , where δ is the detection threshold of the sensor.
[0121] Training and testing of the Kalman variational autoencoder. First, the autoencoder is trained on a dataset of normal data sequences to learn the network parameters of the autoencoder. Then, the trained autoencoder is used to encode new data points into a low-dimensional latent space representation. The autoencoder is then tested using the threshold-based DTW similarity metric. DTW is calculated as follows:
[0122] L(0,0)=0; L(0,1:l2)=+∞; L(1:l1,0)=+∞
[0123]
[0124]
[0125] Among them, L is the metric matrix, p and q are the current indexes of the two sequences respectively, and L(p,q) means that the sequence x p and Minimum cost of alignment. Sequence x t and The lengths are l1 and l2 respectively.
[0126] Example:
[0127] The present invention uses the Research Data Exchange Database from the Safety Pilot Model Deployment (SPMD) program. The database stores vehicle trajectories, sensor readings, communication messages, and various contextual information, which can be used to study vehicle physics properties, inter-vehicle communication, intersection safety, and more.
[0128] Next, the specific implementation steps of the present invention will be described in detail with reference to the accompanying drawings:
[0129] Step 1: Data Preparation. Three types of sensor data were selected from the SPMD dataset: vehicle speed, GPS speed, and vehicle acceleration. The data were then normalized for deviation. 5,000 samples were randomly selected as the training set, and 3,000 samples were used as the validation and test sets. Since the original dataset contained no anomalies, four possible real-world anomalies were simulated with anomaly rates of 1%, 3%, and 5%, respectively. These anomalies were added to the SPMD dataset: transient anomalies, constant anomalies, gradual drift anomalies, and deviation anomalies.
[0130] Step 2: Parameter selection: study the sensitivity of the autoencoder to different choices of regularization hyperparameters λ and η, and adjust the hyperparameters so that the autoencoder has better reconstruction performance for normal sample data.
[0131] Figures 2(a) and 2(b) show the mean squared error (MSE) and mean absolute error (MAE) of the reconstruction results for different hyperparameters. Smaller MSE and MAE values indicate that the autoencoder is able to reconstruct the original data more accurately, while larger values indicate poorer reconstruction quality. Therefore, we selected λ = 0.12 and η = 0.08.
[0132] Step 3: Anomaly detection. KVAE with an SSE layer is used to reconstruct the feature set to reconstruct a compact behavior sequence with feature correlation that satisfies the laws of physics to capture the normal mode of the multivariate time behavior sequence. Then, the IRLS-based state estimator is used to perform state estimation using the reconstructed behavior sequence. Finally, the AN-CUSUM anomaly detector is used to perform adaptive non-parametric cumulative summation of the state difference between the state predicted by the state estimator and the state observed by the sensor to perform anomaly detection.
[0133] Figures 3(a) and 3(b) show the reconstruction effects of the physical properties of velocity and acceleration under noise disturbance. It can be clearly seen from the velocity property in Figure 3(a) that the noise disturbance will indeed increase the reconstruction error, but its error growth rate is much smaller than the growth rate during the abnormal time period. Therefore, the method of the present invention can still accurately identify anomalies under these interference conditions and is robust.
[0134] The anomaly detection model in step 3 of this embodiment is described as follows:
[0135] (1) Figure 1 As shown in Figure 3, the anomaly detection model consists of three components, including a KVAE autoencoder with SSE layers for behavior sequence reconstruction, an iteratively reweighted least squares based state estimator for state estimation, and an adaptive nonparametric cumulative summation based anomaly detector for anomaly detection.
[0136] (2) Reconstruction process: The autoencoder transforms the subspace features Convert to latent variable b t The probability distribution of these latent variables b t It can be interpreted as encoding the vehicle's position, velocity, acceleration, and other physical properties.
[0137] (3) Loss function: The objective function of the autoencoder is a variational lower bound, defined as the expected log-likelihood of the probability distribution in the autoencoder with respect to the posterior distribution, and the sum of the negative Kullback-Leibler (KL) divergence between the posterior distribution and the prior distribution of the latent variable, expressed as follows:
[0138]
[0139] (4) Model training and model testing: First, the autoencoder is trained on a dataset of normal data sequences to learn the network parameters of the autoencoder. Then, the trained autoencoder is used to encode new data points into a low-dimensional latent space representation. The threshold-based DTW similarity measurement method is then used to test the autoencoder. DTW is calculated as follows:
[0140] L(0,0)=0; L(0,1:l2)=+∞; L(1:l1,0)=+∞
[0141]
[0142]
[0143] Corresponding to the aforementioned embodiment of the unsupervised IoV anomaly detection method based on a physical invariant subspace, the present invention also provides an embodiment of an unsupervised IoV anomaly detection system based on a physical invariant subspace implemented using the aforementioned method. The unsupervised IoV anomaly detection system based on a physical invariant subspace includes:
[0144] The data acquisition and preprocessing module collects time series data of the vehicle's driving status through on-board sensors and performs data preprocessing on the collected data;
[0145] A Kalman variational autoencoder with a subspace extraction layer is used to train the preprocessed data to reconstruct a compact behavior sequence with feature correlation that satisfies physical laws to capture the normal pattern of multivariate temporal behavior sequences;
[0146] A state estimator based on iterative reweighted least squares is used to perform state estimation on the behavior sequence reconstructed by the Kalman variational autoencoder;
[0147] The anomaly detector is used to perform adaptive non-parametric cumulative summation on the state difference between the state predicted by the state estimator and the state observed by the sensor to obtain an anomaly detection result.
[0148] An embodiment of the present invention also provides an unsupervised vehicle network anomaly detection device based on a physical invariant subspace, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement the above-mentioned unsupervised vehicle network anomaly detection method based on a physical invariant subspace.
[0149] An embodiment of the present invention also provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the above-mentioned unsupervised vehicle network anomaly detection method based on physical invariant subspace is implemented.
[0150] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of this specification shall be included in the scope of protection of one or more embodiments of this specification.
Claims
1. An unsupervised vehicle network anomaly detection method based on physical invariant subspace, characterized by: include: Collect time series data of vehicle driving status through on-board sensors and perform data preprocessing on the collected data; A Kalman variational autoencoder with a subspace extraction layer is used to train the preprocessed data to reconstruct a compact behavior sequence with feature correlation that satisfies physical laws to capture the normal pattern of multivariate temporal behavior sequences. The Kalman variational autoencoder consists of three components: the encoder network Subspace extraction layer and decoder network in, represents sample data, Indicates that it contains x t The latent variables of the features, is the hidden variable z t The subspace representation extracted after linear transformation, is the behavior sequence output by the decoder network, φ and θ are the encoder and decoder network parameters respectively, is the latent variable introduced in the autoencoder, in represents the latent variable b t The importance of the i-th physical property of the motion state, b t The overall importance of β t Indicates, C represents the measurement matrix; the Kalman variational autoencoder takes the sequence x t-T:t That is x t And the sample data of the previous T consecutive observation moments are used as input to reconstruct The specific steps are: (1) The encoder network takes the input sample data sequence x t-T:t Mapped to the latent variable sequence z t-T:t On, denoted as {z t },{z t } obey the posterior distribution (2) Subspace extraction layer Extract z t The important correlation features in the feature subspace representation are obtained (3) Decoder network learns an approximation of the prior distribution Representing the subspace Map back to the original data space; The state of the reconstructed behavior sequence is estimated using a state estimator based on iterative reweighted least squares. Anomaly detector is used to perform adaptive non-parametric cumulative summation of the state difference between the state predicted by the state estimator and the state observed by the sensor for anomaly detection.
2. The method according to claim 1, characterized in that The time series data is transmitted in real time in the vehicle network to form a discrete time-invariant model to describe the dynamic behavior of the vehicle. The discrete time-invariant model is expressed as follows: in, Represent the state vector, control input vector and output vector at time k respectively; A, B, C represent the state transfer matrix, input matrix and measurement matrix respectively; represents independent and identically distributed noise, is a positive definite symmetric matrix; n, c, and m represent the dimensions of the system's state vector, control input vector, and output vector, respectively.
3. The method according to claim 2, characterized in that The data preprocessing is specifically as follows: Perform deviation normalization and sliding window segmentation to obtain a series of sequences {x t-T ,x t-T+1 ,…,x t }, recorded as sequence or Where n represents the number of sample points, t represents the starting time point of the sliding window, and x t Represents the state vector at the starting time point of the sliding window.
4. The method according to claim 1, wherein The subspace extraction layer uses a robust sparse subspace extraction model with latent variables to decompose the data matrix into a low-rank matrix and a sparse matrix. The optimization function is expressed as: subject to P T P=I d in, and express with b t The sequence composed of the i-th dimension of is the principal component analysis loading matrix, is the regression sparse matrix; represents the sum of the L2 norms of all rows of the matrix; the parameter λ weighs the measurement accuracy and the principal component extraction accuracy, η is the regularization parameter, I d It is a d×d unit matrix, where d represents the dimension of the unit matrix.
5. The method according to claim 4, characterized in that The objective function of the Kalman variational autoencoder is the variational lower bound, defined as the expected log-likelihood of the probability distribution in the autoencoder with respect to the posterior distribution, and the sum of the negative KL divergence between the posterior and prior distributions of the latent variables, expressed as follows: Among them, u t is the control input sequence after data preprocessing, φ1 is the encoder network parameter without subspace extraction, φ2 is the encoder network parameter after subspace extraction, θ1 and θ2 are the decoder network parameters; and is a Gaussian distribution, indicating that given u t Under the condition of t or The prior distribution of Represents the log-likelihood of the decoder network output data, through the latent variable z t and Reconstruct the input data, the decoder network is controlled by parameters θ1 and θ2; D KL (·) represents the KL divergence; the first term of the objective function is the negative reconstruction loss term, and the second and third terms are regularization terms.
6. The method according to claim 5, characterized in that Through the inverse sliding window segmentation step, the reconstructed sequence is reassembled into the original state vector, where the state vector at time k after reorganization is expressed as The state estimation is performed by iteratively reweighted least squares fitting, and the weights of the observation sequence are continuously adjusted to obtain the best fitting parameters. The specific steps are as follows: (1) Establish a state estimator based on iterative reweighted least squares, which is expressed as follows: Among them, W k is a diagonal matrix whose elements are w k ; (2) Minimize the sum of squared errors J k : in is the observation sequence; (3) Calculate the residual vector r k : (4) Adjust the weight factor w k : Adjust the weight factor according to the size of the residual at each iteration; (5) Determine whether it converges: After each iteration, k The value of determines whether it converges. If it converges, it returns as the final estimate of the state vector.
7. The method according to claim 6, characterized in that The anomaly detector uses the statistical decision metric of adaptive non-parametric cumulative sum to perform anomaly detection. The detection steps are as follows: (1) Formalize the statistical decision metric of anomaly detectors: in, is the attack vector, represents the state vector at time i, D k Represents the cumulative value in all time windows l before time k, and takes the maximum value among them, Indicates the observed The probability density function of Indicates the observed attack state The probability density function of The statistical decision quantity is expressed as: Among them, σ i is the standard deviation of the i-th observation, r i is the residual vector of the i-th observation; Or expressed recursively: in, is a k The predicted value of ARL0 represents the average time interval that the system maintains a normal state when there are no abnormalities; (2) Using exponentially weighted moving average statistics to predict the attack vector a one step ahead k Make a prediction: Among them, a min Indicates the minimum measurable offset, θ(e k ) is a monotonic function that represents the relationship between the weighted average of new observations and the prediction error; (3) Anomaly detection decision: When the statistical decision amount The anomaly detector issues an alarm when , where δ is the detection threshold of the sensor.
8. The method according to claim 7, characterized in that The training and testing of the Kalman variational autoencoder are specifically as follows: first, the autoencoder is trained on a dataset of normal data sequences to learn the network parameters of the autoencoder, then the trained autoencoder is used to encode new data points into a low-dimensional latent space representation, and then the threshold-based DTW similarity measurement method is used to test the autoencoder.
9. An unsupervised vehicle network anomaly detection system based on physical invariant subspace implemented by the method according to any one of claims 1 to 8, characterized in that: include: The data acquisition and preprocessing module collects time series data of the vehicle's driving status through on-board sensors and performs data preprocessing on the collected data; A Kalman variational autoencoder with a subspace extraction layer is used to train the preprocessed data to reconstruct a compact behavior sequence with feature correlation that satisfies physical laws to capture the normal pattern of multivariate temporal behavior sequences; A state estimator based on iterative reweighted least squares is used to perform state estimation on the behavior sequence reconstructed by the Kalman variational autoencoder; The anomaly detector is used to perform adaptive non-parametric cumulative summation on the state difference between the state predicted by the state estimator and the state observed by the sensor to obtain an anomaly detection result.