A deep learning detection method for automotive software anomalies based on service mesh architecture

Abstract

The present invention discloses a deep learning detection method for automotive software anomalies based on a service mesh architecture, comprising the following steps: Step 1: Building a lightweight automotive service mesh covering the automotive electronic and electrical architecture to form a centralized data plane and control plane; Step 2: Deploying an automotive software anomaly detection module in the automotive service mesh control plane to subscribe to and analyze service runtime telemetry data in real time to perform real-time anomaly detection. The present invention proposes a deep learning detection method for automotive software anomalies based on a service mesh architecture. The method fully utilizes the global data aggregation capability provided by the control plane in the service mesh architecture to centralize heterogeneous data scattered across various service nodes, such as vehicle status data and environmental parameters, into a unified data plane for correlation analysis, thereby upgrading the detection mode from single structured data to global multimodal data.

Description

Technical Field

[0001] The present invention relates to the field of vehicle-mounted software reliability assurance, and in particular to a software anomaly detection method based on a deep learning algorithm and deployed on an automotive service grid architecture. In particular, the present invention relates to a deep learning detection method for automotive software anomalies based on a service grid architecture. Background Art

[0002] As vehicles transition to software-defined vehicles (SDVs), traditional distributed automotive electrical and electronic architectures are increasingly exposed to issues such as insufficient scalability, integration difficulties, and data silos, making them incapable of supporting the complex software functions required by smart cars. To address this challenge, the next generation of automotive electrical and electronic architectures is evolving toward centralized, high-performance computing platforms. Under this new architecture, electronic control units (ECUs) distributed throughout the vehicle will be gradually consolidated into fewer but more powerful domain controllers, or even a central computing platform. Simultaneously, the vehicle's internal network will be upgraded to a high-speed interconnect solution primarily based on Ethernet.

[0003] As automotive electrical and electronic architectures evolve, the paradigm for in-vehicle software development is also shifting. An increasing number of automakers are incorporating advanced IT concepts, decoupling software development from hardware and adopting a microservices-based architecture. Smart car software is divided into numerous loosely coupled microservices, independently developed, tested, and deployed, and then dynamically orchestrated on a service mesh infrastructure to address the explosive growth and rapid iteration demands of software. As a dedicated infrastructure layer, the service mesh handles service discovery, communication routing, monitoring, and tracking, allowing microservice development teams to focus on business logic and improving development efficiency.

[0004] However, the growing scale and complexity of automotive software systems, coupled with the dynamic nature of service-oriented architectures, present new challenges for ensuring software reliability. Anomaly detection is particularly critical. Traditional anomaly detection methods based on static rules or simple statistical models struggle to effectively address the high-dimensional, strongly correlated, and nonlinear behavior patterns of current in-vehicle software. Anomaly symptoms often manifest in the interaction data of multiple services, characterized by complex spatiotemporal dependencies and semantic associations, making them difficult to exhaustively capture using a single dimension. Furthermore, the complex and ever-changing automotive operating environment and the continuous evolution of in-vehicle software behavior make it difficult to predefine patterns of abnormal conditions. Summary of the Invention

[0005] In response to the technical problems pointed out in the background technology, the purpose of the present invention is to provide a deep learning detection method for automotive software anomalies based on a service grid architecture.

[0006] To achieve the purpose of the present invention, the technical solutions provided by the present invention are as follows:

[0007] A deep learning detection method for automotive software anomalies based on a service grid architecture includes the following steps:

[0008] Step 1: Build a lightweight automotive service grid covering the automotive electronic and electrical architecture, forming a centrally managed data and control plane.

[0009] Step 2: Deploy the automotive software anomaly detection module in the automotive service mesh control plane to subscribe to and analyze service runtime telemetry data in real time for real-time anomaly detection.

[0010] The service runtime telemetry data includes: service call topology data, service input and output data, and resource usage data.

[0011] Among them, the automotive software anomaly detection module includes an end-to-end deep learning anomaly detection model, which uses the anomaly detection model to perform real-time anomaly detection.

[0012] Compared with the prior art, the present invention has the following beneficial effects:

[0013] This paper proposes a deep learning detection method for automotive software anomalies based on a service mesh architecture. This method fully utilizes the global data aggregation capabilities provided by the control plane of the service mesh architecture to centralize heterogeneous data scattered across various service nodes, such as vehicle status data and environmental parameters, into a unified data plane for correlation analysis, thus upgrading the detection model from single structured data to global multimodal data.

[0014] In the data-based end-to-end deep learning model, the introduction of automotive software domain knowledge for integration alleviates the problems of scarce anomaly labels and insufficient model generalization; and realizes the development of the field of automotive software anomaly detection from rule-based to data-driven and then to knowledge-fused. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A schematic diagram of the method flow provided in the embodiment of the present application;

[0016] Figure 2 Schematic diagram of the end-to-end deep learning anomaly detection model provided in an embodiment of the present application; DETAILED DESCRIPTION

[0017] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0018] The solution proposed in this paper leverages the data advantages of a service mesh architecture to globally capture and integrate the multi-dimensional, dynamically migrating behavioral characteristics of in-vehicle software. It then uses an adaptive algorithm to learn normal and abnormal patterns. The proposed deep anomaly detection model, which integrates multiple knowledge points and is applied to a service mesh-based automotive electrical and electronic architecture, can effectively address these challenges.

[0019] On the one hand, by leveraging the global perspective and data aggregation capabilities provided by the service mesh control plane for automotive software operations, key data such as vehicle status parameters and performance parameters from in-vehicle software services is natively centralized on the control plane, creating high-dimensional data features for anomaly analysis. This creates the conditions for data-driven intelligent algorithms such as deep learning.

[0020] On the other hand, end-to-end deep neural networks that integrate multiple knowledge points can fully exploit the complex connections and unknown patterns within the heterogeneous data of the service mesh. At the underlying algorithm level, graph neural networks can be used to extract anomaly signals propagating through the service interaction topology, and time series models can be used to extract dynamic anomaly patterns within a single indicator. At the application layer, the importance of features from different dimensions for anomaly identification is adaptively learned. Furthermore, data on typical anomaly scenarios and physical models based on in-vehicle software domain knowledge can be embedded into the network structure to guide the training and inference of the anomaly detection model. This end-to-end model can continuously learn from the massive amount of operational data from the service mesh, approximating the boundary between normal and abnormal in-vehicle software behavior in real-world environments.

[0021] like Figure 1 As shown, this embodiment provides a deep learning detection method for automotive software anomalies based on a service grid architecture, including the following steps:

[0022] Step 1: Build a lightweight automotive service grid covering the automotive electronic and electrical architecture, forming a centrally managed data and control plane.

[0023] It should be noted that the lightweight service mesh built across the automotive electrical and electronic architecture forms a centrally managed data plane and control plane. Services access the mesh through data plane proxies, while the control plane is responsible for service registration and discovery, routing strategies, telemetry monitoring, and more.

[0024] The specific implementation process includes:

[0025] (1) Optimize the service registry to support dynamic registration and discovery of in-vehicle services. Consider introducing a distributed consensus protocol (Raft) to improve the fault tolerance of the service registry.

[0026] (2) Customized service gateway to provide security authentication and protection for off-vehicle access, and fine-grained permission control and traffic management for in-vehicle service access.

[0027] (3) Expand the monitoring indicators of the service grid to cover the vehicle-specific service quality and safety requirements, such as real-time performance, reliability, and functional safety.

[0028] Step 2: Deploy the automotive software anomaly detection module in the automotive service mesh control plane to subscribe to and analyze service runtime telemetry data in real time for real-time anomaly detection.

[0029] It's important to note that an automotive software anomaly detection module is deployed within the service mesh control plane to subscribe to and analyze runtime telemetry data in real time. This includes integrating the anomaly detection service into the mesh console, conducting corresponding testing, and optimizing detection algorithms. This is combined with mechanisms such as on-board diagnostics (OBD) and fault injection to continuously evaluate and improve anomaly detection capabilities.

[0030] The specific implementation process includes:

[0031] (1) Define the anomaly detection service interface: First, a standardized anomaly detection service interface needs to be defined to clarify the service’s input and output data formats and interaction methods.

[0032] (2) Develop anomaly detection services: Based on the defined interfaces, develop microservices that implement anomaly detection functions. This includes implementing encapsulated anomaly detection algorithms, encapsulating the deep learning anomaly detection algorithm based on multi-knowledge fusion as a service, implementing data subscription and caching, implementing the gRPC or REST API interface of the anomaly detection service, receiving telemetry data from the control plane, and returning anomaly detection results.

[0033] (3) Integrate the developed anomaly detection service into the service mesh control plane.

[0034] (4) For the service grid of automotive software, customize the telemetry data required for anomaly detection services, including: service call topology data, service input and output data, and resource usage data.

[0035] (5) Provide a management interface for anomaly detection services for automotive software development and operation and maintenance teams, integrated into the service grid console.

[0036] (6) Perform functional and performance testing of anomaly detection services in a service grid environment.

[0037] (7) Based on the operational data accumulated by the service grid, the anomaly detection model is continuously trained and optimized.

[0038] Specifically, the anomaly detection model F takes as input the telemetry data x of the automotive software service grid and outputs the anomaly determination result y.

[0039] y=F(x)

[0040] Among them, x contains monitoring indicator data of multiple services s at multiple time steps t, such as:

[0041] x={x_s1_t1,x_s1_t2,...,x_s1_tn,x_s2_t1,x_s2_t2,...,x_s2_tn,...,x_sm_t1,x_sm_t2,...,x_sm_tn}

[0042] Among them, model F includes: graph convolutional network (GCN), recurrent neural network (RNN) and attention mechanism.

[0043] Among them, the graph convolutional network is used to extract the structural features of the service call topology graph:

[0044] h_graph = GCN(A,X);

[0045] Among them, A is the adjacency matrix of the service call directed graph, X is the node feature matrix, GCN can be stacked in multiple layers, and the calculation formula for each layer is:

[0046] H^(l+1)=σ(D^-1 / 2·A·D^-1 / 2·H^(l)·W^(l))

[0047] Where D is the degree matrix of A, W is the weight matrix, and σ is the activation function (such as ReLU).

[0048] Recurrent neural networks are used to extract time series features of each service:

[0049] h_s1_rnn=RNN(x_s1_t1,x_s1_t2,...,x_s1_tn)

[0050] h_s2_rnn=RNN(x_s2_t1,x_s2_t2,...,x_s2_tn) ...

[0052] h_sm_rnn=RNN(x_sm_t1,x_sm_t2,...,x_sm_tn)

[0053] The definition of RNN is:

[0054] h_t=tanh(W_xh·x_t+W_hh·h_(t-1)+b_h)

[0055] The outputs of GCN and RNN are fused through the attention mechanism to generate the final anomaly score:

[0056] h_final=Attention(h_graph,h_s1_rnn,h_s2_rnn,...,h_sm_rnn)

[0057] y=Sigmoid(MLP(h_final))On this basis, an end-to-end deep learning algorithm is introduced to realize the upgrade of anomaly detection mode from local single data to global multimodal data.

[0058] The construction process of the anomaly detection model is as follows:

[0059] (1) Perform preprocessing operations such as cleaning, conversion, and normalization on the telemetry data collected by the automotive service grid. Specifically, this includes removing noise data such as missing values ​​and outliers to ensure data quality, converting unstructured or semi-structured data (such as call links and logs) into structured feature vectors, and normalizing the numerical ranges of different indicators to eliminate dimensionality effects.

[0060] (2) Based on the preprocessed data, a directed graph model of the call relationships between services is constructed. Each service is first abstracted as a node in the graph. Node attributes include the service name and the management domain to which it belongs. Directed edges are then generated based on the call relationships between services. As the call relationships in the service grid change dynamically, the nodes and edges of the graph are updated in real time.

[0061] (3) A graph convolutional network (GCN) is used to extract features from the service call topology graph (a dynamic description of the entire vehicle service grid, using a process of data preprocessing - building a directed graph of service calls - extracting features using a graph convolutional network - generating anomaly detection models - and model training and validation). A low-dimensional embedding representation of each service node is first learned through methods such as random walks or node attribute aggregation. Based on the node embedding, the feature information of neighboring nodes is aggregated through graph convolution operations to update the node representation. The node representations are then aggregated through graph pooling operations to generate an embedding vector for the entire service call topology graph.

[0062] (4) Recurrent neural networks are used to extract time series features of each service. Time series data includes: request data, response time data, error rate data, resource usage data, and call relationship data. Recurrent neural networks (such as LSTM and GRU) are used to extract features from these time series data. These neural network structures are suitable for processing data with temporal relationships and can capture dependencies over long time spans. They can also analyze service performance, identify potential anomalies, and support subsequent anomaly detection models. Recurrent neural networks (such as LSTM and GRU) are used for feature extraction.

[0063] (5) Based on the features extracted by the graph convolutional network and the recurrent neural network, a deep learning anomaly detection model is designed. Specifically, the service call topology graph feature vector extracted by the graph convolutional network is v_graph, and the service time series feature vectors extracted by the recurrent neural network are v_s1_rnn, v_s2_rnn, ..., v_sm_rnn.

[0064] Feature fusion: concatenate graph features and time series features to form a long vector:

[0065] v_concat=Concat(v_graph,v_s1_rnn,v_s2_rnn,...,v_sm_rnn)

[0066] Among them, Concat is a tensor concatenation operation.

[0067] Feature transformation: Use the fully connected layer (Dense) to perform nonlinear transformation on the concatenated feature vectors to extract high-order interaction features:

[0068] h_fuse=ReLU(Dense(v_concat))

[0069] Dense is a fully connected layer, and ReLU is an activation function that increases the model's nonlinear expression capabilities. To further improve the quality of feature representation, multiple fully connected layers can be stacked.

[0070] h_fuse=ReLU(Dense(ReLU(Dense(v_concat))))

[0071] Anomaly score calculation: Finally, a Sigmoid activation function is connected to map the feature representation to between 0 and 1 to obtain the anomaly probability score:

[0072] y = Sigmoid(Dense(h_fuse))

[0073] Among them, the Sigmoid function compresses real numbers into the range of 0-1, and the closer to 1, the greater the possibility of abnormality.

[0074] In summary, by combining local feature extraction and the end-to-end anomaly detection model, the complete forward computation process can be expressed as:

[0075] v_graph = GCN(A,X)

[0076] v_s1_rnn=RNN(x_s1_t1,x_s1_t2,...,x_s1_tn)

[0077] v_s2_rnn=RNN(x_s2_t1,x_s2_t2,...,x_s2_tn) ...

[0079] v_sm_rnn=RNN(x_sm_t1,x_sm_t2,...,x_sm_tn)

[0080] v_concat=Concat(v_graph,v_s1_rnn,v_s2_rnn,...,v_sm_rnn)

[0081] h_fuse=ReLU(Dense(ReLU(Dense(v_concat))))

[0082] y=Sigmoid(Dense(h_fuse)).

[0083] It should be noted that an attention mechanism is designed at the high level of the deep anomaly detection model to adaptively learn the importance weights of different telemetry indicators for anomaly determination. A gating mechanism is also introduced to enhance the model's memory and noise immunity. The specific implementation process includes:

[0084] (1) An attention mechanism is introduced at the high level of the anomaly detection model to adaptively learn the importance weights of different telemetry indicators.

[0085] (2) A gating mechanism is introduced at the high level of the anomaly detection model to enhance the model's memory and noise resistance. The forgetting gate coefficient f is calculated through the sigmoid activation function to control the degree of retention of the memory state of the previous moment.

[0086] (3) Integrate the attention mechanism and gating mechanism into the end-to-end anomaly detection model, and use service grid telemetry data for model training and optimization.

[0087] (4) Analyze the decision-making process and key influencing factors of the anomaly detection model.

[0088] In addition, the method of this application also includes using the historical service grid monitoring data accumulated by automobile manufacturers to pre-train the anomaly detection model, and then using the real-time data of the fleet for continuous online learning to continuously improve the model performance and generalization ability.

[0089] The specific implementation process includes:

[0090] (1) Historical data collection and processing: Historical telemetry data within a certain timeframe (e.g., the past year) is collected from the automaker’s service mesh monitoring system. This data includes service call topology, performance metrics, resource utilization, etc. After preprocessing operations such as cleaning, conversion, and normalization, feature extraction and selection are performed on the historical data to construct the input feature vector for the anomaly detection model. Features include the number of service calls, average latency, error rate, etc.

[0091] (2) Anomaly Detection Model Pretraining: Based on the characteristics of the automotive software service grid, the structure and parameters of the anomaly detection model are initialized. The anomaly detection model is trained using the training set data and the model parameters are optimized. The performance of the pretrained model is then evaluated on the validation set or test set. Metrics such as precision, recall, and F1 score are calculated to comprehensively measure the model's performance on the anomaly detection task. The advantages and disadvantages of the model and directions for improvement are analyzed.

[0092] (3) Online learning of real-time fleet data: Through on-board terminal equipment and fleet management platforms: real-time collection of telemetry data of the vehicle service grid, including vehicle status data (reflecting the working status of each subsystem and component of the vehicle, such as the real-time operating parameters of the power system, braking system, steering system, battery management system, etc.), service call data (reflecting the call relationship and interaction between vehicle software services), environmental parameter data (the external environment conditions of the vehicle, such as temperature, light intensity, road conditions, etc.), and vehicle driving data (the driving status of the vehicle, such as speed, acceleration, steering angle, positioning information, etc.).

[0093] (4) Real-time detection: The real-time feature vector is input into the pre-trained anomaly detection model, the anomaly score is calculated, and the anomaly is judged in real time based on the set threshold to generate an anomaly alert.

[0094] (5) Model incremental learning and updating: New samples (such as new service call patterns, abnormal events, etc.) in the fleet's real-time data are cached in memory or a database as the data source for incremental learning. After incremental learning, the performance of the updated anomaly detection model is evaluated using a new validation set. If the performance improvement is significant, the updated model parameters are persisted and the original pre-trained model is replaced.

[0095] The pre-trained anomaly detection model is F_pre, and its parameter is θ_pre. The input of the model is the telemetry data x of the automotive software service grid, and the output is the anomaly determination result y.

[0096] y = F_pre(x;θ_pre)

[0097] Among them, x can be expressed as a multi-dimensional feature vector of different time steps t and different services s, such as:

[0098] x={x_s1_t1,x_s1_t2,...,x_s1_tn,x_s2_t1,x_s2_t2,...,x_s2_tn,...,x_sm_t1,x_sm_t2,...,x_sm_tn}

[0099] Based on the above, the pre-trained anomaly detection model F_pre is mainly composed of a graph convolutional network (GCN), a recurrent neural network (RNN), and a fully connected layer (Dense). The goal of the pre-training phase is to learn a set of initial parameters θ_pre with good generalization performance, laying the foundation for subsequent incremental learning.

[0100] In the incremental learning phase, new telemetry data x_new and corresponding anomaly labels y_new are obtained. At this point, fine-tuning can be used to continue training based on the pre-trained model and update the model parameters to adapt to the new data distribution. The updated model F_inc can be expressed as:

[0101] y_new = F_inc(x_new;θ_inc)

[0102] Among them, θ_inc is the new parameter obtained by incremental update based on θ_pre. The goal of incremental training is to minimize the loss function L on the new data, the cross entropy loss:

[0103] L(θ_inc)=-Σ[y_new·log(F_inc(x_new;θ_inc))+(1-y_new)·log(1-F_inc(x_new;

[0104] θ_inc))]

[0105] Use the gradient descent method to optimize the loss function and update the model parameters:

[0106]

[0107] The above describes in detail the optional implementation methods of the embodiments of the present invention in conjunction with the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details in the above implementation methods. Within the technical concept of the embodiments of the present invention, various simple modifications can be made to the technical solutions of the embodiments of the present invention, and these simple modifications all fall within the scope of protection of the embodiments of the present invention.

Claims

1. A deep learning detection method for automotive software anomalies based on a service grid architecture, characterized by: The steps include: Step 1: Build a lightweight automotive service grid covering the automotive electronic and electrical architecture, forming a centrally managed data and control plane. Step 2: Deploy an automotive software anomaly detection module in the automotive service mesh control plane to subscribe to and analyze service runtime telemetry data in real time for real-time anomaly detection. The automotive software anomaly detection module includes an end-to-end deep learning anomaly detection model and uses the anomaly detection model to perform real-time anomaly detection. The construction process of the anomaly detection model is as follows: (1) Cleaning, conversion, and normalization preprocessing operations on telemetry data collected by the automotive service grid; (2) Based on the preprocessed data, a directed graph model of the call relationships between services is constructed. Each service is first abstracted as a node in the graph, and then directed edges are generated based on the call relationships between services. As the call relationships in the service grid change dynamically, the nodes and edges of the graph are updated in real time. (3) Use graph convolutional networks to extract features from the service call topology graph. First, learn the low-dimensional embedding representation of each service node through random walk or node attribute aggregation methods. Based on the node embedding, aggregate the feature information of neighboring nodes through graph convolution operations, update the node representation, and aggregate the node representations through graph pooling operations to generate the embedding vector of the entire service call topology graph. (4) Recurrent neural network is used to extract the time series features of each service, and the recurrent neural network is used to extract features from these time series data; (5) Based on the features extracted by the graph convolutional network and the recurrent neural network, a deep learning anomaly detection model is designed. Specifically, the service call topology graph feature vector extracted by the graph convolutional network is v_graph, and the service time series feature vectors extracted by the recurrent neural network are v_s1_rnn, v_s2_rnn, ..., v_sm_rnn respectively. Feature fusion: concatenate graph features and time series features to form a long vector: v_concat=Concat(v_graph,v_s1_rnn,v_s2_rnn,...,v_sm_rnn) Among them, Concat is a tensor concatenation operation; Feature transformation: Use the fully connected layer to perform nonlinear transformation on the concatenated feature vectors to extract high-order interaction features: h_fuse=ReLU(Dense(v_concat)) Among them, Dense is a fully connected layer, and ReLU is an activation function, which can increase the nonlinear expression ability of the model; stacking multiple fully connected layers: h_fuse=ReLU(Dense(ReLU(Dense(v_concat)))) Anomaly score calculation: Finally, a Sigmoid activation function is connected to map the feature representation to between 0 and 1 to obtain the anomaly probability score: y = Sigmoid(Dense(h_fuse)) Among them, the Sigmoid function compresses real numbers into the range of 0-1, and the closer to 1, the greater the possibility of abnormality.

2. The deep learning detection method for automobile software anomalies based on service grid architecture according to claim 1 is characterized in that: The service runtime telemetry data includes: service call topology data, service input and output data, and resource usage data.

Images