Data anomaly detection method and device, vehicle and computer readable storage medium

Abstract

The invention discloses a data anomaly detection method and device, a vehicle and a computer readable storage medium, and the method comprises the steps: obtaining a vehicle data frame corresponding to a target vehicle, the vehicle data frame comprising data transmitted through a vehicle bus of the target vehicle; performing data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame; according to the invention, the data anomaly detection result of the target vehicle is determined based on the data frame detection result of the vehicle data frame, so that the data anomaly condition of the vehicle can be found in time to deal with the anomaly condition, and the safety of the vehicle is ensured.

Description

Technical Field

[0001] The present application relates to the automotive field, and in particular to a data anomaly detection method, device, vehicle and computer-readable storage medium. Background Art

[0002] With the rapid development of technology, vehicles are increasingly connected to external networks, and the probability of vehicles being attacked by external networks is also greater, which may cause vehicle data to be tampered with or stolen, leading to security issues such as vehicle manipulation and vehicle component failure. Summary of the invention

[0003] The embodiments of the present application provide a data anomaly detection method, device, vehicle and computer-readable storage medium, which can promptly detect data anomalies of the vehicle so as to respond to the data anomalies and ensure the safety of the vehicle.

[0004] In order to achieve the above object, according to a first aspect of the present application, a data anomaly detection method is provided, comprising:

[0005] Acquire a vehicle data frame corresponding to a target vehicle, wherein the vehicle data frame includes data transmitted via a vehicle bus of the target vehicle;

[0006] Performing data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame;

[0007] Based on the data frame detection result of the vehicle data frame, a data anomaly detection result of the target vehicle is determined.

[0008] According to a second aspect of the present application, a data anomaly detection device is provided, comprising:

[0009] An acquisition unit, configured to acquire a vehicle data frame corresponding to a target vehicle, wherein the vehicle data frame includes data transmitted via a vehicle bus of the target vehicle;

[0010] an anomaly detection unit, used to perform data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame;

[0011] The result determination unit is used to determine the data anomaly detection result of the target vehicle based on the data frame detection result of the vehicle data frame.

[0012] According to a third aspect of the present application, a vehicle is provided, comprising a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute any one of the data anomaly detection methods provided in the embodiments of the present application.

[0013] According to a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium is used to store a computer program, and the computer program is loaded by a processor to execute any one of the data anomaly detection methods provided in the embodiments of the present application.

[0014] The embodiment of the present application obtains a vehicle data frame corresponding to a target vehicle, where the vehicle data frame includes data transmitted through a vehicle bus of the target vehicle; performs data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame; and determines a data anomaly detection result of the target vehicle based on the data frame detection result of the vehicle data frame. This allows for timely discovery of data anomalies in the vehicle so that data anomalies can be addressed to ensure vehicle safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application, and those skilled in the art can obtain other drawings based on these drawings without creative work.

[0016] Figure 1 is a flow chart of a data anomaly detection method provided in an embodiment of the present application;

[0017] Figure 2 It is a schematic diagram of the intrusion detection network structure provided by an embodiment of the present application;

[0018] Figure 3 is a schematic diagram of an anomaly detection network provided in an embodiment of the present application;

[0019] Figure 4 is a schematic diagram of a data anomaly detection device provided in an embodiment of the present application;

[0020] Figure 5 It is a schematic diagram of the structure of a vehicle provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0022] The embodiments of the present application provide a data anomaly detection method, device, vehicle, and computer-readable storage medium. The data anomaly detection device can be integrated in a vehicle.

[0023] It should be noted that the description order of the following embodiments is not intended to limit the preferred order of the embodiments.

[0024] This embodiment will be described from the perspective of a data anomaly detection device, which may be specifically integrated in a vehicle.

[0025] The present application provides a method for detecting data anomalies. Figure 1 As shown, the specific process of the data anomaly detection method can be as follows:

[0026] 101. Acquire a vehicle data frame corresponding to a target vehicle, where the vehicle data frame includes data transmitted via a vehicle bus of the target vehicle.

[0027] The vehicle bus may be a bus network connecting nodes on the vehicle, and the nodes on the vehicle may include sensors, electronic control units (ECUs), etc. The ECUs may control one or more devices, such as controlling the intake volume, fuel injection volume, and exhaust volume of the engine, etc. The ECUs may also be connected to sensors, cameras, and other devices. The types of nodes connected to the vehicle bus may be set according to actual application requirements, and are not limited here. The vehicle bus may be a CAN bus, a LIN bus, a FlexRay bus, or a MOST bus, etc. In addition to being of the CAN type, the vehicle data frame may also be of the CANFD, Ethernet (ETH), and other types.

[0028] Through the vehicle bus, nodes connected to the vehicle bus can send data to other nodes, or receive data sent by other nodes, so the vehicle data frame can include data transmitted on the vehicle bus, such as the ambient temperature and in-vehicle temperature collected by the temperature sensor, image data collected by the camera, the duty cycle of the vehicle's air-conditioning compressor, control instructions, etc.

[0029] Optionally, the vehicle data frame may be a frame of data sent by any node on the vehicle bus. The vehicle data frame may include data detected by the node, such as the temperature collected by the temperature sensor in the node, the duty cycle of the vehicle's air-conditioning compressor, the vehicle's power level, etc.

[0030] The data anomaly detection method provided in the embodiment of the present application can be applied to the target vehicle or to the server corresponding to the target vehicle. If the data anomaly detection method provided in the embodiment of the present application is applied to the server corresponding to the target vehicle, the target vehicle can send the data transmitted on the vehicle bus to the server.

[0031] 102. Perform data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame.

[0032] Since each node on the vehicle bus is pre-configured with at least one corresponding unique identifier (i.e., a message identifier), the vehicle data frame sent by the node on the vehicle bus will carry the unique identifier corresponding to the node. Therefore, it is possible to detect through the message ID whether the data transmitted on the vehicle bus is intrusion data rather than data sent by the device on the vehicle; the time interval for sending data of some nodes on the bus is fixed, and some nodes send vehicle data frames when triggered by specified events, so it is also possible to detect whether the vehicle data frame is abnormal based on the time when the node sends data; in addition, there is also a correlation between the values ​​of different variables on the vehicle data frame. For example, the vehicle data frame may include sub-data indicating the cooling mode of the vehicle and sub-data indicating the duty cycle of the air-conditioning compressor, and the cooling mode of the vehicle will affect the duty cycle of the air-conditioning compressor. Since the outside world does not know the meaning represented by the sub-data on different data bits in the vehicle data frame, there is no correlation between the sub-data in the data frame of the intruding vehicle. Therefore, based on the correlation of the sub-data in the vehicle data frame, it is also possible to detect whether the vehicle data frame is abnormal.

[0033] In one embodiment, performing data anomaly detection processing on the vehicle data frame may include flow anomaly detection combing and load anomaly detection processing, that is, the step of "performing data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame" includes:

[0034] Performing traffic anomaly detection processing on the vehicle data frame to obtain a first sub-detection result;

[0035] Performing load anomaly detection processing on the vehicle data frame to obtain a second sub-detection result;

[0036] A data frame detection result is determined according to the first sub-detection result and the second sub-detection result.

[0037] Among them, the traffic anomaly detection processing can be performed on at least one of the sender, sending time and sending format of the vehicle data frame, and the responsible anomaly detection processing can be performed on the data in the vehicle data frame.

[0038] In one embodiment, the vehicle data frame may be subjected to data anomaly detection processing through an intrusion detection network, such as Figure 2 As shown, the intrusion detection network may include a traffic anomaly detection module and a load anomaly detection module, wherein the traffic anomaly detection module is used to perform traffic anomaly detection processing on vehicle data frames to obtain a first sub-detection result, and the load anomaly detection module is used to perform load anomaly detection processing on vehicle data frames to obtain a second sub-detection result. The intrusion detection network combines the first sub-detection result and the second sub-detection result to obtain a data anomaly detection result of the target vehicle.

[0039] The flow anomaly detection process may include verifying the sender of the vehicle data frame through the message identifier in the vehicle data frame. That is, in one embodiment, the step of "performing flow anomaly detection process on the vehicle data frame to obtain a first sub-detection result" includes:

[0040] Extracting a message identifier from the vehicle data frame, where the message identifier is an identifier used by a sending object of the vehicle data frame when sending data;

[0041] Compare the message identifier with the preset message identifier to determine the legitimacy of the vehicle data frame;

[0042] According to the legitimacy of the vehicle data frame, a first sub-detection result is determined.

[0043] Among them, the message identifier is a unique identifier indicating the sending object, which can also be called a message ID. Each node on the target vehicle bus is pre-configured with at least one message identifier, namely a preset message identifier. When an attacker attacks a vehicle, he will use a large number of high-priority message IDs to form messages to occupy bandwidth and hinder the normal communication of the vehicle network, or use an incorrect message ID to send a vehicle data frame. Therefore, based on the comparison between the message identifier in the vehicle data frame and the preset message identifier, it can be determined whether the vehicle data frame is an intrusion data frame.

[0044] Specifically, since the node sends the vehicle data frame in a specified data format, the message identifier can be extracted from the vehicle data frame, and the extracted data identifier is compared with the preset message identifier corresponding to each node on the vehicle bus. If the extracted message identifier is consistent with one of the preset message identifiers, the vehicle data frame is considered to come from the node on the vehicle bus and the vehicle data frame is legal. If the extracted message identifier is inconsistent with the preset message identifiers corresponding to each node on the vehicle bus, the vehicle data frame is considered to be intrusion data and the vehicle data frame is illegal.

[0045] If the vehicle data frame is legal, the first sub-detection result is determined to be that the data frame is normal; if the vehicle data frame is illegal, the first sub-detection result is determined to be that the data frame is abnormal.

[0046] When an attacker replaces or discards a vehicle data frame, the interval between vehicle data frames may change significantly. Therefore, the traffic anomaly of the vehicle data frame may be detected in combination with the time characteristics of the vehicle data frame. If the vehicle data frame is illegal, the first sub-detection result is determined to be a data frame anomaly. In one embodiment, the data anomaly detection method provided by the present application may further include:

[0047] If the vehicle data frame is illegal, the first sub-detection result is determined to be a data frame abnormality.

[0048] If the vehicle data frame is legal, further detect whether the time of the vehicle data frame is abnormal, and determine the first detection result of the vehicle data frame in combination with the time abnormality detection result. That is, in one embodiment, the step of "determining the first sub-detection result according to the legality of the vehicle data frame" may include:

[0049] If the vehicle data frame is legal, then time feature extraction is performed on the vehicle data frame to obtain time feature information corresponding to the vehicle data frame;

[0050] Performing time anomaly detection on the vehicle data frame according to the time feature information to obtain a time anomaly detection result of the vehicle data frame;

[0051] A first sub-detection result is determined according to the time anomaly detection result of the vehicle data frame.

[0052] For example, if the vehicle data frame is legal, time feature extraction is performed on the vehicle data frame to obtain time feature information corresponding to the vehicle data frame. Time feature extraction on the vehicle data frame may include obtaining the sending time or arrival time of the vehicle data frame. If the vehicle data frame includes the sending time, the sending time can be extracted from the vehicle data frame. If the vehicle data frame does not include the sending time, the arrival time of the vehicle data frame can be detected. The arrival time may refer to the time when the vehicle data frame is obtained for data anomaly detection processing.

[0053] A time anomaly detection is performed on the vehicle data frame according to the time feature information. Specifically, each message ID corresponds to a preset time threshold. If the time interval between the sending time of the vehicle data frame and the sending time of the previous vehicle data frame, or the time interval between the arrival time of the vehicle data frame and the arrival time of the previous vehicle data frame, matches (is the same or similar to) the preset time threshold corresponding to the message ID of the vehicle data frame, then it is determined that the time of the vehicle data frame is normal. Otherwise, the time of the vehicle data frame is abnormal, wherein the message ID of the previous vehicle data frame is the same as the message ID of the vehicle data frame.

[0054] If the time of the vehicle data frame is normal, the first sub-detection result is determined to be a normal data frame; if the time of the vehicle data frame is abnormal, the first sub-detection result is determined to be an abnormal data frame. That is, in one embodiment, the step of "determining the first sub-detection result according to the abnormal time detection result of the vehicle data frame" may include:

[0055] If the time anomaly detection result indicates that the vehicle data frame is abnormal, determining the first sub-detection result is a data frame abnormality;

[0056] If the time anomaly detection result indicates that the vehicle data frame is normal, the first sub-detection result is determined to be that the data frame is normal.

[0057] Optionally, the time feature extraction of the vehicle data frame may also be performed based on an analysis of the vehicle data frame and a historical vehicle data frame to determine the time feature information of the vehicle data frame. That is, in one embodiment, the step of “extracting the time feature of the vehicle data frame to obtain the time feature information corresponding to the vehicle data frame” includes:

[0058] Performing feature analysis on the vehicle data frame to obtain first vehicle feature data of the vehicle data frame;

[0059] Acquire the second vehicle characteristic data of the historical vehicle data frame, and generate a vehicle characteristic data sequence based on the time sequence of the first vehicle characteristic data and the second vehicle characteristic data;

[0060] Contextual time feature fusion processing is performed based on the vehicle feature data sequence to obtain time feature information corresponding to the vehicle data frame, and the time feature information represents the characteristics of the arrival time interval between the vehicle data frame and the historical vehicle data frame.

[0061] Among them, vehicle characteristic data may include message identification, arrival time, network connection status and payload content, etc. Vehicle characteristic data may include data extracted from vehicle data frames and data obtained by monitoring vehicle characteristic data. Through characteristic analysis, the data required to extract the time characteristic information of vehicle data frames can be obtained.

[0062] The message identifier of the historical vehicle data frame is the same as the message identifier of the vehicle data frame. The historical vehicle data frame has multiple frames. The first vehicle characteristic data is the vehicle characteristic data corresponding to the vehicle data frame, and the second vehicle characteristic data is the vehicle characteristic data corresponding to the historical vehicle data frame.

[0063] The vehicle data frame and the historical vehicle data frame are combined to generate a vehicle feature data sequence according to the time sequence, and the context time feature fusion processing is performed based on the vehicle feature data sequence to obtain the time feature information corresponding to the vehicle data frame. For example, the vehicle feature data sequence can be processed by a network that can process time series, such as an RNN network or an LSTM network, to perform context time feature fusion processing to obtain the time feature information corresponding to the vehicle data frame, wherein the LSTM network is a long short-term memory network (Long short-term memory) and the RNN is a recurrent neural network (Rerrent Neural Network).

[0064] The time characteristic information of the vehicle data frame can represent the characteristics of the arrival time interval of the vehicle data frame in the data frame sequence (including the vehicle data frame and the historical vehicle data frame).

[0065] In one embodiment, the vehicle feature data sequence may be subjected to feature extraction processing by a first neural network to extract features with strong characterization capability from the vehicle feature data sequence, and then the feature data having a sequential order may be processed by a second neural network, i.e., the step of "performing contextual time feature fusion processing based on the vehicle feature data sequence to obtain time feature information corresponding to the vehicle data frame" may include:

[0066] Performing feature extraction processing on the vehicle feature data sequence through a first neural network to obtain a feature vector sequence corresponding to the vehicle feature data sequence;

[0067] The second neural network performs feature fusion processing based on the time sequence of the feature vector sequence to obtain the time feature information corresponding to the vehicle data frame.

[0068] The first neural network may be a CNN network or other feature extraction networks, and the second neural network may be an LSTM network or an RNN network.

[0069] The vehicle feature data sequence is output to the first neural network, feature extraction is performed on the vehicle feature data sequence through the first neural network, and a feature vector sequence corresponding to the vehicle feature data sequence is output; the feature vector sequence is input to the second neural network, feature fusion is performed based on the time sequence of the feature vector sequence through the second neural network, and time feature information corresponding to the vehicle data frame is output.

[0070] By combining the historical vehicle data frames to generate the time feature information corresponding to the vehicle data frames, time anomaly detection can be performed on periodic vehicle data frames, and time anomaly detection can also be performed on non-periodic vehicle data frames, and there is no need to determine the time anomaly detection result based on a preset time threshold, and the time anomaly detection result of the vehicle data frame can be obtained based on the time feature information through the classification network, that is, in one embodiment, the step of "performing time anomaly detection on the vehicle data frame according to the time feature information to obtain the time anomaly detection result of the vehicle data frame" can include:

[0071] The classification network is used to perform classification processing based on the temporal feature information to obtain the temporal anomaly detection results of the vehicle data frame.

[0072] Among them, the classification network can be a network that can output time anomaly detection results based on time feature information.

[0073] For example, the time feature information is input into the classification network, and the classification network performs classification processing based on the time feature information, and outputs the time anomaly detection result of the vehicle data frame. The time anomaly detection result may include time normality or time anomaly.

[0074] In one embodiment, data anomaly detection processing can be performed on vehicle data frames through an intrusion detection network. The intrusion detection network may include a flow anomaly detection module and a load anomaly detection module. The flow anomaly detection module may include a first neural network, a second neural network and a classification network. In one exemplary embodiment, the flow detection module includes a CNN-LSTM network and a classification network.

[0075] Since the values ​​of different variables on the vehicle data frame are also correlated, for example, the vehicle data frame may include sub-data indicating the cooling mode of the vehicle air conditioner and sub-data indicating the duty cycle of the air-conditioning compressor, and the cooling mode of the vehicle air conditioner will affect the duty cycle of the air-conditioning compressor, so the sub-data indicating the cooling mode of the vehicle air conditioner and the sub-data indicating the duty cycle of the air-conditioning compressor in the vehicle data frame are correlated; and the number of cooling modes of the vehicle air conditioner is a little, for example, 5 cooling modes, each cooling model corresponds to different indication data, for example, 001, 002, and 003 can respectively indicate a cooling mode, so the sub-data indicating the duty cycle of the air-conditioning compressor corresponds to a data validity condition. If the sub-data indicating the duty cycle of the air-conditioning compressor in the vehicle data frame does not meet the data validity condition, it can be determined that the load of the vehicle data frame is abnormal; the temperature detected by the temperature sensor usually changes smoothly. If the sub-data indicating the temperature in the vehicle data frame changes significantly, it can also be determined that the vehicle data frame is abnormal.

[0076] Therefore, performing load anomaly detection processing on the vehicle data frame to obtain the second sub-detection result may specifically include performing anomaly detection on at least one dimension of the correlation, numerical change amplitude, and numerical validity of the variables in the vehicle data frame to obtain a dimension detection result, and determining the second sub-detection result according to the dimension detection result. That is, in one embodiment, the vehicle data frame contains numerical values ​​corresponding to multiple variables, and the step of "performing load anomaly detection processing on the vehicle data frame to obtain the second sub-detection result" may include:

[0077] Performing anomaly detection on at least one dimension of the correlation, value change amplitude, and value validity of variables in the vehicle data frame to obtain a dimension detection result;

[0078] According to the dimension detection result, a second sub-detection result of the vehicle data frame is determined.

[0079] The vehicle data frame contains the values ​​corresponding to multiple variables. The data can be data collected by sensors on the node, or working status parameters of the node device, such as the temperature inside the vehicle detected by the temperature sensor, the duty cycle of the air-conditioning compressor, etc.

[0080] Anomaly detection can be performed on at least one dimension of the correlation, numerical change amplitude and numerical validity of variables in the vehicle data frame to obtain a dimension detection result corresponding to the detected dimension. If one dimension detection result indicates that the load of the vehicle data frame is abnormal, the second sub-detection result is determined to be the load abnormality. If each dimension detection result indicates that the load of the vehicle data frame is normal, the first sub-detection result is determined to be the load normal.

[0081] In one embodiment, each dimension corresponds to an anomaly detection network, and the vehicle data frame is detected based on the anomaly detection network, that is, each dimension corresponds to an anomaly detection network, and the step of "performing anomaly detection on at least one dimension of the correlation, numerical variation range, and numerical validity of the variables of the vehicle data frame to obtain a dimension detection result" may include:

[0082] Through the anomaly detection network corresponding to each dimension in at least one dimension, anomaly detection is performed on the vehicle data frame respectively to obtain a dimension detection result corresponding to each dimension in at least one dimension.

[0083] like Figure 3 As shown, each dimension corresponds to an anomaly detection network, and the correlation of variables corresponds to Figure 3 The correlation detection network in the corresponding variable value change range Figure 3 The change amplitude detection network and numerical validity correspondence in Figure 3 In the numerical validity detection network, each anomaly detection network can be a PCA-RNN network, or a PCA-LSTM network, etc., wherein the PCA network is a network based on the principal component analysis algorithm (Principal Component Analysis, PCA), which performs feature dimension reduction on the data through principal component analysis to reduce the redundancy between features. The PCA network can retain as much information of the original data as possible while eliminating data redundancy. The RNN network consists of an input layer, a hidden layer, and an output layer. The RNN network performs the same operation on all nodes, and the output at the current moment depends on the previous calculation results. In the recurrent neural network, not only the input layer to the hidden layer and then to the output layer, the layers are fully connected, and the hidden layer nodes between the previous and subsequent time sequences are also interconnected.

[0084] The abnormality detection is performed on the correlation of the variables in the vehicle data frame, specifically, the correlation between the variables can be learned in combination with the historical vehicle data frame, and the variable correlation feature information of the vehicle data frame can be obtained. That is, in one embodiment, the step of "performing abnormality detection on at least one dimension of the correlation, value change amplitude and value validity of the variables in the vehicle data frame to obtain the dimension detection result" can include:

[0085] Acquire a first historical vehicle data frame corresponding to the vehicle data frame;

[0086] Performing a first context information fusion process on the first historical vehicle data frame and the vehicle data frame to obtain variable association feature information of the vehicle data frame, where the variable association feature information represents a feature of the vehicle data frame in terms of variable association;

[0087] According to the variable association feature information, anomaly detection is performed on the numerical association of multiple variables in the vehicle data frame to obtain the association anomaly detection result of the vehicle data frame.

[0088] Among them, the first historical vehicle data frame is a historical data frame with the same message ID as the time-domain vehicle data frame.

[0089] For example, obtain the first historical vehicle data frame corresponding to the vehicle data frame, perform feature analysis on the vehicle data frame and the first historical vehicle data frame respectively, and obtain the effective load data in the vehicle data frame and the first historical vehicle data frame. The effective load data can be data collected by sensors, data indicating the working status of equipment on the node, and other data.

[0090] A first context information fusion process is performed on the first historical vehicle data frame and the vehicle data frame. Specifically, the first context information fusion process can be performed based on a first feature sequence. The first feature sequence can be a load data sequence generated in chronological order from the effective load data in the vehicle data frame and the first historical vehicle data frame. The load data sequence is normalized, that is, standardized, and then feature extraction is performed (optionally, feature extraction can be performed through a PCA network of anomaly detection network).

[0091] By performing a first context information fusion process on the first historical vehicle data frame and the vehicle data frame, it is possible to capture whether the variables in the vehicle data frame are associated or unassociated, as well as the changing pattern between the associated variables. Based on the captured information, variable association features for generating the vehicle data frame can be obtained (optionally, this can be achieved through the RNN network of the anomaly detection network). The variable association feature information can indicate whether there is an anomaly in the variable association of the vehicle data frame.

[0092] According to the variable association feature information, anomaly detection is performed on the numerical correlation of multiple variables in the vehicle data frame. Specifically, classification processing can be performed based on the variable association feature information through a classification network to obtain the correlation anomaly detection result of the vehicle data frame.

[0093] The abnormality detection is performed on the correlation of variables in the vehicle data frame, specifically, the characteristics of the change range of each variable are learned in combination with the historical vehicle data frame, and the variable change characteristic information of the vehicle data frame is obtained. That is, in one embodiment, the step of "performing abnormality detection on at least one dimension of the correlation, value change range and value validity of the variables in the vehicle data frame to obtain the dimension detection result" may include:

[0094] Acquire a second historical vehicle data frame corresponding to the vehicle data frame;

[0095] Performing a second context information fusion process on the second historical vehicle data frame and the vehicle data frame to obtain variable change feature information of the vehicle data frame, where the variable change feature information represents a feature of the vehicle data frame in terms of a magnitude of a value change;

[0096] According to the variable change characteristic information, anomaly detection is performed on the numerical change amplitudes of multiple variables in the vehicle data frame to obtain an abnormal detection result of the change amplitude of the vehicle data frame.

[0097] Among them, the second historical vehicle data frame is a historical data frame with the same message ID as the time-domain vehicle data frame.

[0098] For example, obtain the second historical vehicle data frame corresponding to the vehicle data frame, perform feature analysis on the vehicle data frame and the second historical vehicle data frame respectively, and obtain the effective load data in the vehicle data frame and the second historical vehicle data frame. The effective load data can be data collected by sensors, data indicating the working status of equipment on the node, and other data.

[0099] The second historical vehicle data frame and the vehicle data frame are subjected to a second context information fusion process. Specifically, the second context information fusion process can be performed based on a second feature sequence. The second feature sequence can be the effective load data in the vehicle data frame and the second historical vehicle data frame, and a load data sequence is generated in chronological order. The load data sequence is normalized and then feature extraction is performed (optionally, feature extraction can be performed through the PCA network of the anomaly detection network).

[0100] By performing a second context information fusion processing based on the second feature sequence, the characteristics of the variable in terms of the change amplitude can be captured, and based on the captured information, the variable change characteristics of the generated vehicle data frame can be obtained (optionally, this can be achieved through the RNN network of the anomaly detection network). The variable-related feature information can indicate whether there is an abnormality in the numerical change amplitude of the variable in the vehicle data frame.

[0101] The abnormality detection of the numerical variation range of multiple variables in the vehicle data frame according to the variable variation characteristic information can be specifically performed by performing classification processing based on the variable variation characteristic information through a classification network to obtain the abnormality detection result of the variation range of the vehicle data frame.

[0102] The abnormality detection of the numerical validity of the variables in the vehicle data frame may be specifically performed by learning the value range of each variable in combination with the historical vehicle data frame, and obtaining the numerical feature information of the vehicle data frame. That is, in one embodiment, the step of "performing abnormality detection on at least one dimension of the correlation, numerical variation range and numerical validity of the variables in the vehicle data frame to obtain the dimension detection result" may include:

[0103] Acquire a third historical vehicle data frame corresponding to the vehicle data frame;

[0104] Performing a third context information fusion process on the third historical vehicle data frame and the vehicle data frame to obtain numerical feature information of the vehicle data frame, where the numerical feature information represents the validity of the numerical value corresponding to the variable in the vehicle data frame;

[0105] The vehicle data frame is subjected to a numerical validity check according to the numerical feature information to obtain a numerical validity check result of the vehicle data frame.

[0106] Among them, the third historical vehicle data frame is a historical data frame with the same message ID as the time-domain vehicle data frame.

[0107] For example, obtain the third historical vehicle data frame corresponding to the vehicle data frame, perform feature analysis on the vehicle data frame and the third historical vehicle data frame respectively, and obtain the effective load data in the vehicle data frame and the third historical vehicle data frame. The effective load data can be data collected by sensors, data indicating the working status of equipment on the node, and other data.

[0108] The third historical vehicle data frame and the vehicle data frame are subjected to a third context information fusion process. Specifically, the third context information fusion process can be performed based on a third feature sequence. The third feature sequence can be generated by chronologically arranging the payload data sequence from the vehicle data frame and the third historical vehicle data frame, normalizing the payload data sequence, and then performing feature extraction (optionally, feature extraction can be performed through a PCA network of anomaly detection network).

[0109] By performing a third context information fusion processing on the third historical vehicle data frame and the vehicle data frame, the value range corresponding to the variable can be captured according to the value of each variable, and based on the captured value range and the value of each variable in the vehicle data frame, the numerical feature information of the vehicle data frame can be obtained (optionally, it can be implemented through the RNN network of the anomaly detection network), and the numerical feature information can indicate the validity of the numerical value corresponding to the variable in the vehicle data frame.

[0110] Performing numerical validity detection on the vehicle data frame according to the numerical feature information may specifically be performing classification processing based on the numerical feature information through a classification network to obtain a numerical validity anomaly detection result of the vehicle data frame.

[0111] 103. Determine a data anomaly detection result of the target vehicle based on the data frame detection result of the vehicle data frame.

[0112] For example, if the data frame detection result of the vehicle data frame indicates that the data frame is abnormal, the data anomaly detection result of the target vehicle is determined to be vehicle data abnormal; if the data frame detection result of the vehicle data frame indicates that the data frame is normal, the data anomaly detection result of the target vehicle is determined to be vehicle data normal.

[0113] Optionally, in order to avoid detection errors caused by unexpected situations, for example, a sudden change in temperature causes an abnormal change in the amplitude of the variable in the vehicle data frame, resulting in an abnormal detection error, an error determination condition can be set, such as determining that the vehicle data is abnormal when the number of erroneous vehicle data frames reaches a preset number. That is, in one embodiment, the step of "determining the data abnormality detection result of the target vehicle based on the data frame detection result of the vehicle data frame" includes:

[0114] If the data frame detection result of the vehicle data frame indicates that the vehicle data frame is abnormal, the abnormal data amount is updated, and the abnormal data amount is the number of abnormal historical vehicle data frames;

[0115] If the amount of abnormal data meets the preset conditions, the data anomaly detection result of the target vehicle is determined to be vehicle data anomaly.

[0116] The abnormal data volume indicates the number of historical vehicle data frames in which the abnormality occurs. If the vehicle data frame is abnormal, the abnormal data volume is increased by 1.

[0117] Among them, the preset condition may be that the amount of abnormal data exceeds a preset threshold. For example, if the amount of abnormal data meets the preset condition, the data anomaly detection result of the target vehicle is determined to be vehicle data anomaly.

[0118] Optionally, if the data anomaly detection result of the target vehicle is vehicle data anomaly, an alarm reminder can be issued. For example, a prompt message can be displayed on the display screen of the target vehicle to remind the owner to pull over and leave the vehicle, etc., or a message can be sent to relevant staff to remind the staff to conduct risk investigation.

[0119] If the amount of abnormal data does not meet the preset condition, the data anomaly detection result of the target vehicle is determined to be normal vehicle data, and a new vehicle data frame is obtained to continue data anomaly detection. That is, in one embodiment, the data anomaly detection method provided in the embodiment of the present application may also include:

[0120] If the number of abnormalities does not meet the preset condition, a new vehicle data frame is obtained, and the new vehicle data frame is the next vehicle data frame of the vehicle data frame;

[0121] The new vehicle data frame is used as the vehicle data frame, and the execution step is returned: data anomaly detection processing is performed on the vehicle data frame to obtain a data frame detection result of the vehicle data frame.

[0122] If the number of anomalies does not meet the preset conditions, the next frame of vehicle data frame is obtained; the new vehicle data frame is used as the vehicle data frame, and the execution step is returned: data anomaly detection processing is performed on the vehicle data frame to obtain the data frame detection result of the vehicle data frame, until the amount of abnormal data meets the preset conditions.

[0123] As can be seen from the above, the embodiment of the present application obtains a vehicle data frame corresponding to the target vehicle, the vehicle data frame includes data transmitted through the vehicle bus of the target vehicle; performs data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame; based on the data frame detection result of the vehicle data frame, determines the data anomaly detection result of the target vehicle, so as to timely discover the data anomaly of the vehicle, so as to respond to the abnormal situation and ensure the safety of the vehicle.

[0124] In order to facilitate better implementation of the data anomaly detection method provided in the embodiment of the present application, a data anomaly detection device is also provided in one embodiment. The meanings of the terms are the same as those in the above-mentioned data anomaly detection method, and the specific implementation details can refer to the description in the method embodiment.

[0125] The data anomaly detection device can be integrated in a vehicle, such as Figure 4 As shown, the data anomaly detection device may include: an acquisition unit 301, an anomaly detection unit 302 and a result determination unit 303, which are specifically as follows:

[0126] (1) An acquisition unit 301 is used to acquire a vehicle data frame corresponding to a target vehicle, where the vehicle data frame includes data transmitted via a vehicle bus of the target vehicle.

[0127] (2) Anomaly detection unit 302, used to perform data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame.

[0128] In one embodiment, the anomaly detection unit 302 includes:

[0129] A first detection subunit is used to perform traffic anomaly detection processing on the vehicle data frame to obtain a first sub-detection result;

[0130] A second detection subunit is used to perform load abnormality detection processing on the vehicle data frame to obtain a second sub-detection result;

[0131] The third detection subunit is used to determine the data frame detection result according to the first sub-detection result and the second sub-detection result.

[0132] In one embodiment, the first detection subunit includes:

[0133] An extraction module, used to extract a message identifier from a vehicle data frame, where the message identifier is an identifier used by a sending object of the vehicle data frame when sending data;

[0134] A comparison module, used to compare the message identifier with a preset message identifier to determine the legitimacy of the vehicle data frame;

[0135] The determination module is used to determine the first sub-detection result according to the legitimacy of the vehicle data frame.

[0136] In one embodiment, the determination module includes:

[0137] The feature extraction submodule is used to extract the time feature of the vehicle data frame if the vehicle data frame is legal, so as to obtain the time feature information corresponding to the vehicle data frame;

[0138] The time detection submodule is used to perform time anomaly detection on the vehicle data frame according to the time feature information to obtain the time anomaly detection result of the vehicle data frame;

[0139] The first detection result determination submodule is used to determine a first sub-detection result according to the time anomaly detection result of the vehicle data frame.

[0140] In one embodiment, the feature extraction submodule may also be used for:

[0141] An analysis component, used for performing feature analysis on the vehicle data frame to obtain first vehicle feature data of the vehicle data frame;

[0142] A data acquisition component, used to acquire second vehicle characteristic data of a historical vehicle data frame, and generate a vehicle characteristic data sequence based on the time sequence of the first vehicle characteristic data and the second vehicle characteristic data;

[0143] The fusion component is used to perform contextual time feature fusion processing based on the vehicle feature data sequence to obtain time feature information corresponding to the vehicle data frame, and the time feature information represents the characteristics of the time interval between the vehicle data frame and the historical vehicle data frame.

[0144] In one embodiment, the fusion component may also be used to:

[0145] Performing feature extraction processing on the vehicle feature data sequence through a first neural network to obtain a feature vector sequence corresponding to the vehicle feature data sequence;

[0146] The second neural network performs feature fusion processing based on the time sequence of the feature vector sequence to obtain the time feature information corresponding to the vehicle data frame.

[0147] In one embodiment, the time detection submodule is further used for:

[0148] The classification network is used to perform classification processing based on the temporal feature information to obtain the temporal anomaly detection results of the vehicle data frame.

[0149] In one embodiment, the data anomaly detection device is further used to:

[0150] If the vehicle data frame is illegal, the first sub-detection result is determined to be a data frame abnormality.

[0151] In one embodiment, the first detection result determination submodule includes:

[0152] A first result detection component, configured to determine that the first sub-detection result is a data frame anomaly if the time anomaly detection result indicates that the vehicle data frame is abnormal;

[0153] The second result detection component is used to determine that the first sub-detection result is that the data frame is normal if the time anomaly detection result indicates that the vehicle data frame is normal.

[0154] In one embodiment, the second detection subunit includes:

[0155] A dimension detection module is used to perform anomaly detection on at least one dimension of the correlation, value change amplitude and value validity of variables in the vehicle data frame to obtain a dimension detection result;

[0156] The first detection result determination module is used to determine the second sub-detection result of the vehicle data frame according to the dimension detection result.

[0157] In one embodiment, the dimension detection module is further used to:

[0158] Through the anomaly detection network corresponding to each dimension in at least one dimension, anomaly detection is performed on the vehicle data frame respectively to obtain a dimension detection result corresponding to each dimension in at least one dimension.

[0159] In one embodiment, the dimension detection module includes:

[0160] A first data frame acquisition submodule, used to acquire a vehicle data frame corresponding to a first historical vehicle data frame;

[0161] A first fusion submodule is used to perform a first context information fusion process on the first historical vehicle data frame and the vehicle data frame to obtain variable association feature information of the vehicle data frame, where the variable association feature information represents a feature of the vehicle data frame in terms of variable association;

[0162] The first frame anomaly detection submodule is used to perform anomaly detection on the numerical correlation of multiple variables in the vehicle data frame according to variable correlation feature information to obtain a correlation anomaly detection result of the vehicle data frame.

[0163] In one embodiment, the dimension detection module includes:

[0164] A second data frame acquisition submodule, used to acquire a second historical vehicle data frame corresponding to the vehicle data frame;

[0165] A second fusion submodule is used to perform a second context information fusion process on the second historical vehicle data frame and the vehicle data frame to obtain variable change feature information of the vehicle data frame, where the variable change feature information represents the features of the vehicle data frame in terms of the magnitude of the value change;

[0166] The second frame anomaly detection submodule is used to perform anomaly detection on the numerical variation amplitudes of multiple variables in the vehicle data frame according to the variable variation characteristic information, and obtain the variation amplitude anomaly detection result of the vehicle data frame.

[0167] In one embodiment, the dimension detection module includes:

[0168] A third data frame acquisition submodule, used to acquire a third historical vehicle data frame corresponding to the vehicle data frame;

[0169] A third fusion submodule is used to perform a third context information fusion process on the third historical vehicle data frame and the vehicle data frame to obtain numerical feature information of the vehicle data frame, where the numerical feature information represents the validity of the numerical value corresponding to the variable in the vehicle data frame;

[0170] The third frame anomaly detection submodule is used to perform a numerical validity detection on the vehicle data frame according to the numerical feature information to obtain a numerical validity detection result of the vehicle data frame.

[0171] (3) A result determination unit 303 is used to determine a data anomaly detection result of the target vehicle based on the data frame detection result of the vehicle data frame.

[0172] In one embodiment, the result determination unit 303 includes:

[0173] An updating subunit, configured to update an abnormal data amount if a data frame detection result of the vehicle data frame indicates that the vehicle data frame is abnormal, wherein the abnormal data amount is the number of abnormal historical vehicle data frames;

[0174] The judgment subunit is used to determine that the data anomaly detection result of the target vehicle is vehicle data anomaly if the amount of abnormal data meets a preset condition.

[0175] In one embodiment, the result determination unit 303 further includes:

[0176] A first loop subunit is used for acquiring a new vehicle data frame if the number of abnormalities does not meet a preset condition, where the new vehicle data frame is a next vehicle data frame of the vehicle data frame;

[0177] The second loop subunit is used to use the new vehicle data frame as the vehicle data frame and return to the execution step: performing data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame.

[0178] As can be seen from the above, the embodiment of the present application obtains the vehicle data frame corresponding to the target vehicle through the acquisition unit 301, and the vehicle data frame includes data transmitted through the vehicle bus of the target vehicle; the abnormality detection unit 302 performs data abnormality detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame; the result determination unit 303 determines the data abnormality detection result of the target vehicle based on the data frame detection result of the vehicle data frame, so as to timely discover the data abnormality of the vehicle so as to respond to the abnormal situation and ensure the safety of the vehicle.

[0179] The present application also provides a vehicle, such as Figure 5 As shown, it shows a schematic diagram of the structure of a vehicle involved in an embodiment of the present application, specifically:

[0180] The vehicle may include components such as a processor 1001 of one or more processing cores, a memory 1002 of one or more computer-readable storage media, a power supply 1003, and an input unit 1004. Those skilled in the art will appreciate that Figure 5 The vehicle structure shown in the figure does not constitute a limitation on the vehicle, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0181] in:

[0182] The processor 1001 is the control center of the vehicle, and uses various interfaces and lines to connect various parts of the entire vehicle. By running or executing software programs and / or modules stored in the memory 1002, and calling data stored in the memory 1002, it performs various functions of the vehicle and processes data, thereby monitoring the vehicle as a whole. Optionally, the processor 1001 may include one or more processing cores; preferably, the processor 1001 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and computer programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 1001.

[0183] The memory 1002 can be used to store software programs and modules. The processor 1001 executes various functional applications and data processing by running the software programs and modules stored in the memory 1002. The memory 1002 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, a computer program required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the vehicle, etc. In addition, the memory 1002 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 1002 may also include a memory controller to provide the processor 1001 with access to the memory 1002.

[0184] The vehicle further includes a power supply 1003 for supplying power to various components. Preferably, the power supply 1003 can be logically connected to the processor 1001 through a power management system, so as to manage charging, discharging, and power consumption through the power management system. The power supply 1003 can also include any components such as one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators.

[0185] The vehicle may further include an input unit 1004, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0186] Although not shown, the vehicle may also include a display unit, etc., which will not be described in detail here. Specifically in this embodiment, the processor 1001 in the vehicle will load the executable files corresponding to the processes of one or more computer programs into the memory 1002 according to the following instructions, and the processor 1001 will run the computer programs stored in the memory 1002 to achieve various functions, as follows:

[0187] Acquire a vehicle data frame corresponding to the target vehicle, the vehicle data frame including data transmitted via a vehicle bus of the target vehicle;

[0188] Performing data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame;

[0189] Based on the data frame detection result of the vehicle data frame, a data anomaly detection result of the target vehicle is determined.

[0190] The specific implementation of the above operations can be found in the previous embodiments and will not be described in detail here.

[0191] As can be seen from the above, the embodiment of the present application obtains a vehicle data frame corresponding to the target vehicle, the vehicle data frame includes data transmitted through the vehicle bus of the target vehicle; performs data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame; based on the data frame detection result of the vehicle data frame, determines the data anomaly detection result of the target vehicle, so as to timely discover the data anomaly of the vehicle, so as to respond to the abnormal situation and ensure the safety of the vehicle.

[0192] According to one aspect of the present application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a vehicle reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the vehicle executes the methods provided in various optional implementations in the above-mentioned embodiments.

[0193] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by a computer program, or by controlling related hardware through a computer program. The computer program may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0194] To this end, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. The computer program can be loaded by a processor to execute any data anomaly detection method provided in the embodiment of the present application.

[0195] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0196] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0197] Since the computer program stored in the computer-readable storage medium can execute any one of the data anomaly detection methods provided in the embodiments of the present application, the beneficial effects that can be achieved by any one of the data anomaly detection methods provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0198] The above is a detailed introduction to a data anomaly detection method, device, vehicle and computer-readable storage medium provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data anomaly detection method, characterized in that: include: Acquire a vehicle data frame corresponding to a target vehicle, wherein the vehicle data frame includes data transmitted via a vehicle bus of the target vehicle; Performing data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame; Based on the data frame detection result of the vehicle data frame, a data anomaly detection result of the target vehicle is determined.

2. The method according to claim 1, characterized in that The performing data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame includes: Performing traffic anomaly detection processing on the vehicle data frame to obtain a first sub-detection result; Performing load abnormality detection processing on the vehicle data frame to obtain a second sub-detection result; The data frame detection result is determined according to the first sub-detection result and the second sub-detection result.

3. The method according to claim 2, characterized in that The performing flow anomaly detection processing on the vehicle data frame to obtain a first sub-detection result includes: Extracting a message identifier from the vehicle data frame, wherein the message identifier is an identifier used by a sending object of the vehicle data frame when sending data; Comparing the message identifier with a preset message identifier to determine the legitimacy of the vehicle data frame; The first sub-detection result is determined according to the legitimacy of the vehicle data frame.

4. The method according to claim 3, characterized in that The determining the first sub-detection result according to the legitimacy of the vehicle data frame includes: If the vehicle data frame is legal, extracting time features from the vehicle data frame to obtain time feature information corresponding to the vehicle data frame; Performing time anomaly detection on the vehicle data frame according to the time feature information to obtain a time anomaly detection result of the vehicle data frame; The first sub-detection result is determined according to the time anomaly detection result of the vehicle data frame.

5. The method according to claim 4, characterized in that The extracting time features of the vehicle data frame to obtain time feature information corresponding to the vehicle data frame includes: Performing feature analysis on the vehicle data frame to obtain first vehicle feature data of the vehicle data frame; Acquire second vehicle characteristic data of a historical vehicle data frame, and generate a vehicle characteristic data sequence based on the time sequence of the first vehicle characteristic data and the second vehicle characteristic data; Contextual time feature fusion processing is performed based on the vehicle feature data sequence to obtain time feature information corresponding to the vehicle data frame, where the time feature information represents the characteristics of the time interval between the vehicle data frame and the historical vehicle data frame.

6. The method according to claim 5, characterized in that The performing context time feature fusion processing based on the vehicle feature data sequence to obtain time feature information corresponding to the vehicle data frame includes: Performing feature extraction processing on the vehicle feature data sequence through a first neural network to obtain a feature vector sequence corresponding to the vehicle feature data sequence; The second neural network performs feature fusion processing based on the time sequence of the feature vector sequence to obtain time feature information corresponding to the vehicle data frame.

7. The method according to claim 6, characterized in that The performing time anomaly detection on the vehicle data frame according to the time feature information to obtain a time anomaly detection result of the vehicle data frame includes: A classification network is used to perform classification processing based on the time feature information to obtain a time anomaly detection result of the vehicle data frame.

8. The method according to claim 4, characterized in that The method further comprises: If the vehicle data frame is illegal, the first sub-detection result is determined to be a data frame abnormality.

9. The method according to claim 8, characterized in that The determining the first sub-detection result according to the time anomaly detection result of the vehicle data frame includes: If the time anomaly detection result indicates that the vehicle data frame is abnormal, determining the first sub-detection result as a data frame abnormality; If the time anomaly detection result indicates that the vehicle data frame is normal, the first sub-detection result is determined to be a normal data frame.

10. The method according to claim 1, characterized in that The vehicle data frame includes values ​​corresponding to a plurality of variables, and the load abnormality detection process is performed on the vehicle data frame to obtain a second sub-detection result, including: Performing anomaly detection on at least one dimension of the correlation, value change amplitude, and value validity of the variables in the vehicle data frame to obtain a dimension detection result; A second sub-detection result of the vehicle data frame is determined according to the dimension detection result.

11. The method according to claim 10, characterized in that Each dimension corresponds to an anomaly detection network, and anomaly detection is performed on at least one dimension of the correlation, value change amplitude, and value validity of the variables in the vehicle data frame to obtain a dimension detection result, including: Through the anomaly detection network corresponding to each dimension in the at least one dimension, anomaly detection is performed on the vehicle data frame respectively to obtain a dimension detection result corresponding to each dimension in the at least one dimension.

12. The method according to claim 10, characterized in that The dimension detection result includes a correlation anomaly detection result, and the dimension detection result is obtained by performing anomaly detection on at least one dimension of the correlation, value change amplitude, and value validity of the variables in the vehicle data frame, including: Acquire a first historical vehicle data frame corresponding to the vehicle data frame; Performing a first context information fusion process on the first historical vehicle data frame and the vehicle data frame to obtain variable association feature information of the vehicle data frame, wherein the variable association feature information represents a feature of the vehicle data frame in terms of variable association; According to the variable association feature information, anomaly detection is performed on the numerical association of multiple variables in the vehicle data frame to obtain anomaly detection result of the association of the vehicle data frame.

13. The method according to claim 10, characterized in that The dimension detection result includes a change amplitude abnormality detection result, and the dimension detection result is obtained by performing abnormality detection on at least one dimension of the correlation, value change amplitude and value validity of the variables in the vehicle data frame, including: Acquire a second historical vehicle data frame corresponding to the vehicle data frame; Performing a second context information fusion process on the second historical vehicle data frame and the vehicle data frame to obtain variable change feature information of the vehicle data frame, wherein the variable change feature information represents a feature of the vehicle data frame in terms of a magnitude of a value change; According to the variable change characteristic information, an abnormality detection is performed on the numerical change amplitudes of multiple variables in the vehicle data frame to obtain an abnormality detection result of the change amplitude of the vehicle data frame.

14. The method according to claim 10, characterized in that The dimension detection result includes a value validity detection result, and the dimension detection result is obtained by performing abnormal detection on at least one dimension of the correlation, value change amplitude and value validity of the variables in the vehicle data frame, including: Acquire a third historical vehicle data frame corresponding to the vehicle data frame; Performing a third context information fusion process on the third historical vehicle data frame and the vehicle data frame to obtain numerical feature information of the vehicle data frame, wherein the numerical feature information represents the validity of the numerical value corresponding to the variable in the vehicle data frame; A numerical validity check is performed on the vehicle data frame according to the numerical feature information to obtain a numerical validity check result of the vehicle data frame.

15. The method according to any one of claims 1 to 14, characterized in that: The determining the data anomaly detection result of the target vehicle based on the data frame detection result of the vehicle data frame includes: If the data frame detection result of the vehicle data frame indicates that the vehicle data frame is abnormal, updating the abnormal data amount, the abnormal data amount is the number of abnormal historical vehicle data frames; If the amount of abnormal data meets a preset condition, it is determined that the data anomaly detection result of the target vehicle is vehicle data anomaly.

16. The method according to claim 15, characterized in that The method further comprises: If the abnormal number does not meet the preset condition, a new vehicle data frame is acquired, where the new vehicle data frame is the next vehicle data frame of the vehicle data frame; The new vehicle data frame is used as the vehicle data frame, and the execution step is returned to: performing data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame.

17. A data anomaly detection device, characterized in that: include: An acquisition unit, configured to acquire a vehicle data frame corresponding to a target vehicle, wherein the vehicle data frame includes data transmitted via a vehicle bus of the target vehicle; an anomaly detection unit, used to perform data anomaly detection processing on the vehicle data frame to obtain a data frame detection result of the vehicle data frame; The result determination unit is used to determine the data anomaly detection result of the target vehicle based on the data frame detection result of the vehicle data frame.

18. A vehicle, characterized in that: It comprises a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute the data anomaly detection method according to any one of claims 1 to 16.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and the computer program is loaded by a processor to execute the data anomaly detection method according to any one of claims 1 to 16.

Images