Charging pile network abnormal data detection method and system and electronic equipment

Abstract

The invention discloses a charging pile network abnormal data detection method and system and electronic equipment, and belongs to the technical field of computers, and the method comprises the steps: obtaining open charging point protocol communication data of a charging pile network, and obtaining to-be-detected communication data; performing data preprocessing on the to-be-detected communication data to obtain first communication data; extracting a timestamp, the number of charging times, the charging amount and the charging duration from the first communication data; according to the timestamp, the number of charging times, the charging amount and the charging duration, determining original linear features of the open charging point protocol communication data; performing feature correlation screening on the original linear features to obtain first linear features; identifying a charging mode, a user behavior mode and an abnormal use mode of the charging pile according to the first linear feature; and based on the mode, classifying the open charging point protocol communication data to obtain an abnormal data detection result of the charging pile network. According to the method and the device, more accurate abnormal data detection can be better carried out.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, system and electronic device for detecting abnormal data in a charging pile network. Background Art

[0002] With the transformation of the global energy structure and the rapid development of new energy vehicles, the demand for new energy charging piles is increasing. As an important supporting facility for new energy vehicles, the improvement of the infrastructure of charging piles directly affects the promotion and application of new energy vehicles. In the field of new energy vehicles, Open Charge Point Protocol (OCPP) 2.0, as a crucial communication standard for communication between electric vehicle charging stations and central management systems, has become one of the widely adopted charging infrastructure communication protocols worldwide. In particular, OCPP 2.0 plays a key role in realizing intelligent charging management and cross-platform interoperability.

[0003] However, the main problems faced by related technologies in the field of charging pile safety include limited detection capabilities for abnormal behaviors, especially in real-time monitoring and automated response. Existing solutions often lack effective automated analysis capabilities when processing large amounts of OCPP data, making it difficult to accurately identify potential security threats from massive amounts of data. Summary of the invention

[0004] In order to solve at least one of the above problems, the embodiments of the present application propose a charging pile network abnormal data detection method, system and electronic device with high detection accuracy.

[0005] To achieve the above purpose, one aspect of an embodiment of the present application proposes a method for detecting abnormal data in a charging pile network, the method comprising: Obtaining the open charging point protocol communication data of the charging pile network to obtain the communication data to be detected; Performing data preprocessing on the communication data to be detected to obtain first communication data; extracting a timestamp, a charging number, a charging amount, and a charging duration from the first communication data; Determine the original linear features of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration; wherein the original linear features include historical translation features, differential features and window statistical features; Performing feature correlation screening on the original linear feature to obtain a first linear feature; According to the first linear feature, identifying the charging mode, user behavior pattern and abnormal usage pattern of the charging pile; Based on the charging mode, the user behavior pattern and the abnormal usage pattern, the open charging point protocol communication data is classified to obtain an abnormal data detection result of the charging pile network.

[0006] In some embodiments, performing data preprocessing on the communication data to be detected to obtain the first communication data comprises the following steps: Using median filtering to perform denoising on the communication data to be detected to obtain second communication data; The second communication data is normalized to obtain first communication data.

[0007] In some embodiments, determining the original linear characteristics of the open charge point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration comprises the following steps: using the timestamp, the number of charging times, the charging amount and the charging duration as key features; Calculating the change amount of each key feature within a preset window to obtain a historical translation feature of each key feature; Calculating the difference of the continuous values ​​of each of the key features to obtain the differential feature of each of the key features; Calculate the statistical data of each key feature within a fixed time window to obtain a window statistical feature.

[0008] In some embodiments, performing feature correlation screening on the original linear features to obtain the first linear features comprises the following steps: Calculating feature correlations between all feature pairs in the original linear features; When the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, calculating the missing value ratio of each feature pair; Remove the feature with the smaller missing value ratio in the feature pair; Return to the step of calculating the missing value ratio of each feature pair when the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, until all the original linear features are processed and the first linear feature is obtained.

[0009] In some embodiments, the step of identifying the charging mode, user behavior mode, and abnormal usage mode of the charging pile according to the first linear feature comprises the following steps: Analyzing the historical translation features and window statistical features in the first linear features through a pre-trained target pattern recognition sub-model to obtain a charging mode; For each user, analyzing the window statistical features in the first linear features by using the target pattern recognition sub-model to obtain a user behavior pattern of each user; The target pattern recognition sub-model is used to analyze the differential features in the first linear features to obtain an abnormal usage pattern.

[0010] In some embodiments, the classifying the open charging point protocol communication data based on the charging mode, the user behavior pattern and the abnormal usage pattern to obtain abnormal data detection results of the charging pile network includes the following steps: taking the charging pattern, the user behavior pattern and the abnormal usage pattern as nonlinear features; The decision function is used to calculate the distance from the data point in the nonlinear feature to the decision boundary to obtain an output value; Performing a threshold judgment on the abnormality of the output value to obtain a judgment result; The label of the data point is output according to the judgment result to obtain the abnormal data detection result of the charging pile network.

[0011] In some embodiments, the method further includes constructing and training the target pattern recognition sub-model, specifically comprising the following steps: Constructing an initial pattern recognition sub-model including an input layer, a plurality of hidden layers and an output layer; wherein the number of neurons in the input layer is configured as a first number of input features; the number of neurons in the output layer is configured as a second number of output features; and the number of neurons in the hidden layer is configured as between the first number and the second number; Acquire the open charging point protocol communication data of the charging pile network under normal operation and abnormal operation, and obtain normal state data and abnormal state data; Performing data preprocessing on the normal state data and the abnormal state data, and generating a training data set; The initial pattern recognition sub-model is trained based on the training data set to obtain a target pattern recognition sub-model.

[0012] In some embodiments, the method further comprises the following steps: Extracting abnormal behaviors and abnormal times according to the abnormal data detection results of the charging pile network; Organizing the abnormal behavior and the abnormal time into an abnormal report; The exception report is sent to management personnel.

[0013] To achieve the above purpose, another aspect of the embodiment of the present application provides a charging pile network abnormal data detection system, the system comprising: The first module is used to obtain the open charging point protocol communication data of the charging pile network to obtain the communication data to be detected; The second module is used to perform data preprocessing on the communication data to be detected to obtain first communication data; A third module is used to extract a timestamp, a charging number, a charging amount and a charging duration from the first communication data; A fourth module is used to determine the original linear features of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration; wherein the original linear features include historical translation features, differential features and window statistical features; A fifth module is used to perform feature correlation screening on the original linear features to obtain a first linear feature; A sixth module, configured to identify a charging mode, a user behavior mode, and an abnormal usage mode of a charging pile according to the first linear feature; The seventh module is used to classify the open charging point protocol communication data based on the charging mode, the user behavior pattern and the abnormal use pattern to obtain abnormal data detection results of the charging pile network.

[0014] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the above-mentioned method when executing the computer program.

[0015] To achieve the above objective, another aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0016] The embodiments of the present application include at least the following beneficial effects: The present application provides a charging pile network abnormal data detection method, system and electronic device. The scheme obtains the open charging point protocol communication data of the charging pile network and pre-processes the data to filter out random noise in the data, improve data quality, and help improve the accuracy of subsequent identification processing; extracts timestamps, charging times, charging amounts and charging durations from the pre-processed data, and determines the historical translation features, differential features and window statistical features of the open charging point protocol communication data based on the extracted features, so as to integrate information of massive data, extract useful features, and then identify the charging mode, user behavior pattern and abnormal usage pattern of the charging pile based on these features, and then classify the open charging point protocol communication data based on the identified patterns, so as to obtain the final abnormal data detection results of the charging pile network more accurately and improve the overall safety and reliability of the charging pile network. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings are used to provide further understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0018] Figure 1 It is a schematic diagram of an implementation environment provided by an embodiment of the present application; Figure 2 It is a flow chart of a charging pile network abnormal data detection method provided by an embodiment of the present application; Figure 3 It is a workflow diagram of the target pattern recognition sub-model provided in the embodiment of the present application; Figure 4 It is a SVM workflow diagram provided in an embodiment of the present application; Figure 5 This is an application flow chart of the charging pile network abnormal data detection method provided in the embodiment of the present application; Figure 6 It is a module schematic diagram of a charging pile network abnormal data detection system provided in an embodiment of the present application; Figure 7 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0020] Although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first / S100", "second / S200", etc. in the specification, claims and the above drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0021] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0022] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0023] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0025] It is understandable that the charging pile network abnormal data detection method provided in the embodiment of the present invention can be applied to any computer device with data processing and computing capabilities, and this computer device can be various terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, the terminal is a smart phone, tablet computer, laptop computer, desktop computer, etc., but is not limited to this.

[0026] like Figure 1 FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention. Figure 1The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to a network wirelessly or wired to complete data transmission and exchange.

[0027] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0028] In addition, the server 101 can also be a node server in the blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0029] The terminal 102 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal 102 and the server 101 may be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present invention.

[0030] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides a lateral velocity analysis and mapping method. The following is explained using the lateral velocity analysis and mapping method applied to the server 101 as an example. It can be understood that the lateral velocity analysis and mapping method can also be applied to the terminal 102.

[0031] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0032] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0033] Before describing the embodiments of the present application in detail, some nouns and terms involved in the embodiments of the present application are first described. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0034] Charging pile network: The charging pile network is an infrastructure system that provides charging services for new energy vehicles. It is mainly composed of charging piles, charging stations, management platforms, payment systems and other related supporting facilities. During the use of the charging pile network, abnormal data may be generated due to attacks or charging pile failures. These abnormal data reflect potential security threats.

[0035] OCPP: The full name is Open Charge Point Protocol. In the field of new energy vehicles, it is usually used for communication between charging stations and the central management system of charging stations. OCPP2.0 has become a crucial communication standard, especially in achieving intelligent charging management and cross-platform interoperability.

[0036] Precision: The probability that a sample is actually positive among all samples predicted to be positive.

[0037] Recall: The probability of being predicted as a positive sample among the samples that are actually positive.

[0038] F1 score: The harmonic mean of precision and recall, used to measure the overall performance of the model.

[0039] In related technologies, traditional security measures often rely on static rules and signatures, which are difficult to cope with rapidly changing attack methods and complex network environments, resulting in insufficient timeliness in identifying and responding to abnormal data. In addition, existing solutions often lack effective automated analysis capabilities when processing large amounts of OCPP data, making it difficult to accurately identify potential security threats from massive amounts of data.

[0040] In view of this, a method, system and electronic device for detecting abnormal data in a charging pile network are provided in an embodiment of the present application. The scheme obtains the open charging point protocol communication data of the charging pile network and preprocesses the data, thereby filtering out random noise in the data, improving data quality, and facilitating improving the accuracy of subsequent identification processing; extracts timestamps, charging times, charging amounts and charging durations from the preprocessed data, determines historical translation features, differential features and window statistical features of the open charging point protocol communication data based on the extracted features, and can integrate information on massive amounts of data, extract useful features, and then identify the charging mode, user behavior pattern and abnormal usage pattern of the charging pile based on these features, and then classifies the open charging point protocol communication data based on the identified patterns, so as to more accurately obtain the final abnormal data detection results of the charging pile network and improve the overall safety and reliability of the charging piles.

[0041] Figure 2 is an optional flowchart of a charging pile network abnormal data detection method provided in an embodiment of the present application, Figure 2 The method may include but is not limited to steps S100 to S700.

[0042] Step S100, acquiring the open charging point protocol communication data of the charging pile network to obtain the communication data to be detected.

[0043] Specifically, the OCPP communication data between the charging pile and the central management system is captured, that is, the open charging point protocol communication data, which includes various OCPP messages, such as Authorize.req (authorization request), BootNotification.req (boot notification request), etc. These messages contain key features such as message type, parameter value, timestamp, etc., which are helpful for the subsequent analysis of the data characteristics of the charging pile network operation.

[0044] Step S200: performing data preprocessing on the communication data to be detected to obtain first communication data.

[0045] Furthermore, OCPP communication data usually contains structured messages, which may be affected by pulse noise during transmission, generating random noise. These random noises usually appear as random fluctuations or abnormal signals in the data, which will interfere with the real signal of the data and affect the accuracy of subsequent analysis. Therefore, after obtaining the communication data to be detected, the present application performs data preprocessing on the communication data to be detected. Specifically, median filtering is used to perform denoising on the communication data to be detected to obtain the second communication data. The specific process of the above denoising process is: first, a window size is preset. , for each data sampling point in the window , calculate the median value in its neighborhood , the calculation formula is as follows: ; Calculated using Replace the original data sampling points After each data point is processed, the second communication data is obtained.

[0046] In the preprocessing step, the second communication data needs to be normalized to obtain the first communication data so that all features are in the same dimension for easy model processing. Furthermore, the Min-Max normalization method can be used for normalization to scale the data to the [0,1] interval. The calculation formula is: .

[0047] in, is the normalized first communication data.

[0048] Step S300: extracting a timestamp, charging times, charging amount and charging duration from the first communication data.

[0049] In some embodiments, based on the timestamp, parameter value, message type and other contents contained in the first communication data, key features such as the timestamp, charging times, charging amount and charging duration of certain charging piles or all charging piles in the charging pile network during use can be extracted for subsequent analysis of the original linear characteristics of the charging piles.

[0050] Step S400, determining original linear features of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration; wherein the original linear features include historical translation features, differential features and window statistical features.

[0051] In an embodiment of the present application, based on key features such as timestamp, number of charges, charge amount and charging duration, original linear features such as historical translation features, differential features and window statistical features are extracted, which is conducive to the learning and prediction of the machine learning model, thereby improving the accuracy and efficiency of abnormal data detection in the charging pile network.

[0052] Specifically, the following steps are included: ①~③: ① Calculate the change of each key feature within the preset window to obtain the historical translation feature of each key feature.

[0053] For each key feature, historical translation features are obtained through past values ​​and current values. These features can help the model understand the changes in charging pile usage patterns over time.

[0054] In this step, the key features such as timestamp, charging times, charging amount, and charging duration in the OCPP communication data are used as data sources to calculate the change amount of each key feature within the time window T. Taking the charging times as an example, if T is 1 hour, the difference between the charging times in the past hour and the current time is calculated. Furthermore, the calculation process of the historical translation feature is: set up For the current moment The eigenvalue of a key feature, for The characteristic value of the key feature before time units, then the historical translation characteristic of the key feature It can be calculated as: ; in, can be any set time window length, for example, if If it is set to 1 hour, It represents the change of the characteristic value within 1 hour, that is, the historical translation feature.

[0055] ② Calculate the difference of continuous values ​​of each key feature to obtain the differential feature of each key feature.

[0056] For each key feature, the differential features of each key feature are extracted by calculating the difference between its consecutive observations. These features help capture sudden changes in the usage pattern of the charging pile, which may be signs of normal changes or abnormal behavior. For example, it can be the time difference between two charging requests, or the difference between two consecutive charging amounts.

[0057] For two consecutive observations and , differential features It can be calculated as: ; All key features are calculated to obtain a second feature vector representing a sudden change in the charging pile usage pattern. This second feature vector, as a differential feature, helps capture abnormal behavior.

[0058] ③ Calculate the statistical data of each key feature within a fixed time window to obtain the window statistical features.

[0059] By performing statistical analysis on the data of each key feature within a fixed time window, window statistical features are extracted, which can help the model understand the usage trend of charging piles within a specific time period. For example, for the number of charging times, it can be the average number of charging times, the maximum number of charging times, or the standard deviation of the number of charging times within a specific time period.

[0060] Taking the number of charging times as an example, For time window The average number of charging times is The calculation formula is: ; In the time window Maximum number of charging times for: ; In the time window Within, the standard deviation of the number of charging times The calculation formula is: ; Where n represents the time window The number of observations of the key feature within the window. The average number of charging times, maximum number of charging times, standard deviation of charging times, etc. can all be used as window statistical features.

[0061] Step S500: performing feature correlation screening on the original linear features to obtain first linear features.

[0062] In fact, the results extracted by different feature extraction methods are usually different, and each method has its own unique focus and calculation method. The historical shift feature focuses on the trend of changes in the time series, and reveals the usage pattern of charging piles by comparing data at different time points; the differential feature focuses on the difference between consecutive observations, which is used to capture mutations or anomalies; the window statistical feature focuses on the statistical characteristics within a certain time window, such as the average, maximum value, standard deviation, etc.

[0063] These methods extract information from different perspectives, so the resulting feature vectors differ in nature and purpose. Extracting these original linear features can capture the characteristics of the data in different dimensions, improve the generalization ability and prediction accuracy of the model, but there may be problems with feature redundancy. This application uses the Pearson correlation coefficient to measure the correlation between features, removes highly correlated features to reduce redundancy between features, and completes feature screening, so that useful original linear features can be better extracted when performing original linear feature extraction. Specifically, the calculation formula for the Pearson correlation coefficient is as follows: ; in, Is the key feature and key features The Pearson correlation coefficient between them ranges from [-1,1]; and The key features are and key features No. observations; and The key features are and Features The average value of is the number of observations.

[0064] when When , it means that the two features are completely positively correlated; when When , it means that the two features are completely negatively correlated; when , it indicates that there is no linear relationship between the two key features.

[0065] When selecting features, you can set a threshold (such as 0.8 or 0.9). If the correlation coefficient between two features exceeds this threshold, calculate the missing value ratio of each of the two features and select the feature with fewer missing values ​​to remove in order to reduce the redundancy between features. The missing value ratio p can be calculated by the following formula: ; in, represents the proportion of missing values; Indicates the number of missing values; Indicates the number of total data points.

[0066] When feature screening is completed for all features in the original linear features, the remaining features constitute the first linear features.

[0067] Step S600: Identify the charging mode, user behavior pattern and abnormal usage pattern of the charging pile according to the first linear feature.

[0068] Specifically, the charging mode, user behavior mode and abnormal usage mode of the embodiment of the present application can be generally referred to as nonlinear features. Nonlinear features generally refer to those features that cannot be described by simple linear relationships. In OCPP communication data, nonlinear features may involve complex patterns and relationships in the data. These patterns and relationships are not simple linear combinations, but can be obtained through multi-level abstraction and transformation of data.

[0069] For OCPP communication data, the above nonlinear characteristics may change due to attacks or malicious behaviors on the charging pile network, so identifying them can determine the abnormal data and abnormal behaviors that may exist in the charging pile network. The various nonlinear characteristics proposed in this application are introduced as follows: Charging mode: By analyzing historical translation features and window statistical features, the embodiment of the present application constructs a neural network to analyze historical translation features and window statistical features to identify charging time period patterns, such as "nighttime charging" or "peak hour charging". This pattern may be related to the user's charging habits and the load of the power grid. It is nonlinear because it involves complex interactions of time series data. The embodiment of the present application assists in identifying abnormal behavior of charging piles by analyzing and identifying charging patterns.

[0070] For example, if a charging pile suddenly receives a large number of new charging requests during non-peak hours, the charging pile may have abnormal operating behavior or a fault; if the charging frequency of a charging pile suddenly increases in a short period of time, the charging pile may have abnormal operating behavior or a fault, such as the charging pile being maliciously occupied.

[0071] User behavior patterns: By analyzing the window statistics and the user identification field (user_id) in the communication data, the charging behavior pattern of each user can be inferred. For example, some users may prefer to charge quickly when the battery is low, while others may prefer to charge slowly. These user behavior patterns may be related to the user's daily activities and charging needs. Due to the complexity of each user's behavior, they are nonlinear. By analyzing and identifying these user behavior patterns, abnormal data and abnormal behavior of charging piles can be identified.

[0072] For example, if a user's behavior suddenly changes, such as changing from slow charging to fast charging, this may indicate that the charging pile has abnormal data or abnormal behavior; if a user frequently charges during abnormal time periods (such as late at night), it may indicate abnormal behavior or that the charging pile is being used maliciously.

[0073] Abnormal usage patterns: By analyzing the differential features, it is possible to identify the usage patterns of charging piles. For example, a charging pile may be used abnormally frequently in a specific time period, which may indicate abnormal behavior or failure. Due to the statistical characteristics of the charging pile usage data and the anomaly detection algorithm involved, this pattern is nonlinear.

[0074] These nonlinear features are different from the original linear features (i.e., simple statistics, such as average, maximum, minimum, etc.), and they need to be extracted through complex data processing. The embodiment of the present application automatically learns and extracts these nonlinear features from a large amount of data by constructing and training a target pattern recognition sub-model based on a neural network, without the need for manual intervention to define feature extraction rules. Through training, the target pattern recognition sub-model can recognize these complex patterns mentioned above.

[0075] The target pattern recognition sub-model can analyze the historical translation features, window statistical features and differential features based on the input raw data, and then preliminarily classify the above patterns based on these features. The process of the target recognition sub-model recognizing the above patterns includes the following steps ④~⑥: ④ Analyze the historical translation features and window statistical features in the first linear feature through the pre-trained target pattern recognition sub-model to obtain the charging mode.

[0076] ⑤ For each user, the window statistical features in the first linear feature are analyzed through the target pattern recognition sub-model to obtain the user behavior pattern of each user.

[0077] ⑥ Analyze the differential features in the first linear features through the target pattern recognition sub-model to obtain the abnormal usage pattern.

[0078] In some embodiments, the target pattern recognition sub-model proposed in the embodiments of the present application needs to be constructed, and the hyperparameters of the model are adjusted through model training to optimize the model performance. The specific steps are as follows: (1) Construct an initial pattern recognition sub-model consisting of an input layer, several hidden layers and an output layer.

[0079] like Figure 3 As shown, in the input layer, raw data such as charging times, charging amount, charging duration, etc. are received.

[0080] The hidden layer includes a convolution layer, an activation function and a pooling layer. The convolution layer of the embodiment of the present application convolves the input data through a convolution kernel to extract local features. The convolution formula is: ; Among them, x is the input data, k is the convolution kernel, a and b are the sizes of the convolution kernel, c is the bias term, and y is the output feature map.

[0081] A nonlinear activation function, such as ReLU, is applied after the convolutional layer to introduce nonlinear features. The ReLU function is defined as: ; That is, if the input is less than 0, the output is 0, otherwise the input value is output.

[0082] The pooling layer is used to reduce the spatial dimension of the feature map, reduce the amount of calculation and the number of parameters, while retaining the most important feature information. The pooling operations include maximum pooling and average pooling. Maximum pooling selects the maximum value in the area, while average pooling calculates the average value in the area.

[0083] In the output layer, the extracted features are processed through the fully connected layer to generate the final prediction output. The output formula of the fully connected layer is: ; in, is the weight matrix, is the input feature vector, is the bias vector.

[0084] (2) After the construction is completed, the initial pattern recognition sub-model needs to be initialized. The number of neurons in the input layer is configured to be the first number of input features; the number of neurons in the output layer is configured to be the second number of output features; and the number of neurons in the hidden layer is configured to be between the first number and the second number.

[0085] He initialization is used to initialize the weights in the model. He initialization is a weight initialization method designed for the ReLU activation function, which aims to maintain the variance of the activation value and gradient during forward and backward propagation in the deep network. For each weight matrix , initialized with He, the expression is: ; in, It means the mean , the variance is The normal distribution of is the number of neurons in the previous layer.

[0086] For each bias vector , initialized to zero, that is .

[0087] Select the cross entropy loss function and SGD optimizer for loss value calculation and model optimization.

[0088] (3) Obtain the open charging point protocol communication data of the charging pile network under normal operation and abnormal operation, and obtain normal state data and abnormal state data.

[0089] Abnormal operation means that the charging pile network is attacked or has abnormal failures. At this time, the OCPP data may include tampered messages or non-standard messages. In actual operation, you can use a protocol analyzer, emulator or dedicated charging pile test software to simulate the sending of various messages specified in the standard protocol to check the reception, parsing and response of the charging pile. If the charging pile's response to certain messages does not comply with the standard protocol, these messages may be non-standard or tampered. Normal status data refers to the OCPP data of the charging pile network under normal operation. The collected data can be used to train the model.

[0090] (4) Preprocess the normal state data and abnormal state data and generate a training data set; Both the normal state data and the abnormal state data are processed using the data preprocessing method of step S200 to generate a training data set.

[0091] (5) Based on the training data set, the initial pattern recognition sub-model is trained to obtain the target pattern recognition sub-model.

[0092] When training a model using training set data, the key is to optimize the performance of the model by adjusting hyperparameters, including learning rate, batch size, number and size of network layers, selection of activation function, etc. During the training process, cross-validation can be used to evaluate the effects of different hyperparameter combinations, and the optimal hyperparameter combination can be found through methods such as grid search or random search. At the same time, in order to prevent overfitting, regularization techniques such as L1 or L2 regularization and dropout mechanism can be introduced. Through these adjustments, the model can improve its ability to recognize abnormal patterns while learning the normal behavior patterns of the charging pile network, thereby improving the recognition accuracy of the target pattern recognition sub-model.

[0093] Step S700, based on the charging mode, user behavior pattern and abnormal usage pattern, the open charging point protocol communication data is classified to obtain the abnormal data detection result of the charging pile network.

[0094] Support vector machine (SVM) can be used to make classification decisions in this step, which can find the optimal decision boundary in a higher-dimensional feature control, so as to more accurately determine whether the OCPP communication data is abnormal.

[0095] Specifically, the charging mode, user behavior pattern and abnormal usage pattern are used as nonlinear features, and a decision function is used to calculate the distance from the data point to the decision boundary in the nonlinear feature to obtain the output value; a threshold judgment is performed on the abnormal situation of the output value to obtain the judgment result, and the label of the data point is output according to the judgment result to obtain the abnormal data detection result of the charging pile network.

[0096] The formula of the decision function is: ; in, is the Lagrange multiplier; is the label of the training data; is the kernel function; is the bias term.

[0097] like Figure 4 As shown, according to the output value of the decision function, it is judged whether the data point is abnormal. If the output value is less than a certain threshold (for example, 0), the data point is considered to be abnormal.

[0098] When classifying new data points, the model will output the label of each data point based on the result of the threshold judgment. For example, the label 1 indicates normal and -1 indicates abnormal.

[0099] Before applying SVM, the SVM model needs to be initialized and trained.

[0100] During initialization, for the OCPP communication function, the radial basis function (RBF) can be selected as the initial kernel function. The formula of the RBF kernel function is: ; in, is the coefficient of the kernel function, which controls the influence range of a single training sample.

[0101] When initializing the parameter settings, the penalty coefficient is initialized to 1.0 to balance the classification interval margin and the penalty for misclassified samples; the RBF kernel function is initially set to ,in, is the number of features; the outlier ratio is initialized to 0.1, indicating the expected outlier ratio. This parameter also affects the decision boundary of the model.

[0102] During the training process of SVM, the parameters can be adjusted and kernel parameters To optimize the performance of the model. Controls the model's sensitivity to abnormal data. The value will make the model more rigorous in identifying abnormal data. A value of 0 makes the model more tolerant. Affects the complexity of the model in the feature space. The value will make the model pay more attention to the local characteristics of the data, while a smaller A higher value will cause the model to focus more on the overall trend of the data.

[0103] In steps S100 to S700 of the embodiment of the present application, by extracting the original linear features in the OCPP communication data, and then identifying nonlinear features such as charging mode, user behavior pattern and abnormal usage pattern, and then making classification decisions, it is possible to better utilize massive data for more accurate abnormal data detection. Furthermore, the nonlinear features extracted by the neural network provide richer information for the SVM, enabling the SVM to make more sophisticated and accurate classification decisions. This method of combining the neural network feature extraction capability and the SVM classification performance further improves the efficiency of the entire anomaly detection system.

[0104] In some embodiments, the present application also includes the following: During the model training process, an independent test set is used to evaluate the individual performance of the model, and indicators such as precision, recall, and F1 score are calculated. This can comprehensively evaluate the performance of the model and then optimize it to ensure that the model has good generalization capabilities.

[0105] like Figure 5 As shown, we study the cases and analyze the errors: We select some specific OCPP communication data cases, analyze the prediction results of the model, and see which types of messages the model performs well on and which types of messages it misjudges. For cases where the model predicts errors, we analyze the reasons in depth to see whether they are caused by insufficient feature extraction, insufficient model training, or the complexity of the OCPP message itself, and further optimize the model.

[0106] Real-time monitoring and feedback: Deploy the model in the actual environment, monitor OCPP message data in real time, evaluate the performance of the model in actual applications, and collect feedback based on the real-time monitoring results to continuously adjust and optimize the model.

[0107] Through real-time monitoring and automated analysis of abnormal data and messages during the operation of charging piles through the model, abnormal behaviors are identified, such as specific OCPP message tampering or specific attack time periods, which are compiled into abnormal reports and distributed to relevant security teams and management, thereby realizing automated abnormal data detection for the charging pile network.

[0108] Below, in conjunction with a specific application example of a charging pile network abnormal data detection scenario, the solution of the embodiment of the present application is described in detail and explained: In an embodiment of the present application, a charging pile network abnormal data detection method is provided, which can be applied to detect abnormal data of a charging pile network, and further, can be implemented as follows: OCPP protocol communication data is collected, and the collected data is preprocessed by denoising and normalizing to obtain first communication data. Feature extraction is then performed on the first communication data to extract timestamp, number of charging times, charging amount, charging duration, etc. A machine learning model (target pattern recognition sub-model) as described in step S600 is constructed and trained to extract nonlinear features and identify the charging mode, user behavior pattern, and abnormal usage pattern of the charging pile during use; and then a SVM model as described in step S700 is constructed to make classification decisions on nonlinear features to achieve abnormal data detection.

[0109] In actual applications, the model is continuously adjusted and optimized by analyzing the feedback from the actual operation of the model to ensure its accuracy. In addition, during real-time monitoring, the abnormal data and messages of the charging pile operation process are automatically analyzed to identify abnormal behaviors and their time periods, compile them into reports, and distribute them to the security team and management.

[0110] In summary, the embodiments of the present application at least include the following beneficial effects: (1) By extracting the original linear features in the OCPP communication data, nonlinear features such as charging patterns, user behavior patterns, and abnormal usage patterns can be identified, and classification decisions can be made. This can better utilize massive data for more accurate abnormal data detection.

[0111] (2) The nonlinear features extracted by the neural network provide richer information for the SVM, enabling the SVM to make more sophisticated and accurate classification decisions. This method, which combines the feature extraction capabilities of the neural network with the classification performance of the SVM, can more accurately identify abnormal data in the charging pile network, further improving the effectiveness of the entire anomaly detection system.

[0112] (3) Real-time monitoring and feedback mechanism to ensure that the performance of the model in actual applications can be evaluated and optimized in a timely manner. By real-time monitoring of OCPP message data, the model can identify abnormal behavior in a timely manner and make adjustments based on feedback.

[0113] (4) This application automatically analyzes abnormal data and messages during the operation of charging piles, identifies abnormal behaviors and their time periods, and compiles them into reports, which is conducive to coping with rapidly changing attack methods and complex network environments, and responding to the identification of abnormal data in a timely manner.

[0114] See also Figure 6 The embodiment of the present application also provides a charging pile network abnormal data detection system, which can implement the above-mentioned charging pile network abnormal data detection method, and the system includes: The first module 201 is used to obtain the open charging point protocol communication data of the charging pile network to obtain the communication data to be detected; The second module 202 is used to perform data preprocessing on the communication data to be detected to obtain first communication data; The third module 203 is used to extract the timestamp, charging times, charging amount and charging duration from the first communication data; The fourth module 204 is used to determine the original linear features of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration; wherein the original linear features include historical translation features, differential features and window statistical features; The fifth module 205 is used to perform feature correlation screening on the original linear features to obtain first linear features; The sixth module 206 is used to identify the charging mode, user behavior mode and abnormal usage mode of the charging pile according to the first linear feature; The seventh module 207 is used to classify the open charging point protocol communication data based on the charging mode, the user behavior pattern and the abnormal use pattern to obtain abnormal data detection results of the charging pile network.

[0115] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0116] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned charging pile network abnormal data detection method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0117] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0118] See also Figure 7 , Figure 7 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes: The processor 301 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application; The memory 302 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 302 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 302, and the processor 301 calls and executes the above method; Input / output interface 303, used to implement information input and output; Communication interface 304, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.); A bus 305 that transmits information between the various components of the device (e.g., the processor 301, the memory 302, the input / output interface 303, and the communication interface 304); The processor 301 , the memory 302 , the input / output interface 303 and the communication interface 304 are connected to each other in communication within the device via the bus 305 .

[0119] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, and the computer program implements the above method when executed by a processor.

[0120] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0121] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0122] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0123] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0124] The system embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0125] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0126] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0127] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0128] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0129] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0130] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0131] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0132] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A charging pile network abnormal data detection method, characterized in that: The following steps are involved: Obtaining the open charging point protocol communication data of the charging pile network to obtain the communication data to be detected; Performing data preprocessing on the communication data to be detected to obtain first communication data; extracting a timestamp, a charging number, a charging amount, and a charging duration from the first communication data; Determine the original linear features of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration; wherein the original linear features include historical translation features, differential features and window statistical features; Performing feature correlation screening on the original linear feature to obtain a first linear feature; According to the first linear feature, identifying the charging mode, user behavior pattern and abnormal usage pattern of the charging pile; Based on the charging mode, the user behavior pattern and the abnormal usage pattern, the open charging point protocol communication data is classified to obtain an abnormal data detection result of the charging pile network.

2. The method according to claim 1, characterized in that: The step of performing data preprocessing on the communication data to be detected to obtain first communication data comprises the following steps: Using median filtering to perform denoising on the communication data to be detected to obtain second communication data; The second communication data is normalized to obtain first communication data.

3. The method according to claim 1, characterized in that The determining of the original linear characteristics of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration comprises the following steps: using the timestamp, the number of charging times, the charging amount and the charging duration as key features; Calculating the change amount of each key feature within a preset window to obtain a historical translation feature of each key feature; Calculating the difference of the continuous values ​​of each of the key features to obtain the differential feature of each of the key features; Calculate the statistical data of each key feature within a fixed time window to obtain a window statistical feature.

4. The method according to claim 1, characterized in that The step of performing feature correlation screening on the original linear features to obtain the first linear features comprises the following steps: Calculating feature correlations between all feature pairs in the original linear features; When the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, calculating the missing value ratio of each feature pair; Remove the feature with the smaller missing value ratio in the feature pair; Return to the step of calculating the missing value ratio of each feature pair when the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, until all the original linear features are processed and the first linear feature is obtained.

5. The method according to claim 1, characterized in that The step of identifying the charging mode, user behavior mode, and abnormal usage mode of the charging pile according to the first linear feature comprises the following steps: Analyzing the historical translation features and window statistical features in the first linear features through a pre-trained target pattern recognition sub-model to obtain a charging mode; For each user, analyzing the window statistical features in the first linear features by using the target pattern recognition sub-model to obtain a user behavior pattern of each user; The target pattern recognition sub-model is used to analyze the differential features in the first linear features to obtain an abnormal usage pattern.

6. The method according to claim 1, characterized in that The method of classifying the open charging point protocol communication data based on the charging mode, the user behavior mode and the abnormal usage mode to obtain abnormal data detection results of the charging pile network includes the following steps: taking the charging pattern, the user behavior pattern and the abnormal usage pattern as nonlinear features; The decision function is used to calculate the distance from the data point in the nonlinear feature to the decision boundary to obtain an output value; Performing a threshold judgment on the abnormality of the output value to obtain a judgment result; The label of the data point is output according to the judgment result to obtain the abnormal data detection result of the charging pile network.

7. The method according to claim 4, characterized in that The method further includes constructing and training the target pattern recognition sub-model, specifically comprising the following steps: Constructing an initial pattern recognition sub-model including an input layer, a plurality of hidden layers and an output layer; wherein the number of neurons in the input layer is configured as a first number of input features; the number of neurons in the output layer is configured as a second number of output features; and the number of neurons in the hidden layer is configured as between the first number and the second number; Acquire the open charging point protocol communication data of the charging pile network under normal operation and abnormal operation, and obtain normal state data and abnormal state data; Performing data preprocessing on the normal state data and the abnormal state data, and generating a training data set; The initial pattern recognition sub-model is trained based on the training data set to obtain a target pattern recognition sub-model.

8. The method according to claim 1, characterized in that: The method further comprises the following steps: Extracting abnormal behaviors and abnormal times according to the abnormal data detection results of the charging pile network; Organizing the abnormal behavior and the abnormal time into an abnormal report; The exception report is sent to management personnel.

9. A charging pile network abnormal data detection system, characterized in that: include: The first module is used to obtain the open charging point protocol communication data of the charging pile network to obtain the communication data to be detected; The second module is used to perform data preprocessing on the communication data to be detected to obtain first communication data; A third module is used to extract a timestamp, a charging number, a charging amount and a charging duration from the first communication data; A fourth module is used to determine the original linear features of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration; wherein the original linear features include historical translation features, differential features and window statistical features; A fifth module is used to perform feature correlation screening on the original linear features to obtain a first linear feature; A sixth module, configured to identify a charging mode, a user behavior mode, and an abnormal usage mode of a charging pile according to the first linear feature; The seventh module is used to classify the open charging point protocol communication data based on the charging mode, the user behavior pattern and the abnormal usage pattern to obtain abnormal data detection results of the charging pile network.

10. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 8.

Images