Abnormality detection method and device for remote unlocking of vehicle at abnormal time

Abstract

The application provides an abnormality detection method for automobile abnormal time remote unlocking, comprising: acquiring a plurality of remote unlocking behavior information; constructing the behavior characteristics of each vehicle VIN code in the time dimension according to the remote unlocking time; the behavior characteristics include the unlocking times in each period; clustering the behavior characteristics according to a clustering algorithm to obtain K behavior mode clusters; each behavior mode cluster includes a mode cluster ID; the mode cluster ID is associated with the vehicle VIN code; determining the feature items of each behavior mode cluster in the K behavior mode clusters; training the K behavior mode clusters according to the feature items to obtain the model of each behavior mode cluster; when performing abnormality detection, receiving the reported current vehicle VIN code and current remote unlocking time, determining the behavior mode cluster ID where the VIN code is located; determining the target model according to the behavior mode cluster ID; judging whether the current remote unlocking time is abnormal through the target model; and generating an abnormality detection result when it is abnormal.

Description

Technical Field

[0001] This invention relates to the field of data processing, and in particular to an anomaly detection method and apparatus for remotely unlocking a car at abnormal times. Background Technology

[0002] With the rapid development of intelligent and internet-connected vehicles, remote car unlocking technology has brought great convenience to many car owners. It allows owners to easily lock and unlock their cars using their mobile phones or other smart devices without physical contact. However, this advanced technology has also raised a series of security concerns.

[0003] In recent years, cybersecurity attacks on automobiles have become increasingly common. For example, techniques such as man-in-the-middle attacks and replay attacks are used to remotely unlock vehicles, creating security vulnerabilities.

[0004] To ensure unlocking security, existing technologies can either perform remote unlocking based on fixed rules or train a separate unlocking model for each vehicle owner. Fixed rules include: if the wrong password is entered multiple times within a short period, the system will automatically lock; or, based on the owner's habits, the system will set a fixed time window during which unlocking will not occur, and any unlocking operation within this timeframe will be considered abnormal.

[0005] The existing technology has the following problems:

[0006] The contradiction between universality and accuracy. Anomaly detection methods that rely on car owner habits often tend to look for common behaviors among car owners and then apply uniform settings based on these behavioral characteristics. While this strategy simplifies the process, its accuracy is poor, easily leading to a "one-size-fits-all" effect. For example, using 12:00 AM to 5:00 AM as the time when most car owners do not remotely unlock their vehicles ignores those who work or are active at night, making their normal remote unlocking behavior vulnerable to external attacks or false alarms.

[0007] The challenges of resources and efficiency. As the number of car owners increases, training a separate model for each owner puts enormous pressure on storage and computing resources. For example, assuming each model requires 2MB of space, models for 1 million car owners would require up to 2TB of storage, significantly consuming memory resources. Furthermore, the demands for rapid model retrieval and loading in real-time detection scenarios are extremely high, further increasing the system's complexity.

[0008] The homogeneity of car owner behavior. In actual observation, many car owners exhibit similar behaviors in specific scenarios. For example, peak commuting times for office workers are often concentrated in specific periods in the morning and evening. This means that if these homogeneous behaviors can be identified and integrated, the number of models and the complexity of implementation can be greatly simplified. Summary of the Invention

[0009] This invention proposes an anomaly detection method and device for remote unlocking of a car at abnormal times, in order to solve the problems existing in the prior art.

[0010] In a first aspect, the present invention provides an anomaly detection method for remote unlocking of a vehicle at abnormal times, the method comprising:

[0011] Acquire multiple remote unlocking behavior information; the remote unlocking behavior information includes the vehicle VIN code and the remote unlocking time;

[0012] Based on the remote unlocking time, construct the behavioral characteristics of each vehicle's VIN code in the time dimension; the behavioral characteristics include the number of unlocks in each time period;

[0013] The behavioral features are clustered according to a clustering algorithm to obtain K behavioral pattern clusters; each behavioral pattern cluster includes a pattern cluster ID; the pattern cluster ID is associated with the vehicle VIN code.

[0014] Determine the feature terms of each behavior pattern cluster in K behavior pattern clusters;

[0015] Based on the aforementioned features, K behavioral pattern clusters are trained to obtain a model for each behavioral pattern cluster;

[0016] When performing anomaly detection, the system receives the reported current vehicle VIN code and current remote unlocking time, and determines the behavior pattern cluster ID to which the VIN code belongs.

[0017] The target model is determined based on the behavior pattern cluster ID;

[0018] Based on the target model, determine whether the current remote unlocking time is abnormal;

[0019] When an anomaly is detected, an anomaly detection result is generated.

[0020] In one possible implementation, after acquiring multiple remote unlocking behavior information, the method further includes:

[0021] The remote unlocking behavior information is preprocessed; wherein, the preprocessing includes filling or removing missing values ​​and correcting non-standard or erroneous time formats.

[0022] In one possible implementation, constructing the behavioral characteristics of each vehicle VIN code in the time dimension based on the remote unlocking time specifically includes:

[0023] Within a preset time period, the number of times each car owner unlocks the vehicle during multiple time periods is determined. These multiple time periods include the daily hourly average, daily hourly maximum, daily hourly minimum, daily hourly mode, unlocking times from 0:00 to 7:00 on weekdays, unlocking times from 7:00 to 12:00 on weekdays, unlocking times from 12:00 to 18:00 on weekdays, unlocking times from 18:00 to 24:00 on weekdays, unlocking times from 0:00 to 7:00 on weekends, unlocking times from 7:00 to 12:00 on weekends, unlocking times from 12:00 to 18:00 on weekends, and unlocking times from 18:00 to 24:00 on weekends.

[0024] In one possible implementation, the step of clustering the behavioral features according to a clustering algorithm to obtain K behavioral pattern clusters specifically includes:

[0025] Based on the elbow method, determine K categories;

[0026] The K-means clustering algorithm is used to cluster behavioral features to obtain K clusters of behavioral patterns.

[0027] In one possible implementation, determining the feature terms of each of the K behavioral pattern clusters specifically includes:

[0028] Determine the first and second feature terms for feature calculation;

[0029] In the behavior pattern cluster, determine the first remote unlock count of the first feature item and the second remote unlock count of the second feature item under multiple remote unlock times.

[0030] In one possible implementation, training K behavior pattern clusters based on the feature terms to obtain a model for each behavior pattern cluster specifically includes:

[0031] In each behavioral pattern cluster, the first feature term and the second feature term are used as samples of an isolated tree, and the isolated tree is trained using these samples.

[0032] Randomly select one feature from the first feature and the second feature as the selected feature, and randomly select a feature value within the range of the selected feature. Perform a binary partition on the selected feature, and partition samples with values ​​less than the feature value to the left of the node, and partition samples with values ​​greater than the feature value to the right of the node.

[0033] Continue dividing the samples to the left and right of the node until the termination condition is met.

[0034] The test data is traversed down the isolated tree along the corresponding conditional branches until a leaf node is reached, and the length of the path traversed is recorded.

[0035] Calculate the anomaly score of the data to be tested based on the path length;

[0036] The probability of an anomaly is determined based on the anomaly score.

[0037] Secondly, the present invention provides an anomaly detection device for remote unlocking of a vehicle at abnormal times, the device comprising:

[0038] The acquisition module is used to acquire multiple remote unlocking behavior information, including the vehicle VIN code and the remote unlocking time.

[0039] A construction module is used to construct behavioral characteristics of each vehicle VIN code in the time dimension based on the remote unlocking time; the behavioral characteristics include the number of unlocks in each time period;

[0040] A clustering module is used to cluster the behavioral features according to a clustering algorithm to obtain K behavioral pattern clusters; each behavioral pattern cluster includes a pattern cluster ID; the pattern cluster ID is associated with the vehicle VIN code;

[0041] The determining module is used to determine the feature terms of each behavior pattern cluster in K behavior pattern clusters;

[0042] The training module is used to train K behavior pattern clusters based on the feature terms to obtain a model for each behavior pattern cluster.

[0043] The receiving module is used to receive the reported current vehicle VIN code and current remote unlocking time when anomaly detection is performed.

[0044] The determining module is further configured to determine the behavior pattern cluster ID to which the VIN code belongs; and determine the target model based on the behavior pattern cluster ID;

[0045] The judgment module is used to determine whether the current remote unlocking time is abnormal based on the target model;

[0046] A generation module is used to generate anomaly detection results when an anomaly occurs.

[0047] Thirdly, the present invention provides a computer server, comprising: a memory, a processor, and a transceiver;

[0048] The processor is used to couple with the memory, read and execute instructions in the memory to implement the abnormal detection method for remote unlocking of a car at abnormal times as described in any of the first aspects.

[0049] The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0050] Fourthly, the present invention provides a chip system including a processor coupled to a memory, the memory storing program instructions, wherein when the program instructions stored in the memory are executed by the processor, the abnormal detection method for remote unlocking of a vehicle at abnormal times as described in any of the first aspects is implemented.

[0051] Fifthly, the present invention provides a computer-readable storage medium storing a computer program, the computer program being executed by a processor as described in any one of claims 1-5 for the abnormal detection method of remote unlocking of a vehicle at abnormal times.

[0052] By applying the anomaly detection method for remote unlocking of vehicles at abnormal times provided in this invention, behavioral features are constructed by acquiring the vehicle owner's recent remote unlocking operation records. These behavioral features can better characterize the vehicle owner's remote unlocking habits. This application utilizes an advanced clustering algorithm to effectively aggregate vehicle owners with similar behavioral habits, which not only improves data processing efficiency but also provides a better foundation for subsequent behavioral pattern learning. Furthermore, clustering vehicle owners with similar behavioral habits effectively reduces the use of storage and search resources, which is particularly important for large-scale data processing systems, helping to reduce complexity and usage costs. This application uses an unsupervised algorithm model to learn and train each behavioral pattern cluster, better adapting to the personalized usage habits of vehicle owners and improving the accuracy and reliability of anomaly detection. Attached Figure Description

[0053] Figure 1 This is a schematic diagram of the abnormal detection method for remote unlocking of a car at abnormal times provided in Embodiment 1 of the present invention;

[0054] Figure 2 To determine the K value based on the elbow method;

[0055] Figure 3 To obtain multiple clusters of behavioral patterns through clustering;

[0056] Figure 4A A schematic diagram of the uncommon remote unlocking time for the first behavior pattern cluster;

[0057] Figure 4B A schematic diagram of the uncommon remote unlocking time for the second behavior pattern cluster;

[0058] Figure 5 This is a schematic diagram of the abnormal detection device for remote unlocking of a car at abnormal times provided in Embodiment 2 of the present invention;

[0059] Figure 6 This is a schematic diagram of the computer server structure provided in Embodiment 3 of the present invention;

[0060] Figure 7 This is a schematic diagram of the chip system structure provided in Embodiment 4 of the present invention;

[0061] Figure 8 This is a schematic diagram of the chip system structure provided in Embodiment 5 of the present invention. Detailed Implementation

[0062] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0063] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0064] Example 1

[0065] Embodiment 1 of this invention provides an anomaly detection method for remote unlocking of a car at abnormal times. The executing entity of this application is a server, or a system or device with computing and processing functions, such as... Figure 1 As shown, the method includes the following steps:

[0066] Step 110: Obtain information on multiple remote unlocking actions.

[0067] The remote unlocking information includes the vehicle's VIN code and the remote unlocking time; the vehicle's VIN code is associated with the vehicle owner's ID.

[0068] Following step 110, the following may also be included:

[0069] Preprocess information about remote unlocking behavior.

[0070] Preprocessing includes imputing or removing missing values ​​and correcting non-standard or erroneous time formats. This ensures the high accuracy and completeness of the dataset, creating a solid and reliable foundation for subsequent cluster analysis and model building.

[0071] The preprocessed remote unlocking behavior information is shown in Table 1:

[0072] 0001 2023-10-29 08:12:35 0001 2023-10-28 08:05:15 0002 2023-10-29 07:59:25 0002 2023-10-28 08:14:32 0003 2023-10-27 12:14:32 0003 2023-10-27 12:24:19 0004 2023-10-28 12:19:20 …… ……

[0073] Table 1

[0074] Step 120: Based on the remote unlocking time, construct the behavioral characteristics of each vehicle's VIN code in the time dimension; the behavioral characteristics include the number of unlocks in each time period;

[0075] Specifically, step 120 includes determining the number of times each car owner unlocks the vehicle during multiple time periods within a preset duration; these multiple time periods include the daily hourly average, daily hourly maximum, daily hourly minimum, daily hourly mode, number of unlocks from 0:00 to 7:00 on weekdays, number of unlocks from 7:00 to 12:00 on weekdays, number of unlocks from 12:00 to 18:00 on weekdays, number of unlocks from 18:00 to 24:00 on weekdays, number of unlocks from 0:00 to 7:00 on weekends, number of unlocks from 7:00 to 12:00 on weekends, number of unlocks from 12:00 to 18:00 on weekends, and number of unlocks from 18:00 to 24:00 on weekends.

[0076] The preset duration can be set based on experience, and this application does not limit it. For example, the preset duration could be one week. For each car owner, behavioral characteristics of that car owner within one week can be constructed.

[0077] In one example, the following behavioral characteristics were constructed based on the weekly time dimension:

[0078] (1) Daily hourly average ("hour_mean"): This indicates the average number of times the car owner unlocks the car per hour throughout the day.

[0079] (2) Daily hourly maximum value ("hour_max"): This indicates the maximum number of times a car owner can unlock the car in a certain hour of the day.

[0080] (3) Daily hourly minimum ("hour_min"): This indicates the minimum number of times the car owner must unlock the car in a given hour of the day.

[0081] (4) Hour mode ("hour_mode"): This indicates the hour during which the car owner unlocks the car the most times in a day.

[0082] (5) Average number of unlocks per week ("avg_weekly_unlock_count"): This indicates the average number of times the owner unlocks the car per week.

[0083] (6) Number of unlocks during weekdays from 0:00 to 7:00 ("day_1-5_hour_0-7_unlock_count"): This indicates the total number of times the owner unlocks the car during the weekday period from 0:00 to 7:00.

[0084] (7) Number of unlocks during weekdays from 7:00 to 12:00 ("day_1-5_hour_7-12_unlock_count"): This indicates the total number of times the owner unlocks the car during the weekdays from 7:00 to 12:00.

[0085] (8) Number of unlocks during weekdays from 12:00 to 18: This indicates the total number of times the owner unlocks the car during the weekdays from 12:00 to 18:00.

[0086] (9) Number of unlocks during weekdays from 18:00 to 24: This indicates the total number of times the owner unlocks the car during the weekdays from 18:00 to 24:00.

[0087] (10) Number of unlocks during weekend 0-7 hours ("day_6-7_hour_0-7_unlock_count"): This indicates the total number of times the owner unlocks the car during the weekend 0-7 hours.

[0088] (11) Number of unlocks during weekends from 7 to 12 ("day_6-7_hour_7-12_unlock_count"): This indicates the total number of times the owner unlocks the car during the weekend from 7 to 12.

[0089] (12) Number of unlocks during weekends from 12:00 to 18:00 ("day_6-7_hour_12-18_unlock_count"): This indicates the total number of times the owner unlocks the car during the weekend from 12:00 to 18:00.

[0090] (13) Number of unlocks during weekends from 6 PM to 11 AM ("day_6-7_hour_18-24_unlock_count"): This indicates the total number of times the owner unlocks the car during the weekend from 6 PM to 11 AM.

[0091] Step 130: Based on the clustering algorithm, cluster the behavioral features to obtain K behavioral pattern clusters; each behavioral pattern cluster includes a pattern cluster ID; the pattern cluster ID is associated with the vehicle VIN code;

[0092] Specifically, step 130 includes the following steps:

[0093] Based on the elbow method, determine K categories;

[0094] The K-means clustering algorithm is used to cluster behavioral features to obtain K clusters of behavioral patterns.

[0095] In the K-means algorithm, choosing an appropriate value for K is crucial. To determine the optimal number of clusters, the "elbow method" is commonly used to evaluate the clustering performance at different K values. The basic principle of the elbow method is that as the number of clusters K increases, the Within Set Sum (WSS) of errors within each cluster gradually decreases. However, when K reaches a certain value, the rate of decrease in WSS suddenly slows down. This turning point, like a person's "elbow," represents the optimal value of K.

[0096] After experimental analysis of owner behavior data for nearly 1 million vehicles, such as... Figure 2As shown, the elbow method reveals that when the number of clusters is approximately 4000, the rate of decrease in the sum of squared errors begins to slow down, thus determining the optimal K value to be 4000.

[0097] Based on this optimal K value, vehicle owners were clustered, resulting in 4000 unique behavioral pattern clusters. A complete mapping table between vehicle owner's VIN and behavioral pattern cluster ID was simultaneously generated, ensuring that the behavioral pattern cluster to which each vehicle owner belongs is clearly identified. The obtained behavioral pattern clusters can be found in [link to table]. Figure 3 .

[0098] Two behavioral pattern clusters are randomly selected, and the unlocking behavioral patterns of each cluster are plotted weekly. Figure 4A As shown, the horizontal axis represents the seven days of the week, and the vertical axis represents the number of remote unlocks. Figure 4A and Figure 4B It can be seen that the time for unused remote unlocking is different under the two behavior pattern clusters.

[0099] Step 140: Determine the feature terms of each behavior pattern cluster in the K behavior pattern clusters;

[0100] Specifically, step 140 includes the following:

[0101] Determine the first and second feature terms for feature calculation;

[0102] In the behavior pattern cluster, determine the first remote unlock count of the first feature and the second remote unlock count of the second feature.

[0103] Continuing with the previous example, after behavior clustering, each behavior pattern cluster includes multiple remote unlocking times associated with the vehicle's VIN code. To build an accurate model for each behavior pattern cluster, the data within each cluster needs to be processed, and feature extraction operations need to be performed on this data. See Table 2:

[0104] 1 0001 2023-10-29 08:12:35 1 0001 2023-10-28 08:05:15 1 0002 2023-10-29 07:59:25 1 0002 2023-10-28 08:14:32 2 0003 2023-10-27 12:14:32 2 0003 2023-10-27 12:24:19 2 0004 2023-10-28 12:19:20 …… …… ……

[0105] Table 2

[0106] On the dataset in Table 2, key features need to be extracted from remote unlock times. At this point, the analysis continues using the time dimension of "week," with "day of the week" as the first feature and "hour of the day" as the second feature. The first remote unlock count for the first feature and the second remote unlock count for the second feature are determined, respectively. For example, 2023-10-29 08:12:35 is extracted to be Sunday 8:00 AM. Therefore, the features obtained for each behavior pattern cluster are shown in Table 3.

[0107]

[0108]

[0109] Table 3

[0110] As shown in Table 3, when the behavior pattern cluster ID is 0001 and the remote unlock time is 2023-10-29 08:12:35, the first feature term is 7 and the second feature term is 8. This transforms the data within the behavior pattern cluster into a form that can be directly utilized by machine learning models. This not only enhances the data's expressive power but also provides a solid foundation for subsequent model training and validation.

[0111] Step 150: Based on the feature terms, train the K behavior pattern clusters to obtain the model for each behavior pattern cluster;

[0112] Specifically, this application can train a model using an unsupervised algorithm, such as the isolated forest tree algorithm. Step 150 explains how to build a model based on the isolated forest tree algorithm, including the following steps:

[0113] In each behavioral pattern cluster, the first and second feature terms are used as samples for the isolated tree, and the isolated tree is trained using these samples.

[0114] Randomly select one feature term from the first feature term and the second feature term as the selected feature term, and randomly select a feature value within the range of the selected feature term. Perform a binary partition on the selected feature term, and partition the samples with values ​​less than the feature value to the left of the node, and partition the samples with values ​​greater than the feature value to the right of the node.

[0115] Continue dividing the samples to the left and right of the node until the termination condition is met.

[0116] The test data is traversed down the isolated tree along the corresponding conditional branches until a leaf node is reached, and the length of the path traversed is recorded.

[0117] Calculate the anomaly score of the data to be tested based on the path length;

[0118] The probability of an anomaly is determined based on the anomaly score.

[0119] Specifically, through feature extraction in step 140, multiple feature terms are obtained in each behavior pattern cluster, thus constructing a feature set for that behavior pattern cluster. For each feature set, the isolated forest algorithm is used to train a model for each behavior pattern cluster, ensuring that each behavior pattern cluster can obtain a unique model representation. This successfully constructs 4000 independent models that accurately characterize car owner behavior patterns, forming a model library. This ensures that car owner behavior can be effectively identified and analyzed in practical applications.

[0120] The first stage of the Isolation Forest algorithm involves training isolated trees to form an isolated forest. Each sample is then fed into each isolated tree in the forest, and the average height is calculated. Afterward, an outlier score is calculated for each sample. Within each behavioral pattern cluster, samples can be considered as features. Each feature is fed into each isolated tree, its average height is calculated, and then an outlier score is calculated for each feature. If the outlier score of a feature is greater than a preset value, it indicates that the feature has a high probability of being abnormal.

[0121] Specifically, assuming the dataset has N data points, an isolated tree is constructed by uniformly sampling (usually without replacement) ψ samples from the N data points as training samples for this isolated tree.

[0122] In the training samples, a feature is randomly selected, and a value is randomly selected from all values ​​of this feature (between the minimum and maximum values). The samples are then divided into two binary parts: those less than the selected value are assigned to the left of the node, and those greater than or equal to the selected value are assigned to the right of the node.

[0123] This yields a splitting condition and two datasets (left and right). The process is then repeated on both datasets until the termination condition is met. There are two termination conditions: one is that the data itself is indivisible (containing only one sample, or all samples are identical), and the other is that the tree height reaches a set value. Once all the isolated trees are constructed, predictions can be made. The prediction process involves traversing the test data along the corresponding conditional branch on the isolated tree until a leaf node is reached, recording the path length h(x) along the way—the number of edges traversed from the root node, through intermediate nodes, to the leaf node.

[0124] Finally, substitute h(x) into Calculate the anomaly score for each data point to be tested.

[0125] Where E(h(x)) is the mean path length of the sample in t isolated trees; c(n) = 2H(n-1) - (2(n-1) / n) is the average path length of the binary search tree, used to normalize the result; n is the number of samples; the exponential part has a range of (-∞, 0), therefore the range of s is (0, 1). The smaller the path length, the closer s is to 1, and the greater the probability that the sample is an outlier.

[0126] If the S(x) score is closer to 1, it is more likely to be an outlier; if the scores are all less than 0.5, then it can be basically determined to be normal data; if all scores are around 0.5, then the data does not contain obvious outliers.

[0127] Therefore, by establishing a model for each behavioral pattern cluster, anomaly detection can be performed on the data to be tested. In this application, the data to be tested can be any remote unlocking behavior information.

[0128] Step 160: When performing anomaly detection, receive the reported current vehicle VIN code and current remote unlocking time, and determine the behavior pattern cluster ID where the VIN code belongs;

[0129] Step 170: Determine the target model based on the behavior pattern cluster ID;

[0130] Step 180: Determine whether the current remote unlocking time is abnormal using the target model;

[0131] Step 190: When an anomaly occurs, generate an anomaly detection result.

[0132] Specifically, when detecting abnormal remote unlocking behavior, the vehicle's VIN number from the reported information is first used for precise lookup to determine its corresponding behavior pattern cluster ID. Then, based on the behavior pattern cluster ID, the corresponding model is loaded for subsequent anomaly detection. The anomaly detection results include the vehicle VIN, abnormal time, anomaly label, and anomaly score. The abnormal time indicates the time the vehicle was remotely unlocked; the anomaly label is -1 or 1, where -1 represents abnormal and 1 represents normal; the anomaly score is a floating-point value between -1 and 1, with values ​​closer to -1 indicating a stronger anomaly and values ​​closer to 1 indicating a stronger normality.

[0133] At this point, the method for anomaly detection is the same as the method for anomaly detection of the test data in step 150, and will not be repeated here. This ensures that the remote unlocking detection process is both efficient and accurate.

[0134] By applying the anomaly detection method for remote unlocking of vehicles at abnormal times provided in this invention, behavioral features are constructed by acquiring the vehicle owner's recent remote unlocking operation records. These behavioral features can better characterize the vehicle owner's remote unlocking habits. This application utilizes an advanced clustering algorithm to effectively aggregate vehicle owners with similar behavioral habits, which not only improves data processing efficiency but also provides a better foundation for subsequent behavioral pattern learning. Furthermore, clustering vehicle owners with similar behavioral habits effectively reduces the use of storage and search resources, which is particularly important for large-scale data processing systems, helping to reduce complexity and usage costs. This application uses an unsupervised algorithm model to learn and train each behavioral pattern cluster, better adapting to the personalized usage habits of vehicle owners and improving the accuracy and reliability of anomaly detection.

[0135] Example 2

[0136] Embodiment 2 of the present invention provides an anomaly detection device for remote unlocking of a car at abnormal times, such as... Figure 5 As shown, the device includes: an acquisition module 510, a construction module 520, a clustering module 530, a determination module 540, a training module 550, a judgment module 560, a receiving module 570, and a generation module 580.

[0137] The acquisition module 510 is used to acquire multiple remote unlocking behavior information; the remote unlocking behavior information includes the vehicle VIN code and the remote unlocking time;

[0138] The construction module 520 is used to construct the behavioral characteristics of each vehicle VIN code in the time dimension based on the remote unlocking time; the behavioral characteristics include the number of unlocks in each time period;

[0139] The clustering module 530 is used to cluster behavioral features according to a clustering algorithm to obtain K behavioral pattern clusters; each behavioral pattern cluster includes a pattern cluster ID; the pattern cluster ID is associated with the vehicle VIN code;

[0140] The determination module 540 is used to determine the feature terms of each behavior pattern cluster in the K behavior pattern clusters;

[0141] The training module 550 is used to train K behavior pattern clusters based on feature terms to obtain a model for each behavior pattern cluster;

[0142] The receiving module 560 is used to receive the reported current vehicle VIN code and current remote unlocking time when anomaly detection is performed;

[0143] The determination module 540 is also used to determine the behavior pattern cluster ID where the VIN code is located; and to determine the target model based on the behavior pattern cluster ID.

[0144] The judgment module 570 is used to determine whether the current remote unlocking time is abnormal based on the target model;

[0145] The generation module 580 is used to generate anomaly detection results when an anomaly occurs.

[0146] Furthermore, based on the remote unlocking time, the construction module 520 constructs the behavioral characteristics of each vehicle's VIN code in the time dimension, specifically including:

[0147] Within a preset time period, the number of times each car owner unlocks the vehicle during multiple time periods is determined. These multiple time periods include the daily hourly average, daily hourly maximum, daily hourly minimum, daily hourly mode, unlocking times from 0:00 to 7:00 on weekdays, unlocking times from 7:00 to 12:00 on weekdays, unlocking times from 12:00 to 18:00 on weekdays, unlocking times from 18:00 to 24:00 on weekdays, unlocking times from 0:00 to 7:00 on weekends, unlocking times from 7:00 to 12:00 on weekends, unlocking times from 12:00 to 18:00 on weekends, and unlocking times from 18:00 to 24:00 on weekends.

[0148] Furthermore, the clustering module 530 clusters the behavioral features according to the clustering algorithm, obtaining K behavioral pattern clusters, specifically including:

[0149] Based on the elbow method, determine K categories;

[0150] The K-means clustering algorithm is used to cluster behavioral features to obtain K clusters of behavioral patterns.

[0151] Furthermore, the feature terms determined by the determining module 540 for each of the K behavioral pattern clusters specifically include:

[0152] Determine the first and second feature terms for feature calculation;

[0153] In the behavior pattern cluster, determine the first remote unlock count of the first feature item and the second remote unlock count of the second feature item under multiple remote unlock times.

[0154] Furthermore, the determination module 540 trains the model for each of the K behavioral pattern clusters based on the feature terms, specifically including:

[0155] In each behavioral pattern cluster, the first and second feature terms are used as samples for the isolated tree, and the isolated tree is trained using these samples.

[0156] Randomly select one feature term from the first feature term and the second feature term as the selected feature term, and randomly select a feature value within the range of the selected feature term. Perform a binary partition on the selected feature term, and partition the samples with values ​​less than the feature value to the left of the node, and partition the samples with values ​​greater than the feature value to the right of the node.

[0157] Continue dividing the samples to the left and right of the node until the termination condition is met.

[0158] The test data is traversed down the isolated tree along the corresponding conditional branches until a leaf node is reached, and the length of the path traversed is recorded.

[0159] Calculate the anomaly score of the data to be tested based on the path length;

[0160] The probability of an anomaly is determined based on the anomaly score.

[0161] The apparatus provided in Embodiment 2 of the present invention can execute the method steps in Embodiment 1 of the above method. Its implementation principle and technical effect are similar, and will not be described again here.

[0162] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented by processing element calls to software, while others are implemented in hardware. For example, a determination module can be a separate processing element, or it can be integrated into a chip within the above device. Alternatively, it can be stored as program code in the memory of the above device, and its function can be called and executed by a processing element of the device. The implementation of other modules is similar. Moreover, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.

[0163] For example, these modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). As another example, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a System-on-a-Chip (SOC).

[0164] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The aforementioned computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The aforementioned computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the aforementioned computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, Bluetooth, microwave, etc.) means. The aforementioned computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The aforementioned available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

[0165] Example 3

[0166] Embodiment 3 of the present invention provides a computer server, such as Figure 6 As shown, it includes: memory, processor, and transceiver;

[0167] The processor is used to couple with the memory, read and execute instructions in the memory to implement any of the abnormal detection methods for remote unlocking of a car at abnormal times provided in Embodiment 1 above;

[0168] The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0169] Example 4

[0170] Embodiment 4 of the present invention provides a chip system, such as Figure 7 As shown, it includes a processor and a coupled memory. The memory stores program instructions. When the program instructions stored in the memory are executed by the processor, an abnormal detection method for remote unlocking of a car at abnormal times, as provided in Embodiment 1, is implemented.

[0171] Example 5

[0172] Embodiment 5 of the present invention provides a computer-readable storage medium, such as... Figure 8 As shown, it includes a program or instructions that, when run on a computer, implement any of the abnormal detection methods for remote unlocking of a car at abnormal times, as provided in Embodiment 1.

[0173] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0174] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0175] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An anomaly detection method for remote unlocking of a vehicle at abnormal times, characterized in that, The method includes: Acquire multiple remote unlocking behavior information; the remote unlocking behavior information includes the vehicle VIN code and the remote unlocking time; Based on the remote unlocking time, construct the behavioral characteristics of each vehicle's VIN code in the time dimension; the behavioral characteristics include the number of unlocks in each time period; The behavioral features are clustered according to a clustering algorithm to obtain K behavioral pattern clusters; each behavioral pattern cluster includes a pattern cluster ID; the pattern cluster ID is associated with the vehicle VIN code. Determine the feature terms of each behavior pattern cluster in K behavior pattern clusters; Based on the aforementioned features, K behavioral pattern clusters are trained to obtain a model for each behavioral pattern cluster; When performing anomaly detection, the system receives the reported current vehicle VIN code and current remote unlocking time, and determines the behavior pattern cluster ID to which the VIN code belongs. The target model is determined based on the behavior pattern cluster ID; Based on the target model, determine whether the current remote unlocking time is abnormal; When an anomaly is detected, an anomaly detection result is generated.

2. The method according to claim 1, characterized in that, After acquiring multiple remote unlocking behavior information, the method further includes: The remote unlocking behavior information is preprocessed; wherein, the preprocessing includes filling or removing missing values ​​and correcting non-standard or erroneous time formats.

3. The method according to claim 1, characterized in that, The specific steps of constructing the behavioral characteristics of each vehicle's VIN code in the time dimension based on the remote unlocking time include: Within a preset time period, the number of times each car owner unlocks the vehicle during multiple time periods is determined. These multiple time periods include the daily hourly average, daily hourly maximum, daily hourly minimum, daily hourly mode, unlocking times from 0:00 to 7:00 on weekdays, unlocking times from 7:00 to 12:00 on weekdays, unlocking times from 12:00 to 18:00 on weekdays, unlocking times from 18:00 to 24:00 on weekdays, unlocking times from 0:00 to 7:00 on weekends, unlocking times from 7:00 to 12:00 on weekends, unlocking times from 12:00 to 18:00 on weekends, and unlocking times from 18:00 to 24:00 on weekends.

4. The method according to claim 1, characterized in that, The step of clustering the behavioral features according to the clustering algorithm to obtain K behavioral pattern clusters specifically includes: Based on the elbow method, determine K categories; The K-means clustering algorithm is used to cluster behavioral features to obtain K clusters of behavioral patterns.

5. The method according to claim 1, characterized in that, The specific steps of determining the feature terms of each of the K behavioral pattern clusters include: Determine the first and second feature terms for feature calculation; In the behavior pattern cluster, determine the first remote unlock count of the first feature item and the second remote unlock count of the second feature item under multiple remote unlock times.

6. The method according to claim 5, characterized in that, The step of training K behavioral pattern clusters based on the feature terms to obtain a model for each behavioral pattern cluster specifically includes: In each behavioral pattern cluster, the first feature term and the second feature term are used as samples of an isolated tree, and the isolated tree is trained using these samples. Randomly select one feature from the first feature and the second feature as the selected feature, and randomly select a feature value within the range of the selected feature. Perform a binary partition on the selected feature, and partition samples with values ​​less than the feature value to the left of the node, and partition samples with values ​​greater than the feature value to the right of the node. Continue dividing the samples to the left and right of the node until the termination condition is met. The test data is traversed down the isolated tree along the corresponding conditional branches until a leaf node is reached, and the length of the path traversed is recorded. Calculate the anomaly score of the data to be tested based on the path length; The probability of an anomaly is determined based on the anomaly score.

7. An anomaly detection device for remote unlocking of a car at abnormal times, characterized in that, The device includes: The acquisition module is used to acquire multiple remote unlocking behavior information, including the vehicle VIN code and the remote unlocking time. A construction module is used to construct behavioral characteristics of each vehicle VIN code in the time dimension based on the remote unlocking time; the behavioral characteristics include the number of unlocks in each time period; A clustering module is used to cluster the behavioral features according to a clustering algorithm to obtain K behavioral pattern clusters; each behavioral pattern cluster includes a pattern cluster ID; the pattern cluster ID is associated with the vehicle VIN code; The determining module is used to determine the feature terms of each behavior pattern cluster in K behavior pattern clusters; The training module is used to train K behavior pattern clusters based on the feature terms to obtain a model for each behavior pattern cluster. The receiving module is used to receive the reported current vehicle VIN code and current remote unlocking time when anomaly detection is performed. The determining module is further configured to determine the behavior pattern cluster ID to which the VIN code belongs; and determine the target model based on the behavior pattern cluster ID; The judgment module is used to determine whether the current remote unlocking time is abnormal based on the target model; A generation module is used to generate anomaly detection results when an anomaly occurs.

8. A computer server, characterized in that, include: Memory, processor, and transceiver; The processor is used to couple with the memory, read and execute instructions in the memory to implement the abnormal detection method for remote unlocking of a car at abnormal times as described in any one of claims 1-6; The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

9. A chip system, characterized in that, The device includes a processor coupled to a memory, the memory storing program instructions, which, when executed by the processor, implement the abnormal detection method for remote unlocking of a vehicle at abnormal times as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which is executed by a processor according to any one of claims 1-6, for the abnormal detection method of remote unlocking of a vehicle at abnormal times.

Images