An anomaly detection method, device, equipment, storage medium, product and vehicle

Abstract

The application provides an anomaly detection method, device, equipment, storage medium, product and vehicle. The method is applied to a vehicle. The vehicle comprises a plurality of state machines. The setting information of each state machine is determined based on a preset anomaly behavior mode library. The anomaly behavior mode library comprises at least one detection rule of an anomaly behavior. The state table of each state machine comprises a normal state and an anomaly state. The method comprises the following steps: acquiring first information. The first information comprises vehicle control information. When it is determined that the first information corresponds to a first state migration event of a first state machine, an event processing function corresponding to the first state migration event is called. The first state machine is migrated from a current state to a first state. When it is determined that the first state is an anomaly state, an anomaly processing procedure is executed. The application can improve the accuracy and efficiency of vehicle anomaly detection, and has strong adaptability and scalability.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an anomaly detection method, apparatus, device, storage medium, product, and vehicle. Background Technology

[0002] With the rapid development of intelligent transportation systems and the continuous improvement of vehicle automation technology, vehicle safety and reliability have become a focus of attention. To ensure the stability and safety of vehicles during operation, timely and accurate detection of abnormal vehicle behavior is crucial.

[0003] Traditional vehicle anomaly detection typically relies on human experience and simple diagnostic tools. This approach is not only inefficient but also susceptible to human error, making it difficult to guarantee diagnostic accuracy and consistency. With the widespread use of electronic control units (ECUs) and onboard sensors, vehicle functionality and complexity are increasing, and status information is becoming richer and more complex. Consequently, vehicles face a greater variety of potential anomalies and risks, making traditional diagnostic methods insufficient to meet the needs of modern vehicles. Summary of the Invention

[0004] In view of this, the embodiments of this application are committed to providing an anomaly detection method, apparatus, device, storage medium, product and vehicle, which performs vehicle anomaly detection based on state machine and abnormal behavior pattern library, which can not only improve the accuracy and efficiency of vehicle anomaly detection, but also has strong adaptability and scalability.

[0005] According to a first aspect of the embodiments of this application, an anomaly detection method is provided, applied to a vehicle, the vehicle including multiple state machines, each state machine's setting information including a state table, a state transition event table and an event handling function table, the setting information of each state machine is determined based on a preset abnormal behavior pattern library, the abnormal behavior pattern library including at least one abnormal behavior detection rule, and the state table of each state machine including a normal state and an abnormal state.

[0006] The method includes:

[0007] Obtain first information, which includes vehicle control information;

[0008] When the first information corresponds to the first state transition event of the first state machine, the event handling function corresponding to the first state transition event is called to transition the first state machine from the current state to the first state;

[0009] When the first state is determined to be an abnormal state, the exception handling process is executed.

[0010] Optionally, the method further includes: determining the state machine and state transition event corresponding to the first information based on the first information and the first mapping table, wherein the first mapping table includes event information corresponding to each state transition event of each state machine.

[0011] Optionally, the first information includes identification information and content information, and the setting information of each state machine also includes an event information identification set. Based on the first information and the first mapping table, the state machine and state transition event corresponding to the first information are determined, including:

[0012] The identification information of the first information is matched with the event information identification set corresponding to each state machine;

[0013] When it is determined that the identifier information of the first information matches the event information identifier set corresponding to the first state machine, the first state transition event of the first state machine corresponding to the first information is determined according to the first information and the first mapping table corresponding to the first state machine. The first mapping table includes the information identifier and content information of the event information corresponding to each state transition event of each state machine.

[0014] Optionally, the state table of the first state machine may also include a listening state;

[0015] When the current state of the first state machine is a normal state and the first state transition event belongs to a preset first mutual exclusion event pair, the first state is a listening state. The first mutual exclusion event pair includes at least two mutual exclusion events. The state transition event associated with the listening state includes the other mutual exclusion events in the first mutual exclusion event pair except for the first state transition event. The event handling function corresponding to the state transition event associated with the listening state is used to transition the first state machine from the listening state to an abnormal state.

[0016] The method further includes:

[0017] Obtain the second information;

[0018] When it is determined that the second information corresponds to the second state transition event of the first state machine, the event handling function corresponding to the second state transition event is called to transition the first state machine from the listening state to the abnormal state and execute the abnormal handling process. The second state transition event belongs to the state transition event associated with the listening state.

[0019] Optionally, the state table of the first state machine may also include suspicious states;

[0020] When the current state of the first state machine is a normal state and the first state transition event belongs to a preset set of suspicious events, the first state is a suspicious state.

[0021] Optionally, the first information is vehicle bus message information, and / or the anomaly handling process includes at least one of outputting alarm information, blocking IP, and isolating the host.

[0022] According to a second aspect of the embodiments of this application, an anomaly detection device is provided, applied to a vehicle, the vehicle including multiple state machines, each state machine's setting information including a state table, a state transition event table and an event handling function table, the setting information of each state machine is determined based on a preset abnormal behavior pattern library, the abnormal behavior pattern library including at least one abnormal behavior detection rule, and the state table of each state machine including a normal state and an abnormal state.

[0023] The device includes:

[0024] The first unit is used to acquire first information, which includes vehicle control information;

[0025] The second unit is used to call the event handling function corresponding to the first state transition event when the first information corresponds to the first state transition event of the first state machine, so as to transition the first state machine from the current state to the first state.

[0026] The third unit is used to execute the exception handling process when the first state is determined to be an abnormal state.

[0027] According to a third aspect of the embodiments of this application, an electronic device is provided, including a memory and a processor;

[0028] The memory is connected to the processor and is used to store programs;

[0029] The processor is used to implement the anomaly detection method as described in any one of the first aspects of the embodiments of this application by running a program in the memory.

[0030] According to a fourth aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, it implements the anomaly detection method as described in any one of the first aspects of the present application.

[0031] According to a fifth aspect of the embodiments of this application, a computer program product is provided, including computer program instructions, which, when executed by a processor, cause the processor to implement the anomaly detection method as described in any one of the first aspects of the embodiments of this application.

[0032] According to a sixth aspect of the embodiments of this application, a vehicle is provided, comprising:

[0033] The vehicle body and multiple state machines. The configuration information of each state machine includes a state table, a state transition event table, and an event handling function table. The configuration information of each state machine is determined based on a preset abnormal behavior pattern library. The abnormal behavior pattern library includes at least one abnormal behavior detection rule. The state table of each state machine includes normal state and abnormal state.

[0034] The anomaly detection method provided in this application introduces a state machine and a pre-defined library of abnormal behavior patterns. Based on this library, the configuration information for each state machine is created. On one hand, this enables real-time processing and analysis of various vehicle information, reducing data processing time and allowing for rapid identification of abnormal behavior, thus improving detection efficiency. On the other hand, the library of abnormal behavior patterns contains abnormal behavior detection rules, and through precise state machine configuration, the possibility of false positives and false negatives is reduced, improving detection accuracy. Furthermore, upon detecting abnormal behavior, the state machine can immediately transition to an abnormal state and trigger an anomaly handling process. This rapid response mechanism helps to address network attacks promptly, reducing the impact of attacks on vehicles and driving safety. Finally, the library of abnormal behavior patterns can be continuously updated as new security threats emerge, maintaining the advanced nature of the detection method. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0036] Figure 1 This is a structural schematic diagram of a vehicle provided in an embodiment of this application.

[0037] Figure 2 This is a flowchart illustrating an anomaly detection method provided in an embodiment of this application.

[0038] Figure 3 This is a flowchart illustrating another anomaly detection method provided in an embodiment of this application.

[0039] Figure 4 This is a flowchart illustrating another anomaly detection method provided in an embodiment of this application.

[0040] Figure 5 This is a schematic diagram of an anomaly detection device provided in an embodiment of this application.

[0041] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0042] The technical solutions of this application are applicable to scenarios requiring precise monitoring and anomaly handling of vehicle status, covering vehicle production lines in manufacturing, experimental vehicles in scientific research, test vehicles for autonomous driving and intelligent transportation systems, and ground support vehicles in the aerospace field. In these application scenarios, the vehicle system is equipped with multiple state machines, and the settings of each state machine are carefully configured based on a preset abnormal behavior pattern library, including a state table, a state transition event table, and an event handling function table, ensuring that each state machine can accurately identify and respond to abnormal states. By implementing the technical solution of this application, the vehicle system can acquire vehicle information such as control information in real time and call the corresponding event handling functions based on this information to achieve precise state machine transitions. When an abnormal state is detected, the system immediately triggers the anomaly handling process, thereby effectively preventing potential faults and ensuring the safe operation of the vehicle. Furthermore, the method of this application can significantly improve the efficiency and accuracy of anomaly detection in the vehicle system, reducing resource waste and safety hazards caused by false alarms or missed alarms. By optimizing the configuration of state machines and the anomaly handling process, the overall performance and reliability of the vehicle system can be further improved, providing strong technical support for vehicle applications in various fields.

[0043] The technical solutions provided in this application can be applied, by way of example, to hardware devices such as processors, electronic devices, and servers (including cloud servers), or packaged into software programs for execution. When the hardware device executes the processing procedure of the technical solutions in this application, or when the aforementioned software program is run, the target task can be automatically split and the application programming interfaces required by the task can be automatically invoked to achieve the purpose of the target task. This application only provides illustrative descriptions of the specific processing procedure of the technical solutions in this application and does not limit the specific implementation form of the technical solutions in this application. Any technical implementation form that can execute the processing procedure of the technical solutions in this application can be adopted by this application.

[0044] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0045] Before introducing the solution proposed in this application, the relevant technologies will first be introduced:

[0046] With the rapid development of intelligent transportation systems and the continuous improvement of vehicle automation technology, vehicle safety and reliability have become a focus of attention. To ensure the stability and safety of vehicles during operation, timely and accurate detection of abnormal vehicle behavior is crucial.

[0047] Traditional vehicle anomaly detection typically relies on human experience and simple diagnostic tools. This approach is not only inefficient but also susceptible to human error, making it difficult to guarantee diagnostic accuracy and consistency. With the widespread use of electronic control units (ECUs) and onboard sensors, vehicle functionality and complexity are increasing, and status information is becoming richer and more complex. Consequently, vehicles face a greater variety of potential anomalies and risks, making traditional diagnostic methods insufficient to meet the needs of modern vehicles.

[0048] Taking vehicle network security anomaly detection as an example, with the continuous improvement of automotive informatization and intelligence, vehicle networking systems have become an indispensable part of modern automobiles. However, the widespread application of this system has also brought severe information security challenges. Vehicles are vulnerable to network security threats from various parties, causing various abnormal behaviors that seriously endanger driving safety. Currently, the field of automotive information security intrusion detection lacks mature methods for detecting and analyzing abnormal behavior. At present, the industry practice is usually based on a comprehensive detection method using vehicle manufacturer signal specifications, historical data, and expert experience. While this method can detect some security issues to a certain extent, it has many limitations. For example, it has low detection efficiency, making it difficult to process large amounts of complex data in a short time; it lacks accuracy, easily leading to false positives or missed detections of abnormal events; and it has a slow response speed, making it difficult to respond promptly to rapidly changing network attacks.

[0049] In view of this, the embodiments of this application are committed to providing an anomaly detection method, apparatus, device, storage medium, product and vehicle, which performs vehicle anomaly detection based on state machine and abnormal behavior pattern library, which can not only improve the accuracy and efficiency of vehicle anomaly detection, but also has strong adaptability and scalability. The following embodiments will be described in detail one by one.

[0050] Exemplary System

[0051] To facilitate understanding, the implementation environment of the anomaly detection method provided in this application embodiment will first be described exemplarily. Please refer to [link / reference]. Figure 1 , Figure 1 This is a schematic diagram of the structure of a vehicle provided in an embodiment of this application. The anomaly detection method provided in this application can be applied to this vehicle as an example.

[0052] like Figure 1As shown, the vehicle includes a vehicle body and multiple state machines. Each state machine's configuration information includes a state table, a state transition event table, and an event handling function table. The configuration information of each state machine is determined based on a preset abnormal behavior pattern library, which includes at least one abnormal behavior detection rule. Each state machine's state table includes normal states and abnormal states.

[0053] As an optional implementation, a linked list of state machines is used to store and manage multiple state machines. The linked list consists of multiple nodes, each corresponding to a state machine and containing all the state machine's settings information, such as a state table, a state transition event table, and an event handling function table. Furthermore, each node also includes a pointer to the next node; that is, each node in the linked list is connected to the next node through its contained pointer. For example, when it is necessary to access the entire linked list, one can start from the head node of the list and sequentially access each state machine in the list until the end of the list is reached.

[0054] An abnormal behavior pattern library can be understood as a database or knowledge base that integrates various abnormal behavior detection rules. Each abnormal behavior detection rule is constructed based on one or more combinations of historical data, expert knowledge, industry standards, and machine learning algorithms, which can provide accurate abnormal detection judgment basis for vehicle abnormality detection systems, so as to promptly detect and handle potential abnormal situations during vehicle operation.

[0055] The abnormal behavior pattern library defines various possible abnormal behavior patterns, such as abnormal speed changes, unstable engine parameters, abnormal braking system response, and simultaneous occurrence of abnormal mutually exclusive events. Each detection rule defines the identification conditions for a specific abnormal behavior, including but not limited to parameter thresholds, time series patterns, and spatial position changes. These rules are implemented through logical expressions or algorithms, enabling automated determination of whether the vehicle's state deviates from the normal range.

[0056] Optionally, to adapt to changes in the vehicle's operating environment and the emergence of new abnormal behaviors, the abnormal behavior pattern library has the ability to be dynamically updated. For example, by periodically analyzing historical data (including various parameters and indicators of the vehicle under normal and abnormal conditions) and expert knowledge, a machine learning algorithm is trained to automatically identify and predict new abnormal behavior patterns.

[0057] Multiple state machines are deployed inside the vehicle, each responsible for monitoring the operational status or functional module of a specific aspect of the vehicle. These state machines operate independently yet collaboratively, forming a vehicle status monitoring network. Each state machine possesses independent configuration information, including a state table, a state transition event table, and an event handling function table. This information collectively defines the behavioral logic of the state machine. The state table defines all possible states the state machine can be in. The state transition event table lists all events that can trigger a state machine to transition from its current state to another. These events may originate from vehicle control information, sensor data, user input, etc., and serve as the basis for state machine state transitions. For each state transition event, there is a corresponding event handling function. This function defines how the state machine should respond when the event occurs, including state transition logic and necessary operational instructions. The event handling function table associates state transition events with specific event handling functions.

[0058] The configuration information for each state machine is established based on the abnormal behavior detection rules in the abnormal behavior pattern library.

[0059] Specifically, based on the rules and data in the abnormal behavior pattern library, all possible states of each state machine are defined, including at least normal and abnormal states. This ensures that each state has a clear meaning and triggering conditions. The defined states are then organized into a state table for easier subsequent state management and migration. A normal state indicates that the system or component is operating smoothly and as expected, and can be considered as having no abnormalities; an abnormal state indicates the presence of potential problems or faults.

[0060] Optionally, the state table of the state machine may also include listening states, suspicious states, blocking states, etc., which will be discussed in later sections and will not be explained in detail here.

[0061] Furthermore, various possible events or conditions within the monitoring range are analyzed, such as control information reception, sensor data changes, and user input, to identify events that can trigger state transitions. The identified state transition events are compiled into an event table and associated with the state table, defining the conditions under which each state transition event triggers a state transition.

[0062] Furthermore, the detection rules in the abnormal behavior pattern library are mapped to the corresponding state machine event handling logic. This state machine event handling logic includes state update logic and exception handling measures. This typically involves the following steps: analyzing each abnormal behavior detection rule in the abnormal behavior pattern library to understand its identification conditions, feature parameters, and abnormal behavior description; associating the identification conditions in the abnormal behavior detection rules with defined events to determine which events might trigger rule execution; and defining state transition logic based on the rule execution results. If the rule determines that the vehicle has entered an abnormal state, a transition from the current state to the abnormal state is triggered.

[0063] Furthermore, the established state machines are integrated into the vehicle system, and functional and performance tests are conducted to ensure that they can work collaboratively with other system components.

[0064] Furthermore, new data and anomalies are continuously collected during vehicle operation. Based on the new data and anomalies, the rules in the abnormal behavior pattern library are optimized and adjusted. Then, based on the rule optimization results and vehicle operation requirements, the state machine is updated and improved to enhance its detection performance and accuracy.

[0065] During vehicle operation, vehicle systems generate various data, which may come from various vehicle sensors, ECUs (Electronic Control Units), onboard information systems, and external data sources such as cloud servers and mobile apps. Each data source may provide data on different aspects such as vehicle status, driving behavior, and environmental information.

[0066] This data is collected in real time and transmitted to the vehicle's state machine module via preset interfaces and protocols. The state machine module processes and analyzes this data in real time using preset state sets and state transition rules. Whenever new data is generated and input into the state machine, the state machine determines whether a state transition needs to be triggered based on the current state, input events, and rules in the abnormal behavior pattern library. If the data indicates that the vehicle's current state is abnormal or has potential risks, the state machine will respond quickly, executing the corresponding state transition and exception handling logic, thereby achieving real-time monitoring and effective management of the vehicle's state.

[0067] The specific anomaly detection methods will be described in subsequent embodiments and will not be detailed here.

[0068] As an optional implementation, using a TBOX / IVI to transmit the state machine to the CAN gateway requires transmitting not only the state machine's configuration information but also auxiliary information such as the length of each state machine, the length of the ID list, the length of the state table, the length of the event table, and the length of the state transition table. This facilitates parsing by the CAN gateway program. When the system has multiple state machines, information for each state machine must be transmitted, along with the number of state machines and the total length of all state machines. Transmitting this detailed information ensures that the CAN gateway has sufficient information to correctly parse the state machine's behavior and update the current state of the state machine based on received CAN messages and events.

[0069] As an optional implementation, the abnormal behavior pattern library in the CAN gateway is updated by transmitting the abnormal behavior pattern library to the CAN gateway using TBOX / IVI.

[0070] Exemplary methods

[0071] Figure 2 This is a schematic flowchart illustrating an anomaly detection method provided in an embodiment of this application. The anomaly detection method provided in this embodiment can be exemplarily applied to... Figure 1 Vehicles in the middle. For example... Figure 2 As shown, the method includes steps S201-S203:

[0072] S201. Obtain first information, the first information including vehicle control information.

[0073] The first information can be understood as a series of data and information collected and generated in real time from the vehicle itself and its surrounding environment during vehicle operation, covering information such as the vehicle's operating status, operating instructions, environmental changes, and possible faults or abnormal prompts.

[0074] The first information includes vehicle control information, which can be understood as control information generated during vehicle operation that is directly related to vehicle driving and operation. This information is typically provided by various vehicle control systems and / or sensors, and is used to describe the vehicle's current operating status and the driver's operational intentions. Optionally, vehicle control information includes, but is not limited to, one or more of the following: driving status information (such as vehicle speed, steering angle, braking status, etc.), powertrain system information (such as engine speed, throttle opening, battery charge, motor speed, etc.), body control information (such as light status, wiper status, air conditioning settings, door and window status, etc.), safety system information (such as seatbelt status, airbag status, anti-lock braking system (ABS) status, etc.), and advanced driver assistance system information (such as environmental perception information provided by sensors such as radar and cameras).

[0075] Optionally, the first information may also include other data related to vehicle operation, such as data from the vehicle information system, external environmental data (such as temperature, humidity, road conditions, etc.), etc., which are not limited in this application.

[0076] Optionally, the first information and / or vehicle control information includes information about the interaction between the vehicle system and the external world, including but not limited to data from components such as cloud docking, external communication, firewalls, apps, and APIs.

[0077] Optionally, first information can be obtained through sensor acquisition, ECU integration, vehicle network communication, or access to external data sources.

[0078] Optionally, data aggregation can be performed by assembling data packets using vehicle probes.

[0079] Optionally, the initial information obtained usually needs to be preprocessed, such as noise reduction, calibration, formatting, including data extraction, transformation, loading, deduplication and merging, in order to facilitate subsequent analysis and detection.

[0080] As an optional implementation, the first information is vehicle bus message information.

[0081] The vehicle bus is the main network for internal vehicle communication, responsible for data transmission between various vehicle modules.

[0082] In vehicle systems, information from sensors, ECUs, and other control modules ultimately needs to be transmitted through some form of communication protocol. Bus messages, as the concrete implementation of these communication protocols, carry the underlying transmission tasks for various information. When information is sent to the bus, it is encapsulated into one or more bus messages. These messages contain information such as the source address, destination address, data content, and checksum to ensure correct transmission and reception. At the receiving end, the state machine parses these bus messages, extracts the information, and processes or responds as needed.

[0083] Information related to vehicle operation, control, and status monitoring can be transmitted via bus messages, including but not limited to basic information such as engine status, vehicle speed, steering angle, braking status, and lighting control, as well as higher-level driver assistance system information, such as sensor data from radar and cameras.

[0084] Since bus messages carry communication data between various vehicle systems, potential security threats or abnormal behavior can be detected by monitoring and analyzing these messages.

[0085] Taking abnormal behavior detection in vehicle networking as an example, by analyzing bus messages, the communication status of various systems and components inside the vehicle can be obtained, thereby discovering potential security threats or abnormal behaviors.

[0086] S202. When the first information corresponds to the first state transition event of the first state machine, the event handling function corresponding to the first state transition event is called to transition the first state machine from the current state to the first state.

[0087] Before executing step S202, it is necessary to determine whether the first information corresponds to a certain state transition event in each state machine, and which state transition event in which state machine it corresponds to. For example... Figure 3 As shown, the method further includes step S301:

[0088] S301. Based on the first information and the first mapping table, determine the state machine and state transition event corresponding to the first information. The first mapping table includes event information corresponding to each state transition event of each state machine.

[0089] The first mapping table is a predefined data structure that records the event information corresponding to each state transition event of each state machine.

[0090] The event information can be understood as data elements that directly satisfy the triggering conditions of a state transition event, which may include specific values, signal patterns, data combinations, or logical conditions. In the first mapping table, each state transition event of each state machine is associated with its corresponding event information. When the first information matches the event information of a certain state transition event, that state transition event is triggered.

[0091] The first mapping table is built based on an abnormal behavior pattern library to ensure that it accurately reflects the vehicle's behavioral characteristics under various conditions. Optionally, the first mapping table is also built based on the vehicle's design specifications.

[0092] Specifically, after obtaining the first piece of information, the system compares it with the event information in the first mapping table. This comparison process may involve matching across multiple dimensions. If the first piece of information completely matches any event information in the mapping table or meets certain matching conditions, the system determines the state transition event associated with that event information and the corresponding state machine as the state machine and state transition event corresponding to the first information, i.e., the first state machine and the first state transition event. If the first piece of information does not match any event information in the mapping table, the system may adopt a default processing strategy, such as recording the unmatched information, sending a warning, or entering a safe mode.

[0093] As an optional implementation, the first information includes identification information and content information, and the setting information of each state machine also includes an event information identification set. Step S301, "determine the state machine and state transition event corresponding to the first information according to the first information and the first mapping table," includes steps A1-A2:

[0094] A1. Match the identification information of the first information with the event information identification set corresponding to each state machine.

[0095] In this implementation, the first information comprises two parts: identification information and content information. The identification information uniquely identifies the type or source of the first information and may be a specific code, number, or identifier. The content information contains the specific data or content of the first information, such as the actual values ​​of vehicle control information like vehicle speed and steering angle.

[0096] For example, when the first information is a CAN message, the first information includes the ID field and the Date field of the CAN message. The ID field serves as the identification information of the CAN message. Each CAN message has a unique ID, which identifies the source and destination of the message. The Date field stores the specific content of the message, which usually includes specific control commands or parameters in order to accurately identify the event.

[0097] Each state machine's configuration information includes an event information identifier set, which contains the identifiers of all possible state transition events for that state machine. This event information identifier set is used to quickly match the identifier information of the first piece of information, thereby determining the state machine corresponding to that first piece of information.

[0098] Specifically, after obtaining the first information, the identifier of the first information is matched with the event information identifier set corresponding to each state machine. This matching process can be a simple lookup, hash mapping, or a more complex pattern matching algorithm. If the identifier of the first information matches a certain identifier in the event information identifier set of a certain state machine (e.g., the identifier of the first information is the same as a certain identifier), then the system determines the state machine corresponding to the first information (i.e., the first state machine).

[0099] As an optional implementation, when multiple state machines are stored and managed using a linked list of state machines, when the first information is received, the process first enters the head node of the linked list and matches the identifier information of the first information with the event information identifier set of the state machine corresponding to the head node of the linked list. If they match, proceed to step A2; if they do not match, proceed to the next node in the linked list and match the identifier information of the first information with the time information identifier set of the state machine corresponding to the next node. If they match, proceed to step A2; if they do not match, proceed to the next node in the linked list. This process is repeated until a state machine that matches the identifier information of the first information is found, and then proceed to step A2.

[0100] A2. When it is determined that the identifier information of the first information matches the event information identifier set corresponding to the first state machine, the first state transition event of the first state machine corresponding to the first information is determined according to the first information and the first mapping table corresponding to the first state machine. The first mapping table includes the information identifier and content information of the event information corresponding to each state transition event of each state machine.

[0101] After determining the first state machine, the system will further determine the state transition event corresponding to the first information based on the content information of the first information and the first mapping table corresponding to the first state machine.

[0102] Optionally, the system will compare the content information of the first information with the event information of all possible state transition events of the first state machine in the first mapping table. If the content information of the first information matches the event information of a certain state transition event of the first state machine, the system will determine the state transition event as the state transition event corresponding to the first information (i.e., the first state transition event).

[0103] Optionally, the first mapping table contains the information identifier and content information of the event information corresponding to each state transition event. The system will match the identifier information of the first information with the information identifiers of all possible state transition events of the first state machine in the first mapping table, and / or match the content information of the first information with the event information of all possible state transition events of the first state machine in the first mapping table to determine the state transition event corresponding to the first information (i.e., the first state transition event).

[0104] This implementation method significantly reduces the computational load when the system processes the first piece of information by pre-matching the identification information, thereby improving the efficiency of determining the state machine and state transition events.

[0105] Furthermore, after determining the first state transition event of the first state machine corresponding to the first information through step S301, step S202 is executed to call the event handling function corresponding to the first state transition event to transition the first state machine from the current state to the first state.

[0106] As can be seen from the foregoing, in the design of a state machine, each state transition event is associated with an event handling function, which defines how the state machine should respond when a state transition event occurs.

[0107] After the first state transition event is triggered, the event handling function corresponding to the first state transition event will be called to transition the first state machine from the current state to another new state. This new state is the first state, which is determined according to the definition of the first state transition event and the logic of the event handling function.

[0108] The transition process includes updating the internal state representation of the state machine and performing any necessary operations related to the state transition. These operations may include updating the state machine's state variables, triggering other events related to the state transition, or notifying other system components that the state machine's state has changed.

[0109] S203. When it is determined that the first state is an abnormal state, execute the exception handling process.

[0110] Before executing step S203, the system has already obtained the first information through step S201, and determined the state machine (i.e. the first state machine) corresponding to the first information and the state transition event through step S202 (which may include the previous step S301 and its optional implementations A1 and A2), and then transitioned the first state machine from the current state to the first state.

[0111] In step S203, the system determines whether the latest state of the first state machine after state transition (i.e., the first state) is an abnormal state. This determination is usually based on the state table of the state machine, which explicitly defines normal and abnormal states. By comparing the current state with the abnormal states defined in the state table, it can be determined whether the first state of the first state machine is an abnormal state.

[0112] If the first state is determined to be an abnormal state, the system will immediately trigger the exception handling process.

[0113] Anomaly handling procedures may include multiple steps, such as recording anomaly information, sending warnings to the driver, restricting vehicle functions, and initiating fault diagnosis programs. Specific anomaly handling measures depend on the type and severity of the anomaly, as well as the vehicle's design specifications and safety requirements; this application does not impose any limitations on these measures. Optionally, the anomaly handling procedure may include at least one of outputting alarm information, blocking IP addresses, and isolating the host computer.

[0114] In some cases, after executing the exception handling procedure, the system may attempt to restore the state machine to a normal state or take other measures to mitigate the impact of the abnormal state. This may involve resetting the state machine's state, reinitializing relevant parameters, or performing other recovery operations.

[0115] The anomaly detection method provided in this application introduces a state machine and a pre-defined library of abnormal behavior patterns. Based on this library, the configuration information for each state machine is created. On one hand, this enables real-time processing and analysis of various vehicle information, reducing data processing time and allowing for rapid identification of abnormal behavior, thus improving detection efficiency. On the other hand, the library of abnormal behavior patterns contains abnormal behavior detection rules, and through precise state machine configuration, the possibility of false positives and false negatives is reduced, improving detection accuracy. Furthermore, upon detecting abnormal behavior, the state machine can immediately transition to an abnormal state and trigger an anomaly handling process. This rapid response mechanism helps to address network attacks promptly, reducing the impact of attacks on vehicles and driving safety. Finally, the library of abnormal behavior patterns can be continuously updated as new security threats emerge, maintaining the advanced nature of the detection method.

[0116] As an optional implementation, the state table of the first state machine also includes a listening state.

[0117] When the current state of the first state machine is a normal state and the first state transition event belongs to a preset first mutual exclusion event pair, the first state is a listening state. The first mutual exclusion event pair includes at least two mutual exclusion events. The state transition event associated with the listening state includes the other mutual exclusion events in the first mutual exclusion event pair except for the first state transition event. The event handling function corresponding to the state transition event associated with the listening state is used to transition the first state machine from the listening state to an abnormal state.

[0118] like Figure 4 As shown, after transitioning the first state machine from its current state to the listening state, the method further includes steps S401-S402:

[0119] S401, Obtain the second information.

[0120] S402. When it is determined that the second information corresponds to the second state transition event of the first state machine, the event handling function corresponding to the second state transition event is called to transition the first state machine from the listening state to the abnormal state and execute the abnormal handling process. The second state transition event belongs to the state transition event associated with the listening state.

[0121] In this implementation, in addition to the normal state and the abnormal state, the state table of the first state machine also includes a listening state, which is used to monitor the occurrence of specific event pairs (i.e., the first mutual exclusion event pair).

[0122] The first mutually exclusive event pair consists of at least two mutually exclusive events that are logically mutually exclusive, meaning they cannot occur simultaneously. When the mutually exclusive events in the mutually exclusive event pair occur simultaneously, the vehicle is in an abnormal state.

[0123] If the first state transition event belongs to the preset first mutex event pair, then when the event occurs, the first state machine will not directly transition to the abnormal state, but will first enter the listening state.

[0124] When the first state machine is in the listening state, it associates with a set of state transition events. This set of events includes all the mutex events in the first mutex event pair except for the first state transition event. The event handlers for the state transition events associated with the listening state are designed to transition the first state machine from the listening state to an exception state. These event handlers may contain additional logic to handle mutex events detected in the listening state and trigger exception handling procedures.

[0125] In the listening state, the first state opportunity continuously monitors the remaining mutual exclusion events in the first mutual exclusion event pair, except for the first state transition event. If any of these associated state transition events occurs in the listening state, the first state opportunity immediately transitions from the listening state to the abnormal state.

[0126] Specifically, in this implementation, when the first state is the listening state, the system will continue to acquire vehicle control information during the listening state, which is referred to as the second information.

[0127] If the state transition event corresponding to the second piece of information is a state transition event associated with the listening state (i.e., one of the other mutex events corresponding to the first mutex event), the system will call the event handler function corresponding to that event. This event handler function will transition the first state machine from the listening state to the abnormal state. Once the first state machine transitions to the abnormal state, the system will immediately execute the exception handling procedure.

[0128] For example, the first state machine is responsible for monitoring the vehicle's braking system. The first mutually exclusive event pair includes two mutually exclusive events: "brake overheating" and "brake fluid pressure too low". When the system detects brake overheating (i.e., the first state transition event), it transitions the first state machine from the normal state to the listening state. In the listening state, the system continuously monitors whether the brake fluid pressure is too low. If the brake fluid pressure is indeed too low (i.e., the second state transition event), the system immediately transitions the first state machine from the listening state to the abnormal state and executes the corresponding abnormal handling procedures, such as sending a warning to the driver or activating the backup braking system.

[0129] This implementation, by introducing the concepts of listening states and mutual exclusion event pairs, enables the system to detect anomalies more accurately. Especially in complex scenarios, monitoring the occurrence of mutual exclusion events allows for earlier detection of potential problems. Furthermore, the existence of listening states allows the system to adopt a more cautious and conservative strategy when faced with uncertain or ambiguous information, thus avoiding misjudgments or omissions. This optional implementation is particularly suitable for vehicle systems requiring high reliability and safety, such as the decision-making and control systems of autonomous vehicles and in-vehicle safety systems. In summary, this optional implementation, by introducing listening states and mutual exclusion event pairs, enhances the flexibility and accuracy of anomaly detection methods, providing a higher level of security for vehicle systems.

[0130] As an optional implementation, the state table of the first state machine also includes suspicious states;

[0131] When the current state of the first state machine is a normal state and the first state transition event belongs to a preset set of suspicious events, the first state is a suspicious state.

[0132] In this implementation, the state table of the first state machine, in addition to the normal state and the abnormal state, also includes a suspicious state. The suspicious state is a special state used to identify events that may have problems but have not yet been determined.

[0133] The suspicious event set is a pre-defined set of events that includes state transition events that are considered suspicious and require additional attention.

[0134] When the current state of the first state machine is normal, and the state transition event corresponding to the first piece of information belongs to a preset set of suspicious events, the system will transition the first state machine to a suspicious state. This transition is achieved by calling the event handling function corresponding to the first state transition event.

[0135] In a suspicious state, the first state opportunity will continuously monitor the vehicle's initial information to determine if there are any further signs of anomalies.

[0136] A suspicious state is temporary. The system will decide whether to transition the state to an abnormal state or restore it to a normal state based on subsequent monitoring results. If subsequent monitoring results indicate that an anomaly does exist, the system will trigger a corresponding state transition event, transitioning the first state machine from the suspicious state to the abnormal state and executing the anomaly handling procedure. If subsequent monitoring results indicate that there is no anomaly, or the impact of the suspicious event has been eliminated, the system will trigger a state recovery event, restoring the first state machine from the suspicious state to the normal state.

[0137] For example, the first state machine is responsible for monitoring the vehicle's tire pressure, and the set of suspicious events includes the event of "slight drop in tire pressure". When the system detects a slight drop in tire pressure (i.e., the first state transition event), it transitions the first state machine from the normal state to the suspicious state. In the suspicious state, the system continuously monitors changes in tire pressure. If the tire pressure continues to drop and reaches an abnormal threshold, the system immediately transitions the first state machine from the suspicious state to the abnormal state and executes the corresponding abnormal handling procedure. If the tire pressure remains stable or returns to a normal level, the system triggers a state recovery event, restoring the first state machine from the suspicious state to the normal state.

[0138] This implementation introduces a set of suspicious states and events, providing additional layers and flexibility to anomaly detection methods. This allows the system to more flexibly handle events that pose potential risks but have not yet been definitively classified as anomalies, enabling proactive preventative measures and improving vehicle safety and reliability. Simultaneously, the introduction of suspicious states helps reduce false alarms and missed alarms, enhancing the accuracy of anomaly detection.

[0139] Exemplary device

[0140] Corresponding to the above-mentioned anomaly detection method, this application embodiment also provides an anomaly detection device applied to a vehicle. The vehicle includes multiple state machines. The setting information of each state machine includes a state table, a state transition event table, and an event handling function table. The setting information of each state machine is determined based on a preset abnormal behavior pattern library. The abnormal behavior pattern library includes at least one abnormal behavior detection rule. The state table of each state machine includes a normal state and an abnormal state. Figure 5 This is a schematic diagram of the structure of an anomaly detection device provided in an embodiment of this application, as shown below. Figure 5 As shown, the anomaly detection device provided in this application embodiment includes:

[0141] The first unit 501 is used to acquire first information, the first information including vehicle control information;

[0142] The second unit 502 is used to call the event handling function corresponding to the first state transition event when the first information corresponds to the first state transition event of the first state machine, so as to transition the first state machine from the current state to the first state.

[0143] The third unit 503 is used to execute an exception handling process when the first state is determined to be an abnormal state.

[0144] The anomaly detection device provided in this application introduces a state machine and a pre-set abnormal behavior pattern library. Based on this library, it creates setting information for each state machine. On one hand, this enables real-time processing and analysis of various vehicle information, reducing data processing time and allowing for rapid identification of abnormal behavior, thus improving detection efficiency. On the other hand, the abnormal behavior pattern library contains abnormal behavior detection rules. Precise state machine configuration reduces the possibility of false alarms and missed alarms, improving detection accuracy. Furthermore, upon detecting abnormal behavior, the state machine can immediately transition to an abnormal state and trigger an anomaly handling process. This rapid response mechanism helps to address network attacks promptly, reducing their impact on vehicle and driving safety. Finally, the abnormal behavior pattern library can be continuously updated as new security threats emerge, maintaining the advanced nature of the detection method.

[0145] Optionally, the device further includes:

[0146] The fourth unit is used to determine the state machine and state transition event corresponding to the first information based on the first information and the first mapping table. The first mapping table includes event information corresponding to each state transition event of each state machine.

[0147] Optionally, the first information includes identification information and content information, and the setting information of each state machine also includes an event information identification set. The fourth unit can specifically be used for:

[0148] The identification information of the first information is matched with the event information identification set corresponding to each state machine;

[0149] When it is determined that the identifier information of the first information matches the event information identifier set corresponding to the first state machine, the first state transition event of the first state machine corresponding to the first information is determined according to the first information and the first mapping table corresponding to the first state machine. The first mapping table includes the information identifier and content information of the event information corresponding to each state transition event of each state machine.

[0150] Optionally, the state table of the first state machine may also include a listening state;

[0151] When the current state of the first state machine is a normal state and the first state transition event belongs to a preset first mutual exclusion event pair, the first state is a listening state. The first mutual exclusion event pair includes at least two mutual exclusion events. The state transition event associated with the listening state includes the other mutual exclusion events in the first mutual exclusion event pair except for the first state transition event. The event handling function corresponding to the state transition event associated with the listening state is used to transition the first state machine from the listening state to an abnormal state.

[0152] The device further includes:

[0153] The fifth unit is used to obtain the second information;

[0154] The sixth unit is used to call the event handling function corresponding to the second state transition event when it is determined that the second information corresponds to the second state transition event of the first state machine, to transition the first state machine from the listening state to the abnormal state, and to execute the abnormal handling process. The second state transition event belongs to the state transition event associated with the listening state.

[0155] Optionally, the state table of the first state machine may also include suspicious states;

[0156] When the current state of the first state machine is a normal state and the first state transition event belongs to a preset set of suspicious events, the first state is a suspicious state.

[0157] Optionally, the first information is vehicle bus message information, and / or the anomaly handling process includes at least one of outputting alarm information, blocking IP, and isolating the host.

[0158] The anomaly detection device provided in this embodiment belongs to the same concept as the anomaly detection method provided in the above embodiments of this application. It can execute the anomaly detection method provided in any of the above embodiments of this application and has the corresponding functional modules and beneficial effects for executing the anomaly detection method. Technical details not described in detail in this embodiment can be found in the specific processing content of the anomaly detection method provided in the above embodiments of this application, and will not be repeated here.

[0159] The functions implemented by the first unit 501, the second unit 502 and the third unit 503 described above can be implemented by the same or different processors, and this application embodiment does not limit this.

[0160] It should be understood that the units in the above device can be implemented by a processor calling software. For example, the device includes a processor connected to a memory containing instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of each unit in the device. The processor can be a general-purpose processor, such as a CPU or microprocessor, and the memory can be internal or external to the device. Alternatively, the units in the device can be implemented as hardware circuits. By designing the hardware circuits, some or all of the unit functions can be implemented. The hardware circuits can be understood as one or more processors. For example, in one implementation, the hardware circuit is an ASIC, and the functions of some or all of the above units are implemented by designing the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a PLD, such as an FPGA, which can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files to implement the functions of some or all of the above units. All units in the above device can be implemented entirely by a processor calling software, entirely by hardware circuits, or partially by a processor calling software with the remaining parts implemented by hardware circuits.

[0161] In this application embodiment, a processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction reading and execution capabilities, such as a CPU, microprocessor, GPU, or DSP. In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. These logical relationships are fixed or reconfigurable. For example, the processor may be a hardware circuit implemented as an ASIC or PLD, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the processor loading instructions to implement the functions of some or all of the above units. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as an NPU, TPU, or DPU.

[0162] As can be seen, each unit in the above device can be one or more processors (or processing circuits) configured to implement the above methods, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0163] Furthermore, the units in the above devices can be integrated in whole or in part, or they can be implemented independently. In one implementation, these units are integrated together and implemented in the form of a System-on-Chip (SoC). The SoC may include at least one processor for implementing any of the above methods or implementing the functions of the units in the device. The at least one processor may be of different types, such as CPU and FPGA, CPU and artificial intelligence processor, CPU and GPU, etc.

[0164] Exemplary electronic devices

[0165] This application also proposes an electronic device applied to a vehicle. The vehicle includes multiple state machines. The configuration information of each state machine includes a state table, a state transition event table, and an event handling function table. The configuration information of each state machine is determined based on a preset abnormal behavior pattern library. The abnormal behavior pattern library includes at least one abnormal behavior detection rule. The state table of each state machine includes normal states and abnormal states. See also... Figure 6 As shown, the device includes:

[0166] Memory 200 and processor 210;

[0167] The memory 200 is connected to the processor 210 and is used to store programs;

[0168] The processor 210 is configured to implement the anomaly detection method disclosed in any of the above embodiments by running the program stored in the memory 200.

[0169] Specifically, the aforementioned anomaly detection device may also include: a bus, a communication interface 220, an input device 230, and an output device 240.

[0170] The processor 210, memory 200, communication interface 220, input device 230, and output device 240 are interconnected via a bus. Among them:

[0171] A bus can include a pathway for transmitting information between various components of a computer system.

[0172] The processor 210 can be a general-purpose processor, such as a general-purpose central processing unit (CPU), a microprocessor, etc., or an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present invention. It can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0173] Processor 210 may include a main processor, as well as a baseband chip, modem, etc.

[0174] The memory 200 stores a program that executes the technical solution of this invention, and may also store an operating system and other key business functions. Specifically, the program may include program code, which includes computer operation instructions. More specifically, the memory 200 may include read-only memory (ROM), other types of static storage devices capable of storing static information and instructions, random access memory (RAM), other types of dynamic storage devices capable of storing information and instructions, disk storage, flash memory, etc.

[0175] Input device 230 may include a device for receiving user input data and information, such as a keyboard, mouse, camera, scanner, light pen, voice input device, touch screen, pedometer, or gravity sensor.

[0176] Output device 240 may include devices that allow information to be output to a user, such as a display screen, printer, speaker, etc.

[0177] The communication interface 220 may include a device that uses any transceiver to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Network (WLAN), etc.

[0178] The processor 210 executes the program stored in the memory 200 and calls other devices, which can be used to implement the various steps of any of the anomaly detection methods provided in the above embodiments of this application.

[0179] This application also proposes a chip including a processor and a data interface. The processor reads and runs a program stored in a memory through the data interface to execute the anomaly detection method described in any of the above embodiments. For details of the processing and its beneficial effects, please refer to the embodiments of the above anomaly detection method.

[0180] Exemplary computer program products and storage media

[0181] In addition to the methods and devices described above, embodiments of this application may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps in the anomaly detection methods according to various embodiments of this application as described in any of the above embodiments of this specification.

[0182] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0183] Furthermore, embodiments of this application may also be storage media storing a computer program, which is executed by a processor through steps in the anomaly detection methods according to various embodiments of this application described in any of the foregoing embodiments of this specification. Specifically, the following steps can be implemented:

[0184] S201. Obtain first information, the first information including vehicle control information.

[0185] S202. When the first information corresponds to the first state transition event of the first state machine, the event handling function corresponding to the first state transition event is called to transition the first state machine from the current state to the first state.

[0186] S203. When it is determined that the first state is an abnormal state, execute the exception handling process.

[0187] For the foregoing method embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0188] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0189] The steps in the methods of the various embodiments of this application can be adjusted, merged, or deleted in order according to actual needs, and the technical features described in each embodiment can be replaced or combined.

[0190] The modules and sub-modules in the various embodiments of the present application's devices and terminals can be merged, divided, and deleted according to actual needs.

[0191] It should be understood that the disclosed terminals, devices, and methods can be implemented in other ways, given the several embodiments provided in this application. For example, the terminal embodiments described above are merely illustrative. For instance, the division of modules or sub-modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple sub-modules or modules may be combined or integrated into another module, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0192] The modules or submodules described as separate components may or may not be physically separate. The components that constitute a module or submodule may or may not be physical modules or submodules; that is, they may be located in one place or distributed across multiple network modules or submodules. Some or all of the modules or submodules can be selected to achieve the purpose of this embodiment's solution, depending on actual needs.

[0193] Furthermore, the functional modules or sub-modules in the various embodiments of this application can be integrated into one processing module, or each module or sub-module can exist physically separately, or two or more modules or sub-modules can be integrated into one module. The integrated modules or sub-modules described above can be implemented in hardware or in the form of software functional modules or sub-modules.

[0194] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0195] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software unit executed by a processor, or a combination of both. The software unit can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0196] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0197] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An anomaly detection method, characterized in that, Applied to vehicles, the vehicles include multiple state machines. The configuration information of each state machine includes a state table, a state transition event table, and an event handling function table. The configuration information of each state machine is determined based on a preset abnormal behavior pattern library. The abnormal behavior pattern library includes at least one abnormal behavior detection rule. The state table of each state machine includes normal state and abnormal state. The method includes: Obtain first information, which includes vehicle control information; Determine the state machine and state transition event corresponding to the first information; When the first information corresponds to the first state transition event of the first state machine, the event handling function corresponding to the first state transition event is called to transition the first state machine from the current state to the first state; When the first state is determined to be an abnormal state, the exception handling process is executed; The step of determining the state machine and state transition event corresponding to the first information includes: determining the state machine and state transition event corresponding to the first information based on the first information and the first mapping table, wherein the first mapping table includes event information corresponding to each state transition event of each state machine. The first information includes identification information and content information, and the setting information of each state machine also includes an event information identifier set. Determining the state machine and state transition event corresponding to the first information based on the first information and a first mapping table includes: matching the identification information of the first information with the event information identifier set corresponding to each state machine; when determining that the identification information of the first information matches the event information identifier set corresponding to the first state machine, determining the first state transition event of the first state machine corresponding to the first information based on the first information and the first mapping table corresponding to the first state machine, wherein the first mapping table includes the information identifier and content information of the event information corresponding to each state transition event of each state machine.

2. The method according to claim 1, characterized in that, The state table of the first state machine also includes a listening state; When the current state of the first state machine is a normal state and the first state transition event belongs to a preset first mutual exclusion event pair, the first state is a listening state. The first mutual exclusion event pair includes at least two mutual exclusion events. The state transition event associated with the listening state includes the other mutual exclusion events in the first mutual exclusion event pair except for the first state transition event. The event handling function corresponding to the state transition event associated with the listening state is used to transition the first state machine from the listening state to an abnormal state. The method further includes: Obtain the second information; When it is determined that the second information corresponds to the second state transition event of the first state machine, the event handling function corresponding to the second state transition event is called to transition the first state machine from the listening state to the abnormal state and execute the abnormal handling process. The second state transition event belongs to the state transition event associated with the listening state.

3. The method according to claim 1, characterized in that, The state table of the first state machine also includes suspicious states; When the current state of the first state machine is a normal state and the first state transition event belongs to a preset set of suspicious events, the first state is a suspicious state.

4. The method according to any one of claims 1-3, characterized in that, The first information is vehicle bus message information, and / or the anomaly handling process includes at least one of outputting alarm information, blocking IP, and isolating the host.

5. An anomaly detection device, characterized in that, Applied to vehicles, the vehicles include multiple state machines. The configuration information of each state machine includes a state table, a state transition event table, and an event handling function table. The configuration information of each state machine is determined based on a preset abnormal behavior pattern library. The abnormal behavior pattern library includes at least one abnormal behavior detection rule. The state table of each state machine includes normal state and abnormal state. The device includes: The first unit is used to acquire first information, which includes vehicle control information; The fourth unit is used to determine the state machine and state transition events corresponding to the first information; The second unit is used to call the event handling function corresponding to the first state transition event when the first information corresponds to the first state transition event of the first state machine, so as to transition the first state machine from the current state to the first state. The third unit is used to execute the exception handling process when the first state is determined to be an abnormal state; The device further includes: a fourth unit, configured to determine the state machine and state transition event corresponding to the first information based on the first information and the first mapping table, wherein the first mapping table includes event information corresponding to each state transition event of each state machine; The first information includes identification information and content information. The setting information of each state machine also includes an event information identification set. The fourth unit can be specifically used to: match the identification information of the first information with the event information identification set corresponding to each state machine; when it is determined that the identification information of the first information matches the event information identification set corresponding to the first state machine, determine the first state transition event of the first state machine corresponding to the first information according to the first information and the first mapping table corresponding to the first state machine. The first mapping table includes the information identification and content information of the event information corresponding to each state transition event of each state machine.

6. An electronic device, characterized in that, Including memory and processor; The memory is connected to the processor and is used to store programs; The processor is used to implement the anomaly detection method as described in any one of claims 1-4 by running the program in the memory.

7. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the anomaly detection method as described in any one of claims 1-4.

8. A computer program product, characterized in that, It includes computer program instructions that, when executed by a processor, cause the processor to implement the anomaly detection method as described in any one of claims 1-4.

9. A vehicle, characterized in that, include: The vehicle body and multiple state machines, each state machine's configuration information including a state table, a state transition event table, and an event handling function table, the configuration information of each state machine is determined based on a preset abnormal behavior pattern library, the abnormal behavior pattern library including at least one abnormal behavior detection rule, the state table of each state machine including normal state and abnormal state; the vehicle is used to implement the abnormal detection method as described in any one of claims 1-4 as claimed in the claims.

Images