Method and equipment for acquiring risk prediction information of vehicle equipment

Abstract

The invention aims to provide a method and equipment for obtaining risk prediction information of vehicle equipment, and the method specifically comprises the steps: obtaining historical security event information of the vehicle equipment about an intrusion detection protection system, the historical security event information comprising security events occurring in the intrusion detection protection system in a historical time period; a corresponding prediction algorithm model is established or updated based on the historical security event information, and the prediction algorithm model is used for predicting the number of security events about vehicle equipment in a future time period; and obtaining risk prediction information about a target time period output by the prediction algorithm model, the risk prediction information being used for indicating the number of safety events of the vehicle equipment in the target time period, and the target time period being a future time period of the historical time period. Vehicle safety protection layout can be carried out in advance, and a good safe driving environment is provided for a driver.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a technology for obtaining risk prediction information of vehicle equipment. Background Art

[0002] System security of vehicle equipment refers to the security protection of technology and management established and adopted for data processing systems, which protects the hardware, software and data of vehicle equipment from being destroyed, changed and leaked due to accidental and malicious reasons. Through the application of vehicle network communication, vehicles can better perceive the surrounding environment, reduce the probability of traffic accidents and improve road traffic efficiency. At present, the process of vehicle network communication is often accompanied by communication security threats. If the vehicle equipment encounters a security incident, it is very easy to cause a traffic accident. Summary of the invention

[0003] One object of the present application is to provide a method and device for obtaining risk prediction information of vehicle equipment.

[0004] According to one aspect of the present application, a method for obtaining risk prediction information of vehicle equipment is provided, wherein the method comprises: Acquire historical security event information of the vehicle equipment about the intrusion detection and protection system, wherein the historical security event information includes security events that occurred in the intrusion detection and protection system within a historical time period; Establishing or updating a corresponding prediction algorithm model based on the historical security event information, wherein the prediction algorithm model is used to predict the number of security events related to vehicle equipment in a future time period; The risk prediction information about the target time period output by the prediction algorithm model is obtained, wherein the risk prediction information is used to indicate the number of safety events of vehicle equipment within the target time period, and the target time period is a future time period of the historical time period.

[0005] According to another aspect of the present application, a device for obtaining risk prediction information of vehicle equipment is provided, wherein the device includes: A module for obtaining historical security event information of the vehicle equipment about the intrusion detection and protection system, wherein the historical security event information includes security events that occurred in the intrusion detection and protection system within a historical time period; A module 12 is used to establish or update a corresponding prediction algorithm model based on the historical security event information, wherein the prediction algorithm model is used to predict the number of security events related to vehicle equipment in a future time period; Module 13 is used to obtain risk prediction information about a target time period output by the prediction algorithm model, wherein the risk prediction information is used to indicate the number of safety incidents of vehicle equipment within the target time period, and the target time period is a future time period of the historical time period.

[0006] According to one aspect of the present application, a computer device is provided, wherein the device includes: Processor; and A memory arranged to store computer executable instructions, which when executed cause the processor to perform the steps of any of the methods described above.

[0007] According to one aspect of the present application, a computer-readable storage medium is provided, on which a computer program / instruction is stored, characterized in that when the computer program / instruction is executed, the system performs the steps of any of the methods described above.

[0008] According to one aspect of the present application, a computer program product is provided, including a computer program / instruction, characterized in that the computer program / instruction implements the steps of any of the above methods when executed by a processor.

[0009] Compared with the prior art, the present application obtains risk prediction information in future time periods through a predictive algorithm model, so that vehicle safety protection layout can be made in advance based on the number of safety incidents of vehicle equipment in future time periods, providing drivers with a good and safe driving environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 A flow chart showing a method for obtaining risk prediction information of vehicle equipment according to an embodiment of the present application; Figure 2 A device structure diagram showing a computer device according to another embodiment of the present application; Figure 3 An exemplary system is shown that can be used to implement the various embodiments described in this application.

[0011] The same or similar reference numerals in the drawings represent the same or similar components. DETAILED DESCRIPTION

[0012] The present application is described in further detail below in conjunction with the accompanying drawings.

[0013] In a typical configuration of the present application, the terminal, the device of the service network and the trusted party all include one or more processors (eg, a central processing unit (CPU), an input / output interface, a network interface and a memory.

[0014] Memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash memory. Memory is an example of a computer-readable medium.

[0015] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, Phase-Change Memory (PCM), Programmable Random Access Memory (PRAM), Static Random-Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of random access memory (RAM), Read-Only Memory (ROM), Electrically-Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0016] The devices referred to in this application include but are not limited to user devices, network devices, or devices formed by integrating user devices and network devices through a network. The user devices include but are not limited to any mobile electronic products that can interact with users (for example, interact with users through a touchpad), such as smart phones, tablet computers, etc. The mobile electronic products can use any operating system, such as Android operating system, iOS operating system, etc. Among them, the network device includes an electronic device that can automatically perform numerical calculations and information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable logic devices (Programmable Logic Device, PLD), field programmable gate arrays (Field Programmable Gate Array, FPGA), digital signal processors (Digital Signal Processor, DSP), embedded devices, etc. The network devices include but are not limited to computers, network hosts, single network servers, multiple network server sets or multiple servers. The cloud is composed of a large number of computers or network servers based on cloud computing (Cloud Computing), wherein cloud computing is a type of distributed computing, a virtual supercomputer composed of a group of loosely coupled computer sets. The network includes but is not limited to the Internet, a wide area network, a metropolitan area network, a local area network, a VPN network, a wireless self-organizing network (Ad Hoc network), etc. Preferably, the device may also be a program running on the user device, the network device, or a device formed by integrating the user device and the network device, the network device, the touch terminal, or the network device and the touch terminal through a network.

[0017] Of course, those skilled in the art should understand that the above-mentioned devices are only examples, and other existing or future devices that are applicable to the present application should also be included in the scope of protection of the present application and are included here by reference.

[0018] In the description of the present application, “plurality” means two or more, unless otherwise clearly and specifically defined.

[0019] Figure 1A method for obtaining risk prediction information of vehicle equipment according to the present application is shown, which is applied to computer equipment, wherein the method includes steps S101, S102 and S103. In step S101, historical security event information of vehicle equipment about intrusion detection and protection system is obtained, wherein the historical security event information includes security events that occurred in the historical time period of the intrusion detection and protection system; in step S102, a corresponding prediction algorithm model is established or updated based on the historical security event information, wherein the prediction algorithm model is used to predict the number of security events about vehicle equipment in the future time period; in step S103, risk prediction information about the target time period output by the prediction algorithm model is obtained, wherein the risk prediction information is used to indicate the number of security events of vehicle equipment in the target time period, and the target time period is the future time period of the historical time period. Wherein, the computer equipment includes a network device or an integrated device of a user device and a network device, wherein the network device includes but is not limited to a computer, a network host, a single network server, a plurality of network server sets or a cloud composed of multiple servers, and the user device includes but is not limited to any device that can interact with a user, such as a mobile phone, a personal computer or a vehicle device.

[0020] Specifically, in step S101, historical security event information about the intrusion detection and protection system of the vehicle equipment is obtained, wherein the historical security event information includes security events that occurred in the intrusion detection and protection system in the historical time period. For example, the intrusion detection and prevention system (IDPS) refers to a system that can monitor threats in the network and then take action to prevent the detected threat resolution system. As a network security technology, IDPS aims to automatically identify and defend against malicious activities and attacks against the network or system. It achieves detection and defense by monitoring network traffic and system activities, analyzing data packets, and identifying abnormal behaviors and known attack patterns. Among them, the intrusion detection and protection system is applied to vehicle equipment, and detects and defends against corresponding malicious attacks during the network communication process of the vehicle equipment. After detecting the corresponding malicious attack, the intrusion detection and protection system generates a corresponding security event and uploads the corresponding security event of this malicious attack to a computer device, etc., wherein the security event includes one or more combinations of elements such as the time of event occurrence, the attack type, the vehicle location, and the type of vehicle equipment attacked, which are not limited here. Each vehicle device establishes a communication connection with a computer device (e.g., a network device) through vehicle network communication, and reports the security event information of each vehicle device to the computer device based on the communication connection, so that the computer device obtains the statistical data of the security event information of the vehicle device connected to the cloud. The computer device can use all / part of the security events within a certain time period as input data for risk prediction. For example, the computer device selects all statistical data of security events uploaded by vehicle devices in the system received in a certain time period, and determines all / part of all the security events as input items of this prediction algorithm for risk prediction. Among them, the historical time period includes a time axis from a past tense start time node to another past tense end time node or a current time node after the start time node, which is used to indicate that the event has occurred. In some cases, in order to more accurately predict the future time period, the data corresponding to the time axis close to the current time node is usually selected for analysis and prediction, such as the time difference between the end event node and the current time node is less than or equal to the time difference threshold, such as one day, one week or one month. In order to obtain more accurate prediction data, the statistical data of security events corresponding to the historical time period needs to be large enough, and the time axis length of the historical time period is greater than or equal to the time axis length threshold, such as one month, one quarter or one year.

[0021] Here, the computer device obtains all the security events that occurred in the historical time period, and can directly use all the security events as input items of the prediction algorithm, so as to analyze all the statistical data, and subsequently output risk prediction information that meets the user's expectations based on the user's needs, for example, the number of security events of vehicle equipment that occurred in the future time period (the next day, the next week, etc. of the current time) by the model default, or output data for each parameter, such as the target time period specified by the user (for example, the next week starting from the day after tomorrow, etc.), geographic location information (a certain district in the current city), vehicle equipment type or event type of security event, etc., so as to output the refined risk prediction information. In some cases, the computer device can select part of all security events as input items for risk prediction based on the user's choice, for example, according to the refined risk prediction information of the user's needs, all security events are refined according to various parameters, such as the target time period expected by the user (for example, the next week starting from the day after tomorrow, etc.), geographic location information (a certain district in the current city), vehicle equipment type or event type of security event, etc., so as to use the part of historical security events corresponding to the refined user expected parameters as input items of the subsequent prediction algorithm, etc.

[0022] In step S102, a corresponding prediction algorithm model is established or updated based on the historical security event information, wherein the prediction algorithm model is used to predict the number of security events related to vehicle equipment in a future time period. For example, after the computer device obtains the historical security event information, the corresponding prediction algorithm model is established or updated through a prediction algorithm, and the corresponding prediction algorithm includes but is not limited to an auto-regressive moving average model (ARMA), an auto-regressive integrated moving average model (ARIMA), a wavelet decomposition, and an exponential moving average (EMA) indicator. Among them, the historical network security information in the historical time period is used as an input item, and after using the corresponding mathematical model, the security event-related data in the future time period can be predicted. For example, the algorithm is based on a time series, which is also usually called a time series, a historical complex number, or a dynamic series, etc. The development process, direction, and trend reflected in the time series are analogized or extended to predict the level that may be reached in the next period of time or in the next few years. Specifically, the safety events that occur in each vehicle model or even the entire system can be regarded as a time series, so the prediction algorithm can be used to make some predictions about the number of subsequent events. Among them, taking wavelet transform as an example, the corresponding prediction algorithm process includes: 1) Selecting a wavelet function, such as selecting different wavelets for different signals and requirements; 2) Selecting the number of decomposition layers, selecting the corresponding number of decomposition layers according to signal length, frequency resolution, time resolution, computing resources, and application requirements, etc., the best number of decomposition layers can be determined experimentally, or decisions can be made based on prior knowledge and experience; 3) Predicting the decomposed signals of each layer; 4) Selecting a suitable level for wavelet reconstruction; 5) Obtaining evaluation prediction results. Here, this application uses wavelet transform as an example to illustrate an embodiment of a prediction algorithm for data prediction. Those skilled in the art should understand that such embodiments are also applicable to other prediction algorithms, etc. Here, the prediction algorithm model can be a newly created prediction model based on the historical safety event information, or it can be established based on prior data, and the model is updated based on the historical safety event information.

[0023] In step S103, the risk prediction information about the target time period output by the prediction algorithm model is obtained, wherein the risk prediction information is used to indicate the number of security events of the vehicle equipment in the target time period, and the target time period is the future time period of the historical time period. For example, the computer device inputs the historical security event information as an input item into the corresponding prediction algorithm model, and receives the output item of the prediction algorithm model, and uses the output item as the number of security events of the vehicle equipment in the future time period. In some cases, the output item of the prediction algorithm model is the number of security events of the vehicle equipment in the default future time period (for example, the next day, week or month, etc.), and the number of security events can be the total number of security events of all vehicle equipment, or based on the parameter setting of the input item, the number of security events under the corresponding parameters is output. The target time period is the future time period of the historical time period, and the start time node of the target time period is greater than or equal to the end event node of the historical time period, for example, the target time period is the future day, and the historical time period is the past month, etc. The target time period can be a time period set by the prediction algorithm model based on a priori input or algorithm default, or a specified time period that the user expects to obtain. In some cases, the computer device further includes a display device, and the risk prediction information of the corresponding target time period is presented through the corresponding display device, such as presenting a corresponding description curve of the number of security events corresponding to the target time period on a display screen, etc. In some cases, the risk prediction information also includes the number of unit security events per unit time length in the target time period, thereby forming a corresponding risk prediction curve, etc. For example, if the target time period is one month, the risk prediction curve also includes a prediction curve formed by the number of security events per day in the month, etc.

[0024] In some embodiments, the method further includes step S104 (not shown), in which a prediction request of a user regarding a prediction algorithm model is obtained; wherein, in step S103, risk prediction information about a target time period output by the prediction algorithm model is obtained, wherein the risk prediction information is used to indicate the number of security events that will occur in vehicle equipment within the target time period, and the target time period is a future time period of the historical time period. For example, the computer device can output risk prediction information with the same parameter dimension as the data contained in the historical security event information based on the corresponding historical security event information obtained, such as the corresponding historical security event information is the statistical data of Class A vehicle equipment type encountering Class B security events in a certain district of the current city in the past month, then the corresponding output data is the risk prediction information of Class A vehicle equipment type encountering Class B security events in a certain district of the current city within the next day, etc. In some cases, the prediction algorithm model can also adjust the dimension of the output risk prediction information according to user needs, so as to obtain more detailed user expected data, wherein the parameter dimension of the risk prediction information is a subset of the parameter dimension of the historical security event information, etc. The prediction request may be input by the management user in the computer device, such as collecting the user's input operation through the input device of the computer device to generate the corresponding prediction request; or, the computer device receives the prediction request sent by other devices, which is generated by other devices based on the user's input operation, etc. In some embodiments, the prediction request includes the target time period input by the user. For example, the target time period is a time axis in the future time specified by the user, such as the next week, or the next quarter, etc., so as to achieve flexible and precise risk prediction. In some embodiments, the length of the historical time period is N times the length of the target time period, where N is a positive integer. For example, in order to ensure the accuracy of the prediction result of the prediction algorithm model, it is usually necessary to ensure that the amount of input data is large enough relative to the amount of data in the prediction time period. In other words, the length of the historical time period should be N times the target time period, such as 5 times, 10 times or even 30 times. In some cases, the prediction request may be sent between the input data, that is, the execution of step S104 before step S102, the computer device may adjust the parameter dimension of the input prediction algorithm model based on the prediction request, thereby adjusting the input historical security event information to obtain the corresponding risk prediction information. In other cases, all data within the historical time period are input into the corresponding prediction algorithm model, and the computer device adjusts the parameter dimensions of the output data according to the user's prediction request when outputting data, that is, the execution of step S104 only needs to be before step S103.

[0025] In some embodiments, the prediction request also includes target security event type information; wherein, in step S103, the risk prediction information about the target time period output by the prediction algorithm model is obtained, wherein the risk prediction information is used to indicate the number of security events of the target security event type information that will occur in the vehicle equipment within the target time period, and the target time period is the future time period of the historical time period. For example, the computer device obtains the corresponding prediction request, which contains the target security event type information. Specifically, the security event type information includes but is not limited to: packet filtering firewall, scanning detection, access denial, deception, malformed message, password blasting, Trojan implantation, vulnerability exploitation, CAN protocol traffic detection, CAN protocol message detection and other event types. In some cases, the user wants to perform risk prediction for a certain type of security event, and the computer device outputs the number of security events and / or security event prediction curves of the type of security event information that will occur in the vehicle equipment within the target time period based on the target security event type information contained in the prediction request.

[0026] In some embodiments, the prediction request also includes target vehicle type information; wherein, in step S103, the risk prediction information about the target time period output by the prediction algorithm model is obtained, wherein the risk prediction information is used to indicate the number of security events that will occur to the vehicle equipment corresponding to the target vehicle type information within the target time period, and the target time period is a future time period of the historical time period. For example, the computer device obtains the corresponding prediction request, and the prediction request includes vehicle equipment type information. Specifically, the vehicle equipment type information can be a classification of equipment types based on different brands on the market, and can also be further classified based on different models of each brand. In some cases, the user wants to perform risk prediction for a certain type of vehicle equipment type, and the computer device outputs the number of security events and / or security event prediction curves of all security event type information that will occur to the vehicle equipment corresponding to the target vehicle type information within the target time period based on the target vehicle type information contained in the prediction request. In some embodiments, the prediction request may include parameters of multiple dimensions at the same time. For example, if the prediction request includes target vehicle type information and target safety event type information at the same time, the computer device may output the number of safety events and / or a safety event prediction curve regarding the safety event type information corresponding to the target safety event type information that will occur in the target time period for the vehicle device corresponding to the target vehicle type information based on the target vehicle type information and the target safety event type information contained in the prediction request.

[0027] In some embodiments, the method further includes step S105 (not shown), in which real security event information of the vehicle equipment about the intrusion detection and protection system is obtained, wherein the real security event information includes security events occurring in the target time period in the intrusion detection and protection system; and corresponding risk growth trend information is determined based on the risk prediction information and the real security event information. For example, after the computer device performs risk prediction for the target time period, it can obtain the corresponding risk prediction curve. As time goes by, if the current time advances to after the target time period, the computer device can obtain statistical data of security events of the vehicle equipment within the target time period based on network communication with each vehicle equipment, thereby using the statistical data of security events of the vehicle equipment within the target time period (for example, total statistical data or statistical data with the same dimension as the aforementioned risk prediction information, etc.) as the real security event information of the target time period. The computer device can describe the real security incident information within the target time period based on a unit time scale (such as every day, etc.) in a curve to obtain the corresponding real security incident curve, and compare it with the risk prediction curve obtained by the above prediction to obtain the risk growth trend information, such as subtracting the two curves to obtain the corresponding difference curve, and determine the difference curve as the corresponding risk growth trend information, wherein the risk growth trend information is used to indicate the development trend between the real security incident information and the prediction result. If the real security incident information is larger than the risk prediction result, it indicates that the risk growth trend information is positively growing. If the real security incident information is smaller than the risk prediction result, it indicates that the risk growth trend information is negatively growing.

[0028] In some embodiments, the method further includes step S106 (not shown), in which the prediction algorithm model is updated based on the target risk growth trend information. For example, after the computer device determines the corresponding risk growth trend information, the prediction algorithm model can be updated based on the risk growth trend information. For example, if the risk growth trend information is positive growth, a value greater than 1 is assigned to the model result of the prediction algorithm model as / updates the corresponding weight, etc. The value can be calculated based on the risk prediction information and the real security event information.

[0029] In some embodiments, the method further includes step S107 (not shown), in which the historical security event information is data verified to determine corresponding verification result information, wherein the verification result information includes data accuracy or data inaccuracy; wherein, in step S102, if the verification result information includes data accuracy, a corresponding prediction algorithm model is established or updated based on the historical security event information, wherein the prediction algorithm model is used to predict the number of security events related to vehicle equipment in a future time period. For example, when the computer device obtains the initial statistical data, it will also perform data verification on the statistical data to determine whether the statistical data can be used as an input item of the prediction algorithm model. If there is a large deviation in the data, it means that the data is inaccurate and needs to be processed or ignored without subsequent prediction. The computer device performs data verification on the historical security event information, such as whether there is gross error data in the historical security event information. If not, it is determined that the verification result information of the historical security event information includes data accuracy. If not, it is determined that the verification result information of the historical security event information includes data inaccuracy. If force majeure or emergencies occur, the number of security incidents in a certain day may surge / drop sharply, and the statistical data of security incidents on that day cannot be trusted. The computer device can perform curve fitting on the historical security incident information based on the historical time period, and compare the daily data with the fitting curve. If the difference between the daily data and the fitting curve is less than or equal to the difference threshold, the historical security incident information in the historical time period is determined to be credible, and the corresponding verification result information includes data accuracy.

[0030] In some embodiments, the data verification of the historical security event information and determination of the corresponding verification result information include: dividing the historical security event information about the historical time period into a plurality of unit historical security event information based on a unit time scale; if each unit historical security event information in the plurality of unit historical security event information satisfies a security event quantity threshold, then determining that the corresponding verification result information includes accurate data; if not, then determining that the verification result information includes inaccurate data. For example, the unit time scale is used to indicate the smallest event unit for dividing the historical time period, such as 12 hours, a day, a week, etc. The computer device divides the historical security event information into multiple unit historical security event information according to the unit time scale, such as dividing the security event statistics of the past month into daily security event statistics of each day in the past month, so as to verify each daily security event statistics. If each unit historical security event information in the multiple unit historical security event information meets the security event quantity threshold, then the corresponding verification result information is determined to include accurate data. For example, meeting the security event quantity threshold includes: each daily security event statistics data is within a preset time statistics threshold, or the data difference between the daily security event statistics data and the time statistics data of the corresponding day in the fitting curve is less than or equal to the data difference threshold, etc.; if not, then it is determined that the verification result information includes inaccurate data.

[0031] In some embodiments, the method further includes step S108 (not shown), in which the unit historical security event information that does not meet the security event quantity threshold is removed from the plurality of unit historical security event information, so that the remaining unit historical security event information is used as the corrected historical security event information, and the verification result information of the corrected historical security event information is determined to include data accuracy. For example, for untrustworthy data, if the amount of data corresponding to the gross error data is small, the computer device can remove the part of the untrustworthy data and retain most of the credible data, so that the prediction algorithm can continue to execute to obtain corresponding risk prediction information, etc. The computer device divides the security event statistics of the past month into daily security event statistics of each day in the past month, thereby verifying each daily security event statistics, and removing the daily security event statistics that fail the verification from the monthly security event statistics of the month, and retaining the remaining daily security event statistics as the corresponding historical security event information. In some cases, the computer device can also reassign the number of removed daily security event statistics based on the fitting curve, so as to ensure the continuity of the monthly security event statistics, improve the accuracy of risk prediction, etc.

[0032] The above mainly introduces various embodiments of a method for obtaining risk prediction information of vehicle equipment in the present application. In addition, the present application also provides specific devices that can implement the above embodiments. Figure 2 Make an introduction.

[0033] Figure 2 A computer device 100 for obtaining risk prediction information of vehicle equipment according to the present application is shown, wherein the device includes a one-module 101, a one-module 102, and a one-module 103. The one-module 101 is used to obtain historical security event information of vehicle equipment about an intrusion detection and protection system, wherein the historical security event information includes security events that occurred in a historical time period in the intrusion detection and protection system; the one-module 102 is used to establish or update a corresponding prediction algorithm model based on the historical security event information, wherein the prediction algorithm model is used to predict the number of security events about vehicle equipment in a future time period; the one-module 103 is used to obtain risk prediction information about a target time period output by the prediction algorithm model, wherein the risk prediction information is used to indicate the number of security events of vehicle equipment in the target time period, and the target time period is a future time period of the historical time period.

[0034] Here, the Figure 2 The specific implementations corresponding to the one-to-one module 101, the one-to-two module 102, and the one-to-three module 103 are the same as those described above. Figure 1 The illustrated embodiments of step S101 , step S102 , and step S103 are the same or similar, and thus are not described in detail and are included herein by reference.

[0035] In some embodiments, the device further includes a module 104 (not shown) for obtaining a user's prediction request for a prediction algorithm model; wherein the module 103 is used to obtain risk prediction information about a target time period output by the prediction algorithm model, wherein the risk prediction information is used to indicate the number of safety events that will occur in vehicle equipment within the target time period, and the target time period is a future time period of the historical time period. In some embodiments, the prediction request includes the target time period input by the user. In some embodiments, the length of the historical time period is N times the length of the target time period, wherein N is a positive integer.

[0036] In some embodiments, the prediction request also includes target security event type information; wherein, module 103 is used to obtain risk prediction information about the target time period output by the prediction algorithm model, wherein the risk prediction information is used to indicate the number of security events of target security event type information that will occur in vehicle equipment within the target time period, and the target time period is a future time period of the historical time period.

[0037] In some embodiments, the prediction request also includes target vehicle type information; wherein, module 103 is used to obtain risk prediction information about a target time period output by the prediction algorithm model, wherein the risk prediction information is used to indicate the number of security incidents that will occur in vehicle equipment corresponding to the target vehicle type information within the target time period, and the target time period is a future time period of the historical time period.

[0038] In some embodiments, the device also includes a module (not shown) for obtaining real security event information of the vehicle equipment about the intrusion detection and protection system, wherein the real security event information includes security events that occurred within the target time period in the intrusion detection and protection system; and determining corresponding risk growth trend information based on the risk prediction information and the real security event information.

[0039] In some implementations, the device further includes a module (not shown) that updates the prediction algorithm model based on the target risk growth trend information in step S106.

[0040] In some embodiments, the device also includes a module (not shown) for performing data verification on the historical security event information to determine corresponding verification result information, wherein the verification result information includes accurate data or inaccurate data; wherein module 102 is used to establish or update a corresponding prediction algorithm model based on the historical security event information if the verification result information includes accurate data, wherein the prediction algorithm model is used to predict the number of security events regarding vehicle equipment in a future time period.

[0041] In some embodiments, the data verification of the historical security event information to determine the corresponding verification result information includes: based on a unit time scale, dividing the historical security event information about the historical time period into multiple unit historical security event information; if each unit historical security event information in the multiple unit historical security event information meets the security event quantity threshold, then determining that the corresponding verification result information includes data that is accurate; if not, determining that the verification result information includes data that is inaccurate.

[0042] In some embodiments, the device also includes a module (not shown) for removing the unit historical security event information that does not meet the security event quantity threshold among the multiple unit historical security event information, thereby using the remaining unit historical security event information as the corrected historical security event information, and determining that the verification result information of the corrected historical security event information includes data accuracy.

[0043] Here, the specific implementations corresponding to the four modules to the eight modules are the same as or similar to the embodiments of the aforementioned steps S104 to S108, and thus are not described in detail and are included herein by reference.

[0044] In addition to the methods and devices described in the above embodiments, the present application also provides a computer-readable storage medium, which stores computer code. When the computer code is executed, the method described in any of the preceding items is executed.

[0045] The present application also provides a computer program product. When the computer program product is executed by a computer device, the method described in any of the preceding items is executed.

[0046] The present application also provides a computer device, the computer device comprising: one or more processors; a memory for storing one or more computer programs; When the one or more computer programs are executed by the one or more processors, the one or more processors are caused to implement the method as described in any of the preceding items.

[0047] Figure 3 An exemplary system that can be used to implement various embodiments described in this application is shown; like Figure 3 In some embodiments shown, the system 300 can be used as any of the above-mentioned devices in each of the described embodiments. In some embodiments, the system 300 may include one or more computer-readable media (e.g., system memory or non-volatile memory (NVM) / storage device 320) with instructions and one or more processors (e.g., (one or more) processors 305) coupled to the one or more computer-readable media and configured to execute instructions to implement modules to perform the actions described in this application.

[0048] For one embodiment, system control module 310 may include any suitable interface controller to provide any suitable interface to at least one of processor(s) 305 and / or any suitable device or component in communication with system control module 310 .

[0049] The system control module 310 may include a memory controller module 330 to provide an interface to the system memory 315. The memory controller module 330 may be a hardware module, a software module, and / or a firmware module.

[0050] The system memory 315 may be used, for example, to load and store data and / or instructions for the system 300. For one embodiment, the system memory 315 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the system memory 315 may include a double data rate type four synchronous dynamic random access memory (Double Data Rate 4 SDRAM, DDR4 SDRAM).

[0051] For one embodiment, system control module 310 may include one or more input / output (I / O) controllers to provide interfaces to NVM / storage device 320 and communication interface(s) 325 .

[0052] For example, NVM / storage device 320 may be used to store data and / or instructions. NVM / storage device 320 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDD), one or more compact disc (CD) drives, and / or one or more digital versatile disc (DVD) drives).

[0053] NVM / storage device 320 may include storage resources that are physically part of the device on which system 300 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 320 may be accessed over a network via communication interface(s) 325.

[0054] Communication interface(s) 325 may provide an interface for system 300 to communicate over one or more networks and / or with any other suitable devices. System 300 may wirelessly communicate with one or more components of a wireless network in accordance with any of one or more wireless network standards and / or protocols.

[0055] For one embodiment, at least one of the processor(s) 305 may be packaged together with the logic of one or more controllers (e.g., memory controller module 330) of the system control module 310. For one embodiment, at least one of the processor(s) 305 may be packaged together with the logic of one or more controllers of the system control module 310 to form a System In a Package (SiP). For one embodiment, at least one of the processor(s) 305 may be integrated on the same die with the logic of one or more controllers of the system control module 310. For one embodiment, at least one of the processor(s) 305 may be integrated on the same die with the logic of one or more controllers of the system control module 310 to form a System On Chip (SoC).

[0056] In various embodiments, the system 300 may be, but is not limited to: a server, a workstation, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the system 300 may have more or fewer components and / or different architectures. For example, in some embodiments, the system 300 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application specific integrated circuit (ASIC), and a speaker.

[0057] It should be noted that the present application can be implemented in software and / or a combination of software and hardware, for example, it can be implemented using an application-specific integrated circuit (ASIC), a general-purpose computer or any other similar hardware device. In one embodiment, the software program of the present application can be executed by a processor to implement the steps or functions described above. Similarly, the software program of the present application (including related data structures) can be stored in a computer-readable recording medium, for example, a RAM memory, a magnetic or optical drive or a floppy disk and the like. In addition, some steps or functions of the present application can be implemented using hardware, for example, as a circuit that cooperates with a processor to perform various steps or functions.

[0058] In addition, a part of the present application may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present application through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes but is not limited to source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0059] Communication media include media by which communication signals containing, for example, computer readable instructions, data structures, program modules, or other data are transmitted from one system to another. Communication media may include guided transmission media such as cables and wires (e.g., optical fiber, coaxial, etc.) and wireless (unguided transmission) media that can propagate energy waves, such as acoustic, electromagnetic, radio frequency (RF), microwave, and infrared. Computer readable instructions, data structures, program modules, or other data may be embodied as a modulated data signal in, for example, a wireless medium such as a carrier wave or similar mechanism such as that embodied as part of spread spectrum technology. The term "modulated data signal" refers to a signal whose one or more characteristics are changed or set in such a way as to encode information in the signal. Modulation may be analog, digital, or a hybrid modulation technique.

[0060] By way of example and not limitation, computer-readable storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. For example, computer-readable storage media include, but are not limited to, volatile memory, such as random access memory (RAM, DRAM, SRAM); and non-volatile memory, such as flash memory, various read-only memories (ROM, PROM, EPROM, EEPROM), magnetic and ferromagnetic / ferroelectric memories (MRAM, FeRAM); and magnetic and optical storage devices (hard disks, magnetic tapes, CDs, DVDs); or other media now known or later developed that can store computer-readable information / data for use with a computer system.

[0061] Here, according to an embodiment of the present application, a device is included, which includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein, when the computer program instructions are executed by the processor, the device is triggered to run the methods and / or technical solutions based on the aforementioned multiple embodiments of the present application.

[0062] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the spirit or basic features of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the present application is limited by the attached claims rather than the above description, so it is intended to include all changes that fall within the meaning and scope of the equivalent elements of the claims in the present application. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

Claims

1. A method for obtaining risk prediction information of vehicle equipment, wherein: The method includes: a. Obtaining historical security event information of the vehicle device regarding the intrusion detection and protection system, wherein the historical security event information includes security events that occurred in the intrusion detection and protection system within a historical time period; b. establishing or updating a corresponding prediction algorithm model based on the historical security event information, wherein the prediction algorithm model is used to predict the number of security events related to vehicle equipment in a future time period; c. Obtaining risk prediction information about a target time period output by the prediction algorithm model, wherein the risk prediction information is used to indicate the number of safety events of vehicle equipment within the target time period, and the target time period is a future time period of the historical time period.

2. The method according to claim 1, wherein: The method further comprises: Obtaining user prediction requests regarding prediction algorithm models; Wherein, the step c comprises: Obtain risk prediction information about a target time period output by the prediction algorithm model, wherein the risk prediction information is used to indicate the number of safety incidents that will occur in vehicle equipment within the target time period, and the target time period is a future time period of the historical time period.

3. The method according to claim 2, wherein: The prediction request includes the target time period input by the user.

4. The method according to claim 2 or 3, wherein: The length of the historical time period is N times the length of the target time period, where N is a positive integer.

5. The method according to claim 2, wherein: The prediction request also includes target security event type information; wherein step c includes: Obtain risk prediction information about a target time period output by the prediction algorithm model, wherein the risk prediction information is used to indicate the number of security events of target security event type information that will occur in vehicle equipment within the target time period, and the target time period is a future time period of the historical time period.

6. The method according to claim 2, wherein: The prediction request also includes target vehicle type information; wherein step c includes: In response to the prediction request, risk prediction information about a target time period output by the prediction algorithm model is obtained, wherein the risk prediction information is used to indicate the number of safety incidents that will occur in vehicle equipment corresponding to the target vehicle type information within the target time period, and the target time period is a future time period of the historical time period.

7. The method according to claim 1, wherein: The method further comprises: Acquire real security event information of the vehicle equipment about the intrusion detection and protection system, wherein the real security event information includes security events that occurred in the intrusion detection and protection system within the target time period; Corresponding risk growth trend information is determined based on the risk prediction information and the actual security event information.

8. The method according to claim 7, wherein: The method further comprises: The prediction algorithm model is updated based on the risk growth trend information.

9. The method according to claim 1, wherein: The method further comprises: Performing data verification on the historical security event information to determine corresponding verification result information, wherein the verification result information includes whether the data is accurate or inaccurate; Wherein, the step b comprises: If the verification result information includes accurate data, a corresponding prediction algorithm model is established or updated based on the historical security event information, wherein the prediction algorithm model is used to predict the number of security events related to vehicle equipment in a future time period.

10. The method according to claim 9, wherein: The performing data verification on the historical security event information to determine corresponding verification result information includes: Based on a unit time scale, dividing the historical security event information about the historical time period into a plurality of unit historical security event information; If each unit historical security event information in the multiple unit historical security event information meets the security event quantity threshold, it is determined that the corresponding verification result information including data is accurate; if not, it is determined that the verification result information including data is inaccurate.

11. The method according to claim 10, wherein: The method further comprises: The unit historical security event information that does not meet the security event quantity threshold is removed from the multiple unit historical security event information, so that the remaining unit historical security event information is used as the corrected historical security event information, and the verification result information of the corrected historical security event information is determined to include data accuracy.

12. A device for obtaining risk prediction information of vehicle equipment, wherein: The equipment includes: A module for obtaining historical security event information of the vehicle equipment about the intrusion detection and protection system, wherein the historical security event information includes security events that occurred in the intrusion detection and protection system within a historical time period; A module 12 is used to establish or update a corresponding prediction algorithm model based on the historical security event information, wherein the prediction algorithm model is used to predict the number of security events related to vehicle equipment in a future time period; Module 13 is used to obtain risk prediction information about a target time period output by the prediction algorithm model, wherein the risk prediction information is used to indicate the number of safety incidents of vehicle equipment within the target time period, and the target time period is a future time period of the historical time period.

13. A computer device, wherein: The equipment includes: Processor; and A memory arranged to store computer executable instructions which, when executed, cause the processor to perform the steps of the method as claimed in any one of claims 1 to 11.

14. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: The computer program / instructions, when executed, cause the system to perform the steps of the method as claimed in any one of claims 1 to 11.

15. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images