Software control flow anomaly detection method and device, electronic device and storage medium

Abstract

The invention relates to a software control flow anomaly detection method and device, an electronic device and a storage medium, and the method comprises the steps: reading an original control flow segment generated in a vehicle software execution process, carrying out the nested dictionary conversion of the original control flow segment, and obtaining a control flow segment dictionary; splicing the control flow fragment dictionaries into a complete control flow dictionary; recursively performing key path extraction on the complete control flow dictionary to generate a two-dimensional control flow list; and comparing the two-dimensional control flow list with a pre-constructed abnormal control flow list, and determining abnormal control flow information in the two-dimensional control flow list. According to the method, the abnormal control flow information generated in the software execution process is timely and accurately identified by combining the pre-established abnormal control flow list based on a data management mode of a nested dictionary, so that the stable operation of the AUTOSAR multi-core software can be conveniently maintained.

Description

Technical Field

[0001] The present application relates to the field of vehicle control, and in particular to a method, device, electronic device and storage medium for detecting anomalies in software control flows. Background Art

[0002] Automotive Open System Architecture (AUTOSAR) aims to develop and establish a standardized software framework and open E / E (electronic / electrical) system architecture for intelligent mobility. Currently, AUTOSAR multi-core software has been widely used in the field of new energy vehicles.

[0003] During the operation of AUTOSAR multi-core software, there are often various problems that affect the operation of the software, such as crashes, serious failures, degraded operation, and other non-crash problems. The occurrence of the above problems will affect the stable operation of AUTOSAR multi-core software.

[0004] There is no effective solution to the problem of unstable operation of AUTOSAR multi-core software in related technologies. Summary of the invention

[0005] In this embodiment, a method, device, electronic device and storage medium for detecting anomalies in software control flow are provided to solve the problem of unstable operation of AUTOSAR multi-core software in the related art.

[0006] In a first aspect, a method for detecting anomalies in a software control flow is provided in this embodiment, comprising:

[0007] Reading original control flow fragments generated during the vehicle software execution process, performing nested dictionary conversion on the original control flow fragments to obtain a control flow fragment dictionary;

[0008] splicing the control flow fragment dictionaries into a complete control flow dictionary;

[0009] Recursively extracting key paths from the complete control flow dictionary to generate a two-dimensional control flow list;

[0010] The two-dimensional control flow list is compared with a pre-built abnormal control flow list to determine abnormal control flow information in the two-dimensional control flow list.

[0011] In some embodiments, the original control flow fragment is subjected to nested dictionary conversion to obtain a control flow fragment dictionary, including:

[0012] Parsing the tree structure of the original control flow fragment, and traversing the parent node elements under the root node in the tree structure based on the parsing result;

[0013] Recursively, each parent node element and the corresponding child node element are converted into nested dictionaries and stored as a control flow fragment dictionary.

[0014] In some of the embodiments, each parent node element and the corresponding child node element are converted into a nested dictionary in a recursive manner and stored as a control flow fragment dictionary, including:

[0015] The information of the current parent node element is stored in the parent node dictionary, and the information of the child node element at the next level of the current parent node element is stored in the current node dictionary; the current node dictionary is the value of the parent node dictionary;

[0016] The current node dictionary is used as the parent node dictionary for the next recursion, and the child node elements of the next level of the child node element are recursively processed until all elements of each level under the current parent node element are traversed to obtain a control flow fragment dictionary in the form of a nested dictionary.

[0017] In some embodiments, the outermost key name of the control flow fragment is a scheduling entry name; the scheduling entry name includes at least a task and an interrupt; and each of the control flow fragment dictionaries is spliced ​​into a complete control flow dictionary, including:

[0018] Identify the control flow fragment dictionary with the outermost key name of task or interrupt as the target control flow fragment dictionary;

[0019] Using the key of the target control flow fragment dictionary as the key of the newly generated temporary control flow dictionary, and nesting the values ​​of the temporary control flow dictionary based on the hierarchical structure of the values ​​of the target control flow fragment dictionary;

[0020] The outermost key name of the target control flow fragment dictionary is used as the key, and the generated temporary control flow dictionary is used as the value to obtain a complete control flow dictionary.

[0021] In some of the embodiments, comparing the two-dimensional control flow list with a pre-built abnormal control flow list to determine abnormal control flow information in the two-dimensional control flow list includes:

[0022] The two-dimensional control flow list is compared with a pre-built abnormal control flow list in terms of function call relationships to determine abnormal control flow information in the two-dimensional control flow list.

[0023] In some embodiments, the method further comprises:

[0024] The abnormal control flow information is converted into a message text, and the message text is output through an associated communication platform.

[0025] In some embodiments, the method further comprises:

[0026] Intercept the identified abnormal control flow information.

[0027] In a second aspect, in this embodiment, a software control flow anomaly detection device is provided, comprising: a conversion module, a splicing module, an extraction module and a recognition module; wherein:

[0028] The conversion module is used to read the original control flow fragment generated during the vehicle software execution process, and perform nested dictionary conversion on the original control flow fragment to obtain a control flow fragment dictionary;

[0029] The splicing module is used to splice the control flow fragment dictionaries into a complete control flow dictionary;

[0030] The extraction module is used to recursively extract key paths from the complete control flow dictionary to generate a two-dimensional control flow list;

[0031] The identification module is used to compare the two-dimensional control flow list with a pre-built abnormal control flow list to determine the abnormal control flow information in the two-dimensional control flow list.

[0032] In a third aspect, an electronic device is provided in this embodiment, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the software control flow anomaly detection method described in the first aspect when executing the computer program.

[0033] In a fourth aspect, a storage medium is provided in this embodiment, on which a computer program is stored, and when the program is executed by a processor, the method for detecting anomalies in software control flow described in the first aspect above is implemented.

[0034] Compared with the related art, the present embodiment provides a method, device, electronic device and storage medium for detecting abnormalities in software control flow. Among them, the method for detecting abnormalities in software control flow first reads the original control flow fragments generated by the vehicle software execution process, and then performs nested dictionary conversion on the original control flow fragments to obtain a control flow fragment dictionary; then, each control flow fragment dictionary is spliced ​​into a complete control flow dictionary; next, the key path is extracted recursively on the complete control flow dictionary to generate a two-dimensional control flow list; finally, the two-dimensional control flow list is compared with the pre-built abnormal control flow list to determine the abnormal control flow information in the two-dimensional control flow list. Its data management method based on the nested dictionary, combined with the pre-established abnormal control flow list, realizes the timely and accurate identification of the abnormal control flow information generated during the software execution process, so as to facilitate the maintenance of the stable operation of the AUTOSAR multi-core software.

[0035] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0037] Figure 1 is a hardware structure block diagram of a terminal of the software control flow anomaly detection method of this embodiment;

[0038] Figure 2 is a flowchart of the software control flow anomaly detection method of this embodiment;

[0039] Figure 3 is a schematic diagram of the contents of an original data file of this embodiment;

[0040] Figure 4 is a flowchart of a method for detecting anomalies in software control flow in some embodiments;

[0041] Figure 5 is a flowchart of a nested dictionary conversion method of some of the embodiments;

[0042] Figure 6 is a flowchart of a nested dictionary concatenation method of some of the embodiments;

[0043] Figure 7 is a flowchart of a method for identifying abnormal control flow in some of the embodiments;

[0044] Figure 8 is a flowchart of a method for outputting control flow information in some embodiments;

[0045] Fig. 9 is a flowchart of a method for outputting abnormal control flow information in some embodiments;

[0046] Fig.10 It is a structural block diagram of the software control flow anomaly detection device of this embodiment. DETAILED DESCRIPTION

[0047] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0048] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the", "these" and the like in this application do not represent quantitative restrictions, and they can be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether directly or indirectly. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, "A and / or B" can mean: A exists alone, A and B exist at the same time, and B exists alone. Usually, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0049] The method embodiment provided in this embodiment can be executed in a terminal, a computer or a similar computing device. For example, running on a terminal, Figure 1 : is a hardware structure block diagram of a terminal of the software control flow abnormality detection method of this embodiment. Figure 1 As shown, the terminal may include one or more ( Figure 1Only one is shown in the figure) processor 102 and memory 104 for storing data, wherein processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA. The above terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is for illustration only and does not limit the structure of the above terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0050] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the abnormal detection method of the software control flow in the present embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0051] The transmission device 106 is used to receive or send data via a network. The above network includes a wireless network provided by the communication provider of the terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0052] In this embodiment, a method for detecting anomalies in software control flow is provided. Figure 2 is a flowchart of the software control flow anomaly detection method of this embodiment, such as Figure 2 As shown, the process includes the following steps:

[0053] Step S210 , reading the original control flow fragment generated during the vehicle software execution process, performing nested dictionary conversion on the original control flow fragment, and obtaining a control flow fragment dictionary.

[0054] The vehicle software may be specifically AUTOSAR multi-core software. The control flow generated by the execution of AUTOSAR multi-core software may be the execution order and dependency relationship between software components, tasks and events in the automotive electronic control unit (ECU) under the AUTOSAR architecture. The above-mentioned original control flow fragment may include the calling relationship between functions written by the software program.

[0055] Specifically, the original control flow fragment can be read from the original data file generated in the compilation environment during the execution of the vehicle software. The original data file can be an XML file that represents the calling relationship between different functions in a tree structure. By reading the file and parsing the content therein, the original control flow fragment is converted into a nested dictionary according to the parsed calling relationship between different functions to obtain the corresponding control flow fragment dictionary. Figure 3 is a schematic diagram of the contents of an original data file of this embodiment, such as Figure 3 As shown, you can define the label " <tree>"and" <child>", based on these two tags to achieve the above tree structure, where the tag " <name>" indicates the corresponding node name. For example Figure 3 In the example, "AFunction" is the parent element and "BFunction" is the child element of "AFunction".

[0056] The above nested dictionary is a data structure of a computer programming language. The nested dictionary allows the dictionary value itself to be a dictionary. This structure is suitable for representing data with a hierarchical or classification relationship. In a nested dictionary, deeper data can be accessed through a sequence of one or more keys. In this step, a corresponding control flow fragment dictionary with a nested relationship is generated according to the calling relationship between different functions in the original control flow fragment.

[0057] Step S220: concatenate the control flow fragment dictionaries into a complete control flow dictionary.

[0058] Specifically, each control flow fragment dictionary can be traversed and a pre-written recursive function can be used to recursively access the value of a key of each control flow fragment dictionary until the corresponding value is empty, and the dictionary contents with the same key can be nested to generate a complete control flow dictionary. The specific recursive function can be set according to the recursive idea set according to the needs of the actual application scenario, and this embodiment does not specifically limit this.

[0059] Step S230, recursively extract the key path of the complete control flow dictionary to generate a two-dimensional control flow list.

[0060] Specifically, all key paths can be recursively extracted from the complete control flow dictionary to generate a two-dimensional control flow list consisting of multiple control flows, where each control flow itself is a one-dimensional list. For example, the list can be in the form of "[control flow 1, control flow 2, ... control flow N]", and one control flow can be in the form of "[function 1, function 2]". The two-dimensional control flow list contains all control flow information of the complete control flow dictionary, specifically including the execution order and calling relationship of different functions during the task execution process.

[0061] Step S240: compare the two-dimensional control flow list with the pre-built abnormal control flow list to determine abnormal control flow information in the two-dimensional control flow list.

[0062] A two-layer nested dictionary list can be pre-established, with the first-layer key being the corresponding software function, the second-layer key being the problem description of the abnormal execution of the function, and the second-layer value being the pre-collected abnormal control flow list. The control flow information in the abnormal control flow list may include control flows corresponding to abnormal states such as a freeze, a failure, and a degraded operation. Afterwards, the content of the abnormal control flow list is compared with the content of the two-dimensional control flow list, and the control flow corresponding to the above abnormal state is screened out, thereby identifying the abnormal control flow information in the two-dimensional control flow list.

[0063] Next, all the identified abnormal control flow information can be organized into a new nested dictionary list, specifically, the function can be used as the key of the first layer, the problem description can be used as the key of the second layer, and the identified abnormal control flow information can be used as the value of the second layer. Finally, the new nested dictionary list can be output to facilitate the subsequent processing process to analyze and process the new nested dictionary list and intercept the control flow.

[0064] In the related art, the system performance and responsiveness are improved, the development complexity and cost are reduced, and the system security and reliability are improved by running AUTOSAR multi-core software. Due to the lack of monitoring and abnormal identification of control flow information, it is impossible to detect abnormal software operation problems in time, which affects the normal operation of the software. Based on this, this embodiment uses a nested dictionary to convert the original control flow information according to the characteristics of the control flow, and then performs data management and abnormal analysis, so that the abnormal control flow can be identified at a faster data processing speed; on the other hand, based on the pre-established database of abnormal control flows, it is convenient to accurately retrieve the abnormal control flows existing in the software during the abnormal identification process. Based on this, this embodiment can realize accurate and rapid identification of abnormal control flows, so as to detect abnormal states that affect the normal operation of the software in time and maintain the stable operation of the software.

[0065] In the above steps S210 to S240, the original control flow fragments generated during the execution of the vehicle software are read, and the original control flow fragments are converted into nested dictionaries to obtain a control flow fragment dictionary; each control flow fragment dictionary is spliced ​​into a complete control flow dictionary; the key path of the complete control flow dictionary is recursively extracted to generate a two-dimensional control flow list; the two-dimensional control flow list is compared with the pre-built abnormal control flow list to determine the abnormal control flow information in the two-dimensional control flow list. Its data management method based on the nested dictionary, combined with the pre-built abnormal control flow list, realizes the timely and accurate identification of the abnormal control flow information generated during the software execution process, so as to facilitate the maintenance of the stable operation of the AUTOSAR multi-core software.

[0066] In one embodiment, based on the above step S210, the original control flow fragment is converted into a nested dictionary to obtain a control flow fragment dictionary, which may specifically include:

[0067] The tree structure of the original control flow fragment is parsed, and the parent node elements under the root node in the tree structure are traversed based on the parsing result; each parent node element and the corresponding child node element are converted into a nested dictionary in a recursive manner and stored as a control flow fragment dictionary.

[0068] Specifically, first obtain the original data file containing the original control flow fragment content from the compilation environment, use the ElementTree library to parse the original data file, obtain the tree structure therein, and obtain the root node of the tree structure. The ElementTree library is a standard library in Python for parsing and creating XML data. It provides a lightweight object model that allows developers to process XML data programmatically. Parse the tree structure and traverse all parent node elements under the root node, such as Figure 3 The label is " <tree>". Call the pre-written recursive function of tree structure to nested dictionary conversion to convert each parent node element and its corresponding child node element (such as Figure 3 The label in is " <child>" node element) is converted into a nested dictionary and stored in the control flow fragment dictionary. The recursive function of converting the tree structure to the nested dictionary can be implemented by setting the main recursive logic according to the needs of the actual application scenario, and this embodiment does not make any specific limitation on this.

[0069] By storing the control flow fragment information in the form of a nested dictionary, the data access speed and efficiency can be improved, thereby facilitating the improvement of the efficiency of subsequent data analysis.

[0070] Optionally, in one embodiment, each parent node element and the corresponding child node element are converted into a nested dictionary in a recursive manner and stored as a control flow fragment dictionary, which may include:

[0071] The information of the current parent node element is stored in the parent node dictionary, and the information of the child node element at the next level of the current parent node element is stored in the current node dictionary; the current node dictionary is the value of the parent node dictionary; the current node dictionary is used as the parent node dictionary for the next recursion, and the child node elements at the next level of the child node element are recursively processed until all elements at each level under the current parent node element are traversed, and a control flow fragment dictionary in the form of a nested dictionary is obtained.

[0072] That is, the general idea of ​​the recursive function for converting the tree structure into a nested dictionary can include: obtaining the name text of each node element in the tree structure, storing the name text of the current node element in the parent node dictionary, recursively processing all child node elements of the current node element, and storing the information of the child node elements in the current node dictionary, and using the current node dictionary as the parent node dictionary input for the next recursion. In the nested dictionary, the current node dictionary is the value of its parent node dictionary. By recursively processing a parent node element in the tree structure, the parent node element and the node elements of each level under the parent node element can be converted into a corresponding nested dictionary, and the hierarchical relationship in the tree structure is still retained in the nested dictionary. Based on this, the control flow fragment dictionary corresponding to each control flow fragment can be obtained.

[0073] In addition, in one embodiment, the outermost key name of the control flow fragment is a scheduling entry name; the scheduling entry name includes at least a task and an interrupt; and the control flow fragment dictionaries are spliced ​​into a complete control flow dictionary, which may include:

[0074] The control flow fragment dictionary whose outermost key name is task or interrupt is identified as the target control flow fragment dictionary; the key of the target control flow fragment dictionary is used as the key of the newly generated temporary control flow dictionary, and based on the hierarchical structure of the value of the target control flow fragment dictionary, the value of the temporary control flow dictionary is nested; the outermost key name of the target control flow fragment dictionary is used as the key, and the generated temporary control flow dictionary is used as the value to obtain a complete control flow dictionary.

[0075] In this embodiment, the control flow segment data dictionary is integrated into a complete control data dictionary using tasks or interrupts as entry points. Specifically, the control flow segment data dictionary with the scheduling entry name of task or interrupt is selected as the target control flow segment dictionary to be spliced.

[0076] Traverse the sub-dictionary in the target control flow fragment dictionary whose key name is task or interrupt. This can be mainly processed by calling a pre-written recursive function for splicing processing. First, traverse each target control flow fragment dictionary to obtain the key-value pair, and use the outermost key as the key of the newly created temporary control flow dictionary. If the value of the corresponding key-value pair is not empty, it means that the current sub-dictionary corresponding to the currently queried value still contains control flow information, then recursively call the above recursive function for splicing processing, traverse the sub-dictionary, and continue to nest on the temporary control flow dictionary. If the value of the corresponding key-value pair is empty, it means that the current sub-dictionary no longer contains control flow information, so it is necessary to confirm whether there is a value corresponding to the key in other sub-dictionaries. If there is a value corresponding to the key in other sub-dictionaries, and the key name does not appear in the straight line parent dictionary of the current sub-dictionary, then recursively call the above recursive function for splicing processing, traverse other sub-dictionaries, and continue to nest on the temporary control flow dictionary. If the value is empty and the key name has appeared in the straight line parent dictionary, it means that the value corresponding to the key name has been nested in the temporary control flow dictionary, and exit the nesting process. That is, the control flow information is integrated according to the hierarchical structure of the values ​​of the control flow fragment dictionaries with the same key name, and finally integrated into a complete control flow dictionary.

[0077] Finally, the outermost key name (task or interrupt) of the target control flow fragment dictionary is used as the key, and the temporary control flow dictionary generated by the splicing process is used as the value to obtain a complete control flow dictionary.

[0078] In this embodiment, by splicing the control flow fragment dictionary into a complete control flow dictionary, complete control flow information can be provided for subsequent abnormal control flow identification, thereby improving the accuracy of the analysis result.

[0079] Additionally, in one embodiment, based on the above step S240, comparing the two-dimensional control flow list with the pre-built abnormal control flow list to determine the abnormal control flow information in the two-dimensional control flow list may specifically include:

[0080] The two-dimensional control flow list is compared with the pre-built abnormal control flow list in terms of function call relationship to determine the abnormal control flow information in the two-dimensional control flow list.

[0081] Exemplarily, the pre-built abnormal control flow list may have the following form:

[0082] ControlFlowCheckDict['MPU']['QM process executes the reset function, which will trigger MPU protection, such as 1002, 1101 or software reset request generated by power off']=

[0083] ['Mcu_PerformReset','Mcal_WritePeripEndInitProtReg','Mcal_lUpdatePeriphera lEndInit'];

[0084] The part on the left of the equal sign indicates the abnormal control flow list named "ControlFlowCheckDict", the function is "MPU", and the problem description is "QM process executes the reset function, which triggers MPU protection, such as 1002, 1101 or software reset request generated by power-off". The corresponding specific control flow information is the part on the right of the equal sign.

[0085] During the comparison process, if the abnormal control flow information in the pre-constructed abnormal control flow list is: function b calls function c, and function c calls function d. If it is detected that there is control flow information in the two-dimensional control flow list: function a calls function b, function b calls function c, function c calls function d, and function d calls function e. That is, there is a piece of control flow information, a part of which is consistent with the function call relationship in the abnormal control flow list, then the control flow information in the two-dimensional control flow list is filtered out as the abnormal control flow information. In this embodiment, identifying abnormal control flow information according to the function call relationship can improve the accuracy of the identification result.

[0086] In addition, in one embodiment, the above software control flow anomaly detection method may further include:

[0087] The abnormal control flow information is converted into a message text, and the message text is output through an associated communication platform. The communication platform may include other message platforms obtained by email. Specifically, feedback can be provided through email or other message platforms. For example, the complete control flow dictionary is printed to a spreadsheet excel, and a spreadsheet file is output. Afterwards, the open source automation tool Jenkins is used to send the spreadsheet file via email. And, with the help of enterprise communication tools, the detected abnormal control flow information is converted into message text. The application programming interface (Application Programming Interface, referred to as API) of the message push of the associated enterprise communication tool is called to send the message text to a designated group or individual. For example, in an enterprise WeChat work group, the abnormal control flow information is converted into enterprise WeChat text, and then the enterprise WeChat robot API interface is called to send the text information to the designated enterprise WeChat group.

[0088] Additionally, in one embodiment, the above software control flow anomaly detection method may further include:

[0089] Intercept the identified abnormal control flow information. In AUTOSAR multi-core software, the control flow identified as abnormal control flow is intercepted, for example, the abnormal control flow can be intercepted by the task scheduler. Based on this, the present embodiment can make an interception response in time for the retrieved abnormal control flow, thereby maintaining the normal operation of the software.

[0090] Figure 4 is a flowchart of a method for detecting anomalies in software control flow in some of the embodiments, such as Figure 4 As shown, the software control flow anomaly detection method includes the following steps:

[0091] Step S401 : when it is detected that there is an update in the software engineering of the AUTOSAR multi-core software, an original control flow segment is extracted from an original data file.

[0092] Step S402, performing nested dictionary conversion on the original control flow fragment to obtain a control flow fragment dictionary; wherein, the tree structure of the original control flow fragment is parsed, and the parent node elements under the root node in the tree structure are traversed based on the parsing result; each parent node element and the corresponding child node element are converted into a nested dictionary in a recursive manner, and stored as the control flow fragment dictionary.

[0093] Step S403, concatenate the control flow fragment dictionaries into a complete control flow dictionary; wherein, the control flow fragment dictionary whose outermost key name is task or interrupt is identified as the target control flow fragment dictionary; the key of the target control flow fragment dictionary is used as the key of the newly generated temporary control flow dictionary, and based on the hierarchical structure of the value of the target control flow fragment dictionary, the value of the temporary control flow dictionary is nested; the outermost key name of the target control flow fragment dictionary is used as the key, and the generated temporary control flow dictionary is used as the value to obtain a complete control flow dictionary.

[0094] Step S404, extracting abnormal control flow information from a complete control flow dictionary according to a pre-constructed abnormal control flow list; wherein, recursively extracting key paths from the complete control flow dictionary to generate a two-dimensional control flow list; comparing the two-dimensional control flow list with the pre-constructed abnormal control flow list to determine the abnormal control flow information in the two-dimensional control flow list.

[0095] Step S405, outputting the abnormal control flow information through the associated communication platform; wherein, the abnormal control flow information can be output to the corresponding processing group or individual through the enterprise communication tool, or the complete control flow dictionary can be output to the corresponding staff in the form of email.

[0096] The above steps S401 to S405, based on the data management method of the nested dictionary and combined with the pre-established abnormal control flow list, realize timely and accurate identification of abnormal control flow information generated during software execution, thereby facilitating the maintenance of stable operation of AUTOSAR multi-core software.

[0097] Figure 5 A flowchart of a nested dictionary conversion method in some of the embodiments is shown in FIG. Figure 5 As shown, the nested dictionary conversion method includes:

[0098] Step S501, read the original data file from the compilation environment; wherein the original data file can be as follows Figure 3 As shown, an XML-formatted file that represents the calling relationship between different functions in a tree structure.

[0099] Step S502: parse using the ElementTree library to obtain the root node of the tree structure of the original control flow fragment.

[0100] Step S503, traverse all parent node elements under the root node; for example, combining Figure 3 , you can traverse all node elements under the root node whose node name is "tree".

[0101] Step S504, obtaining the name text of the current parent node element.

[0102] Step S505: store the information of the current parent node element in the parent node dictionary.

[0103] Step S506, recursively process all child nodes under the current parent node, and store the information of the child nodes in the current node dictionary.

[0104] The above steps S501 to S506 realize the conversion of control flow fragments into nested dictionaries, so that data management of control flow information can be implemented in the form of nested dictionaries, thereby improving the efficiency of data access and analysis.

[0105] Figure 6 Flowchart of the nested dictionary concatenation method in some of the embodiments, such as Figure 6 As shown, the nested dictionary concatenation method includes:

[0106] Step S601, from each control flow fragment dictionary, select the control flow fragment dictionary with the outermost key name "task" or "interrupt" as the target control flow fragment dictionary; wherein the control flow fragment dictionary is converted from the original control flow fragment, and the outermost key name of the control flow fragment dictionary is the scheduling entry name.

[0107] Step S602, traverse the current target control flow fragment dictionary, obtain the key-value pair, and use the key as the key of the newly generated temporary control flow dictionary.

[0108] Step S603, determine whether the value corresponding to the key is empty; if so, execute step S604; otherwise, execute step S605.

[0109] Step S604, determine whether the key name appears in the parent dictionary of the line; if not, execute step S606; if so, execute step S607.

[0110] Step S605 , traverse the sub-dictionaries of the current target control flow fragment dictionary, and recursively access the sub-dictionaries under each sub-dictionary, and nest them on the temporary control flow dictionary according to the hierarchical structure of dictionaries at different levels.

[0111] Step S606, if the key exists in other target control flow fragment dictionaries, then access other target control flow dictionaries where the key exists, recursively access the sub-dictionaries therein, and continue nesting processing on the temporary control flow dictionary.

[0112] Step S607, exit the nesting, use the outermost key name "task" or "interrupt" of the target control flow dictionary as the key, and use the temporary control flow dictionary as the value to generate a complete control flow dictionary.

[0113] The above steps S601 to S607 realize the splicing of the complete control flow dictionary from the control flow fragment dictionary value, so that based on different control flow fragments, a complete control flow dictionary can be finally obtained, which can provide complete and comprehensive data for subsequent abnormal control flow identification.

[0114] Figure 7 is a flowchart of a method for identifying abnormal control flow in some embodiments, such as Figure 7 As shown, the abnormal control flow identification method includes:

[0115] Step S701, pre-build a 2-layer abnormal control flow list; wherein the first layer key is the function, the second layer key is the problem description, and the second layer value is the specific abnormal control flow list.

[0116] Step S702, obtaining the above abnormal control flow list.

[0117] Step S703, recursively extract all possible key paths from the complete control flow dictionary to generate a two-dimensional control flow list; the two-dimensional control flow list contains all the read control flow information.

[0118] Step S704, according to the abnormal control flow list, filter out the control flow paths that meet the conditions from the two-dimensional control flow list and identify them as abnormal control flow information; wherein, if the two-dimensional control flow list contains a function call relationship that is consistent with the abnormal control flow list, it is confirmed that the conditions are met and the corresponding control flow information is identified as abnormal control flow information.

[0119] Step S705: Organize the identified abnormal control flow information into a new dictionary list and output it, wherein the first-level key name of the new dictionary list is function, the second-level key is problem description, and the second-level value is the above-identified abnormal control flow information.

[0120] Figure 8 is a flowchart of a method for outputting control flow information in some embodiments, such as Figure 8 As shown, the control flow information output method includes:

[0121] Step S801, printing the contents of the complete control flow dictionary as a spreadsheet file.

[0122] Step S802: Send the electronic spreadsheet file via email through Jenkins.

[0123] Fig. 9 Flowchart of the method for outputting abnormal control flow information in some embodiments, such as Fig. 9 As shown, the abnormal control flow information output method includes:

[0124] Step S901, establish a message sending robot based on the enterprise communication tool; for example, an enterprise WeChat robot can be established in an enterprise WeChat work group; the robot can specifically be an intelligent tool based on artificial intelligence technology, which can realize automatic reply, question answering, task scheduling, data analysis and other functions through natural language processing and machine learning algorithms.

[0125] Step S902: convert the abnormal control flow information into a message text.

[0126] Step S903, based on the robot, call the message sending interface to send the text message to the designated group or individual.

[0127] In this embodiment, a software control flow anomaly detection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. The terms "module", "unit", "subunit", etc. used below can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0128] Fig.10 is a structural block diagram of the software control flow anomaly detection device 10 of this embodiment, as shown in Fig.10 As shown, the software control flow anomaly detection device 10 includes: a conversion module 12, a splicing module 14, an extraction module 16 and a recognition module 18; wherein:

[0129] The conversion module 12 is used to read the original control flow fragments generated by the vehicle software execution process, and perform nested dictionary conversion on the original control flow fragments to obtain a control flow fragment dictionary; the splicing module 14 is used to splice the various control flow fragment dictionaries into a complete control flow dictionary; the extraction module 16 is used to recursively extract the key path of the complete control flow dictionary to generate a two-dimensional control flow list; the identification module 18 is used to compare the two-dimensional control flow list with the pre-constructed abnormal control flow list to determine the abnormal control flow information in the two-dimensional control flow list.

[0130] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0131] In this embodiment, an electronic device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0132] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0133] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0134] S1, reading the original control flow fragment generated during the vehicle software execution process, performing nested dictionary conversion on the original control flow fragment to obtain a control flow fragment dictionary;

[0135] S2, concatenate each control flow fragment dictionary into a complete control flow dictionary;

[0136] S3, recursively extract the key path of the complete control flow dictionary to generate a two-dimensional control flow list;

[0137] S4, comparing the two-dimensional control flow list with a pre-built abnormal control flow list to determine abnormal control flow information in the two-dimensional control flow list.

[0138] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and will not be repeated in this embodiment.

[0139] In addition, in combination with the software control flow anomaly detection method provided in the above embodiments, a storage medium can also be provided in this embodiment to implement the method. The storage medium stores a computer program; when the computer program is executed by a processor, any one of the software control flow anomaly detection methods in the above embodiments is implemented.

[0140] It should be understood that the specific embodiments described herein are only used to explain the application, rather than to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of this application.

[0141] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0142] Obviously, the drawings are only some examples or embodiments of the present application. For ordinary technicians in the field, the present application can also be applied to other similar situations based on these drawings without creative work. In addition, it is understandable that although the work done in this development process may be complicated and lengthy, for ordinary technicians in the field, certain changes in design, manufacturing or production based on the technical content disclosed in this application are only conventional technical means and should not be regarded as insufficient content disclosed in this application.

[0143] The term "embodiment" in this application refers to a specific feature, structure or characteristic described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. It is clearly or implicitly understood by those of ordinary skill in the art that the embodiments described in this application can be combined with other embodiments without conflict.

[0144] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.< / child> < / tree> < / name> < / child> < / tree>

Claims

1. A method for detecting anomalies in software control flow, characterized in that: include: Reading original control flow fragments generated during the vehicle software execution process, performing nested dictionary conversion on the original control flow fragments to obtain a control flow fragment dictionary; splicing the control flow fragment dictionaries into a complete control flow dictionary; Recursively extracting key paths from the complete control flow dictionary to generate a two-dimensional control flow list; The two-dimensional control flow list is compared with a pre-built abnormal control flow list to determine abnormal control flow information in the two-dimensional control flow list.

2. The software control flow anomaly detection method according to claim 1, characterized in that: The original control flow fragment is converted into a nested dictionary to obtain a control flow fragment dictionary, including: Parsing the tree structure of the original control flow fragment, and traversing the parent node elements under the root node in the tree structure based on the parsing result; Recursively, each parent node element and the corresponding child node element are converted into nested dictionaries and stored as a control flow fragment dictionary.

3. The software control flow anomaly detection method according to claim 2, characterized in that: Recursively, each parent node element and the corresponding child node element are converted into a nested dictionary and stored as a control flow fragment dictionary, including: The information of the current parent node element is stored in the parent node dictionary, and the information of the child node element at the next level of the current parent node element is stored in the current node dictionary; the current node dictionary is the value of the parent node dictionary; The current node dictionary is used as the parent node dictionary for the next recursion, and the child node elements of the next level of the child node element are recursively processed until all elements of each level under the current parent node element are traversed to obtain a control flow fragment dictionary in the form of a nested dictionary.

4. The software control flow anomaly detection method according to claim 1, characterized in that: The outermost key name of the control flow fragment is a scheduling entry name; the scheduling entry name includes at least a task and an interrupt; and each of the control flow fragment dictionaries is spliced ​​into a complete control flow dictionary, including: Identify the control flow fragment dictionary with the outermost key name of task or interrupt as the target control flow fragment dictionary; Using the key of the target control flow fragment dictionary as the key of the newly generated temporary control flow dictionary, and nesting the values ​​of the temporary control flow dictionary based on the hierarchical structure of the values ​​of the target control flow fragment dictionary; The outermost key name of the target control flow fragment dictionary is used as the key, and the generated temporary control flow dictionary is used as the value to obtain a complete control flow dictionary.

5. The software control flow anomaly detection method according to claim 1, characterized in that: Comparing the two-dimensional control flow list with a pre-built abnormal control flow list to determine abnormal control flow information in the two-dimensional control flow list includes: The two-dimensional control flow list is compared with a pre-built abnormal control flow list in terms of function call relationships to determine abnormal control flow information in the two-dimensional control flow list.

6. The software control flow anomaly detection method according to claim 1, characterized in that: The method further comprises: The abnormal control flow information is converted into a message text, and the message text is output through an associated communication platform.

7. The software control flow anomaly detection method according to any one of claims 1 to 6, characterized in that: The method further comprises: Intercept the identified abnormal control flow information.

8. A software control flow anomaly detection device, characterized in that: include: A conversion module, a splicing module, an extraction module, and a recognition module; wherein: The conversion module is used to read the original control flow fragment generated during the vehicle software execution process, and perform nested dictionary conversion on the original control flow fragment to obtain a control flow fragment dictionary; The splicing module is used to splice the control flow fragment dictionaries into a complete control flow dictionary; The extraction module is used to recursively extract key paths from the complete control flow dictionary to generate a two-dimensional control flow list; The identification module is used to compare the two-dimensional control flow list with a pre-built abnormal control flow list to determine the abnormal control flow information in the two-dimensional control flow list.

9. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to execute the software control flow anomaly detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the software control flow anomaly detection method according to any one of claims 1 to 7 are implemented.

Images