Message detection method, device and equipment based on large model and readable storage medium

Abstract

A message detection method, device and equipment based on a large model and a readable storage medium relate to the field of automobile network and data analysis, and comprise the following steps: performing format conversion on analyzed SOME / IP message information corresponding to each target SOME / IP message to obtain a structured format text comprising message contents, timestamps, service IDs and method IDs corresponding to the target SOME / IP messages; based on the SOME / IP protocol matrix table, the relationship between the ECUs, the corresponding relationship between the client and the server and all services between each pair of client and server, analyzing the structured format text to generate a target relationship table; determining target message change data according to the target relation table; and inputting the target message change data and a preset exception check rule into a preset large language model for message detection so as to output a target detection result. According to the invention, the dependence on expert experience can be reduced, and the detection efficiency can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of automobile network and data analysis technology, and specifically to a message detection method, device, equipment and readable storage medium based on a large model. Background Art

[0002] SOME / IP (Scalable service-oriented MiddlewarE over IP) is a communication protocol for automotive embedded systems, which is widely used in vehicle networks. As the complexity of automotive electronic systems continues to increase, efficient analysis and detection of SOME / IP messages has become increasingly important.

[0003] In the related art, SOME / IP message analysis and detection mainly relies on expert experience to consult the protocol specifications for frame-by-frame comparison to detect the correctness of SOME / IP message sending; however, its technical and knowledge thresholds are too high, that is, personnel with professional knowledge background need to study the SOME / IP protocol for a long time to master the specific mechanism to analyze and detect the correctness of someip message sending, and because it is necessary to manually consult the protocol specifications for frame-by-frame analysis and comparison, the analysis and detection efficiency of SOME / IP messages is too low.

[0004] It can be seen that how to reduce the dependence on expert experience and improve the efficiency of message detection is an urgent problem that needs to be solved. Summary of the invention

[0005] The present application provides a large model-based message detection method, device, equipment and readable storage medium, which can solve the technical problems existing in the prior art of high reliance on expert experience and low detection efficiency caused by manual implementation of SOME / IP message detection.

[0006] In a first aspect, an embodiment of the present application provides a message detection method based on a large model, comprising the following steps:

[0007] Performing format conversion on the parsed SOME / IP message information corresponding to each target SOME / IP message to obtain a structured format text, wherein the structured format text includes message content, a timestamp, a service ID, and a method ID corresponding to each target SOME / IP message;

[0008] Parsing the structured format text based on a preset SOME / IP protocol matrix table, preset relationships between electronic control units ECU, preset corresponding relationships between clients and servers, and all services between each pair of clients and servers to generate a target relationship table, wherein the target relationship table includes a mapping relationship between a server, a client, a service ID, and a method ID corresponding to each target SOME / IP message;

[0009] Determine target message change data according to the target relationship table;

[0010] The target message change data and the preset anomaly detection rules are input into the preset large language model for message detection to output the target detection results.

[0011] In combination with the first aspect, in one implementation, determining the target message change data according to the target relationship table includes:

[0012] For each mapping relationship in the target relationship table, determine the corresponding target message ID based on the service ID and method ID;

[0013] The message content and timestamp corresponding to each mapping relationship with the same target message ID are compared to determine the target message change data.

[0014] In combination with the first aspect, in one implementation, the inputting the target message change data and the preset anomaly detection rule into the preset large language model LLM for message detection to output the target detection result includes:

[0015] The target message change data and the anomaly detection rule are input into the large language model so that the large language model generates an anomaly detection function based on the anomaly detection rule, and performs message detection on the target message change data according to the anomaly detection function to obtain a target detection result.

[0016] In combination with the first aspect, in one implementation, after the step of outputting the target detection result, the method further includes:

[0017] If there are abnormal results in the target detection results, the preset SOME / IP protocol specification is retrieved through the large language model to output the target protocol specification and abnormal explanation information corresponding to the abnormal result.

[0018] In combination with the first aspect, in one implementation, the method further includes:

[0019] When receiving keyword search information input by the user, a SOME / IP message corresponding to the keyword search information is screened out from all target SOME / IP messages for output, wherein the keyword search information includes one or more of a message ID, a service ID, a method ID, a client ID and a server ID;

[0020] When non-keyword search information input by the user is received, semantic understanding of the non-keyword search information is performed based on the large language model, and all target SOME / IP messages are searched according to the semantic understanding result to output the SOME / IP message corresponding to the non-keyword search information.

[0021] In combination with the first aspect, in one implementation, before the step of formatting the parsed SOME / IP message information corresponding to each target SOME / IP message, the method further includes:

[0022] Perform data pre-cleaning on each received initial SOME / IP message to remove irrelevant messages, interrupted messages and incomplete messages to obtain multiple target SOME / IP messages;

[0023] Each target SOME / IP message is parsed based on the SOME / IP protocol parsing library to obtain parsed SOME / IP message information corresponding to each target SOME / IP message.

[0024] In a second aspect, an embodiment of the present application provides a message detection device based on a large model, including:

[0025] A format conversion module, which is used to perform format conversion on the parsed SOME / IP message information corresponding to each target SOME / IP message to obtain a structured format text, wherein the structured format text includes the message content, timestamp, service ID and method ID corresponding to each target SOME / IP message;

[0026] A relationship table construction module, which is used to parse each structured data in the structured format text based on a preset SOME / IP protocol matrix table to generate a target relationship table, wherein the target relationship table includes a mapping relationship between a server, a client, a service ID, and a method ID corresponding to each target SOME / IP message;

[0027] A data determination module, which is used to determine the target message change data according to the target relationship table;

[0028] The message detection module is used to input the target message change data and the preset anomaly detection rules into the preset large language model for message detection to output the target detection result.

[0029] In conjunction with the second aspect, in one implementation, the data determination module is specifically used to:

[0030] For each mapping relationship in the target relationship table, determine the corresponding target message ID based on the service ID and method ID;

[0031] The message content and timestamp corresponding to each mapping relationship with the same target message ID are compared to determine the target message change data.

[0032] In conjunction with the second aspect, in one implementation, the message detection module is specifically used to:

[0033] The target message change data and the anomaly detection rule are input into the large language model so that the large language model generates an anomaly detection function based on the anomaly detection rule, and performs message detection on the target message change data according to the anomaly detection function to obtain a target detection result.

[0034] In conjunction with the second aspect, in one implementation, the message detection module is further used to:

[0035] If there are abnormal results in the target detection results, the preset SOME / IP protocol specification is retrieved through the large language model to output the target protocol specification and abnormal explanation information corresponding to the abnormal result.

[0036] In conjunction with the second aspect, in one implementation, the device further includes a data retrieval module, which is used to:

[0037] When receiving keyword search information input by the user, a SOME / IP message corresponding to the keyword search information is screened out from all target SOME / IP messages for output, wherein the keyword search information includes one or more of a message ID, a service ID, a method ID, a client ID and a server ID;

[0038] When non-keyword search information input by the user is received, semantic understanding of the non-keyword search information is performed based on the large language model, and all target SOME / IP messages are searched according to the semantic understanding result to output the SOME / IP message corresponding to the non-keyword search information.

[0039] In conjunction with the second aspect, in one implementation, the device further includes a message parsing module, which is used to:

[0040] Perform data pre-cleaning on each received initial SOME / IP message to remove irrelevant messages, interrupted messages and incomplete messages to obtain multiple target SOME / IP messages;

[0041] Each target SOME / IP message is parsed based on the SOME / IP protocol parsing library to obtain parsed SOME / IP message information corresponding to each target SOME / IP message.

[0042] In the third aspect, an embodiment of the present application provides a large model-based message detection device, which includes a processor, a memory, and a large model-based message detection program stored in the memory and executable by the processor, wherein when the large model-based message detection program is executed by the processor, the steps of the large model-based message detection method as described above are implemented.

[0043] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a large model-based message detection program is stored, wherein when the large model-based message detection program is executed by a processor, the steps of the aforementioned large model-based message detection method are implemented.

[0044] The beneficial effects brought by the technical solution provided in the embodiments of the present application include:

[0045] By converting the format of the parsed SOME / IP message information corresponding to each target SOME / IP message, a structured format text including the message content, timestamp, service ID and method ID corresponding to each target SOME / IP message is obtained to provide a data basis for the processing and understanding of the large language model; the structured format text is parsed according to the SOME / IP protocol matrix table, the relationship between ECUs, the corresponding relationship between the client and the server, and all services between each pair of clients and servers to generate a target relationship table including the mapping relationship between the server, the client, the service ID and the method ID; the target message change data is determined according to the target relationship table, that is, only the updated fields in the message are filtered out for storage and message anomaly detection, which can not only provide context information for the processing and understanding of the large language model, but also reduce the data storage space; finally, the target message change data and the preset anomaly detection rules are input into the preset large language model for message detection and then the target detection result is output to realize the automatic detection of SOME / IP messages without manual detection, which can not only reduce the dependence on expert experience, but also effectively improve the detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is a flow chart of an embodiment of a message detection method based on a large model of the present application;

[0047] Figure 2 This is a functional module diagram of an embodiment of a message detection device based on a large model of the present application;

[0048] Figure 3 This is a schematic diagram of the hardware structure of a large model-based message detection device involved in the embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0051] In a first aspect, an embodiment of the present application provides a message detection method based on a large model.

[0052] In one embodiment, referring to Figure 1 , Figure 1 Schematic diagram of the flow of the embodiment of the message detection method based on the large model of this application. Figure 1 As shown, the message detection method based on the large model includes:

[0053] Step S10: performing format conversion on the parsed SOME / IP message information corresponding to each target SOME / IP message to obtain a structured format text, wherein the structured format text includes the message content, timestamp, service ID and method ID corresponding to each target SOME / IP message.

[0054] Exemplarily, it should be understood that the traditional method mainly relies on expert experience to consult the protocol specification for frame-by-frame comparative analysis to achieve anomaly detection of SOME / IP messages, which is not only highly dependent on expert experience but also has low detection efficiency. Therefore, in order to reduce the dependence on expert experience and improve the efficiency of anomaly detection of SOME / IP messages, this embodiment will use a preset large language model LLM (Large Language Model, which is a deep learning model trained with a large amount of text data so that the model can generate natural language text or understand the meaning of language text) to achieve anomaly detection of SOME / IP messages; wherein, in order to enable the LLM model to directly process and understand the SOME / IP message data, the SOME / IP message data needs to be converted into a format suitable for processing by the LLM model.

[0055] Specifically, the target SOME / IP message refers to the message that needs to be analyzed for correctness of sending, and the message is parsed to obtain the parsed SOME / IP message information; then, each parsed SOME / IP message information is formatted to obtain data in a structured format (such as JSON), and then a structured format text is formed to provide a data basis for the processing and understanding of the LLM model; it should be noted that the structured format text stores multiple formatted data, and each formatted data corresponds to a parsed SOME / IP message information, that is, each formatted data stores the message content, timestamp, service ID, method ID and other key information of the corresponding target SOME / IP message. In addition, this embodiment can also assign a unique identifier to each SOME / IP message for subsequent processing and indexing.

[0056] Furthermore, in one embodiment, before the step of converting the format of the parsed SOME / IP message information corresponding to each target SOME / IP message, the method further includes:

[0057] Perform data pre-cleaning on each received initial SOME / IP message to remove irrelevant messages, interrupted messages and incomplete messages to obtain multiple target SOME / IP messages;

[0058] Each target SOME / IP message is parsed based on the SOME / IP protocol parsing library to obtain parsed SOME / IP message information corresponding to each target SOME / IP message.

[0059] Exemplarily, in this embodiment, a dedicated vehicle network data capture device or software can be used to capture the initial SOME / IP message, for example, the Wireshark tool is preferably used to monitor the vehicle network communication in real time and save the message; then all the captured initial SOME / IP messages are pre-cleaned to preliminarily filter and remove irrelevant messages and harmful data (i.e., interrupted messages, incomplete messages, etc.) to obtain multiple target SOME / IP messages; then, a preset SOME / IP protocol parsing library is used to perform message header parsing, load parsing, checksum verification, etc. on each target SOME / IP message to obtain the parsed SOME / IP message information corresponding to each target SOME / IP message; wherein, the message header parsing can be used to identify key fields such as version, message type, service ID, method ID, client ID, session ID, etc. in the message header; load parsing refers to parsing the content of the message payload part according to the message type (such as request, response, event, etc.), which may include a parameter list, a return value, and verifying the checksum of the message; and the checksum of the message is verified by the checksum to ensure that the message is not damaged during transmission.

[0060] For example, the SOME / IP parsing library written in Python first reads the binary data of the SOME / IP message, and then gradually parses each field according to the definition of the SOME / IP protocol to obtain the parsed SOME / IP message information.

[0061] Step S20: parsing the structured format text based on a preset SOME / IP protocol matrix table, a preset relationship between electronic control units ECU, a preset correspondence between a client and a server, and all services between each pair of clients and servers to generate a target relationship table, wherein the target relationship table includes a mapping relationship between a server, a client, a service ID, and a method ID corresponding to each target SOME / IP message.

[0062] Exemplarily, in this embodiment, the SOME / IP protocol matrix table defines each service ID, method ID and its corresponding client and server relationship, and its specific design can be determined according to actual needs and is not limited here; the relationship between ECUs describes the communication relationship between different ECUs, specifically including the services and methods for interaction between them, such as ECU1 and ECU2 communicate through service 1 and method 1, and ECU1 and ECU3 communicate through service 2 and method 2; the correspondence between the client Client and the server Server refers to the interaction and dependency relationship between the Client and the Server. For example, for the pair of ECU1 and ECU2, assuming that ECU1 is the client and ECU2 is the server, ECU1 is the party that initiates the request, and ECU2 is the party that receives and processes the request, then all services between ECU1 and ECU2 include service 1.

[0063] It should be understood that only after the "translation" of the protocol file can the LLM model understand the message content. Since the captured SOME / IP message only has message information, the LLM model cannot understand the message content. Therefore, this embodiment will combine the SOME / IP protocol matrix table, the relationship between ECUs, the correspondence between Clients and Servers, and all services between each pair of Clients and Servers to parse each structured data in the structured format text to supplement the ECU name, ECU service definition and other information, and then realize the "translation" of the SOME / IP message, thereby generating a complete relationship table, that is, obtaining a target relationship table, and the target relationship table stores the mapping relationship between the server, client, service ID, and method ID corresponding to each target SOME / IP message.

[0064] Specifically, firstly, based on the SOME / IP protocol matrix table, the service ID, method ID and the corresponding client ECU and server ECU corresponding to each structured data are extracted; then, according to the relationship between ECUs, all services and methods interacting between each pair of client ECUs and server ECUs are determined; finally, the above information is organized into a target relationship table, wherein each row in the target relationship table represents a service and method relationship between a server ECU and a client ECU; for example, if the information organized according to the above method is: the service ID is 123 and its corresponding method ID is 456, and ECU1 is used as the server and ECU2 is used as the client, then there should be a row in the target relationship table to record this mapping relationship.

[0065] Step S30: Determine target message change data according to the target relationship table.

[0066] Exemplarily, it should be understood that the type of message is fixed, and only some fields of most message messages are updated, so this embodiment will greatly reduce the storage space and improve the efficiency of anomaly detection through sparse data, that is, only the updated fields in the message are screened out for storage and message anomaly detection, which can not only provide context information for the processing and understanding of the LLM model, but also reduce data storage space and improve detection efficiency.

[0067] Specifically, since the target relationship table stores the mapping relationships between the server, client, service ID, and method ID corresponding to each target SOME / IP message, the message content corresponding to the mapping relationship in the target relationship table can be compared and analyzed to determine all fields with updated changes, and then obtain the target message change data; for example, within 5 minutes, the specific value corresponding to the throttle opening field changes from 0 to 1, and the target message change data includes the throttle opening changing from 0 to 1 within 5 minutes. At the same time, the target message change data is stored in the SOME / IP message database to facilitate subsequent retrieval and analysis, and the required messages and data can be efficiently retrieved through database indexing and query optimization.

[0068] Further, in one embodiment, determining the target message change data according to the target relationship table includes:

[0069] For each mapping relationship in the target relationship table, determine the corresponding target message ID based on the service ID and method ID;

[0070] The message content and timestamp corresponding to each mapping relationship with the same target message ID are compared to determine the target message change data.

[0071] Exemplarily, it should be understood that for each pair of Client and Server, when Client1 wishes to call a method (e.g. Method1 and its method ID is 1) of a service (e.g. Service 1 and its service ID is 1) in Server1, it will generate a request message, and the message ID of the request message is composed of the service ID of Service 1 and the method ID of Method 1. For example, if the message ID is 11, then Client1 will continue to call Server1 for Service 1 and Method 1 with a request message with a message ID of 11. Therefore, this embodiment will classify the messages in combination with the service ID and the method ID to sort out the data flow corresponding to each message ID.

[0072] Specifically, in the present embodiment, for each mapping relationship in the target relationship table, the target message ID can be determined by the service ID and method ID recorded therein, and then the message contents and timestamps corresponding to all mapping relationships having the same target message ID are screened out; for example, assuming that the service ID of the target SOME / IP message 1 is 1, the method ID is 1, the message content is X, and the timestamp is T1, and the service ID of the target SOME / IP message 2 is 1, the method ID is 1, the message content is Y, and the timestamp is T2, then the target SOME / IP message 1 and the target SOME / IP message 2 have the same target message ID, then the message content X, the timestamp T1, and the message content Y and the timestamp T2 are screened out.

[0073] Next, the time difference is determined according to T2 and T1, and it is determined whether the specific values ​​of the corresponding fields in the message content X and the message content Y are the same within the time difference; for example, the message content X includes field 1 and field 2 and the message content Y also includes field 1 and field 2, then it is determined whether the specific value of field 1 in the two message contents is the same and whether the specific value of field 2 in the two message contents is the same. If they are the same, it means that there is no updated content; if field 1 is different and field 2 is the same, the change of field 2 within the time difference and its corresponding service ID, method ID, message ID and other information are used as the target message change data; at the same time, the complete FIND (discovery), OFFER (offering), SUB (subscription), NOTIFY (notification), STOP (stop) and other message changes of each message ID are recorded in chronological order, that is, the entire life cycle of the message ID from being discovered, to providing services, to being subscribed, to data update notification and to finally stopping the service is recorded.

[0074] Step S40: Input the target message change data and the preset anomaly detection rules into the preset large language model to perform message detection to output the target detection result.

[0075] For example, it should be noted that the specific architecture and implementation of the large language model LLM are common knowledge in the art, and for the sake of brevity of description, they will not be repeated here.

[0076] In this embodiment, the SOME / IP protocol stack in the AUTOSAR (Automotive Open System Architecture) protocol, company specifications, JIRA (project management tool used to track and manage various tasks and issues in the software development process) problem data, and problem review and elimination records can be collected, and an expert knowledge base can be built through retrieval enhancement generation and other technologies; then specific exception check rules can be written in combination with the expert knowledge base; for example, the value range and required items of certain fields can be defined according to the protocol specifications in the expert knowledge base, so as to generate corresponding exception check rules based on this; for another example, the specification in the expert knowledge base defines that "all SOME / IP messages including headers and payloads should be encoded in network byte order and big-endian mode", and corresponding exception check rules can be generated based on this.

[0077] The target message change data and the anomaly detection rules are input into the LLM model, so that the LLM model automatically performs message detection on the target message change data according to the anomaly detection rules and outputs the target detection result. It can be seen that this embodiment can effectively realize the automatic detection of SOME / IP messages without manual detection, which can not only reduce the dependence on expert experience, but also effectively improve the detection efficiency.

[0078] Further, in one embodiment, the target message change data and the preset anomaly detection rules are input into the preset large language model LLM for message detection to output the target detection result, including:

[0079] The target message change data and the anomaly detection rule are input into the large language model so that the large language model generates an anomaly detection function based on the anomaly detection rule, and performs message detection on the target message change data according to the anomaly detection function to obtain a target detection result.

[0080] Exemplarily, in this embodiment, after the anomaly check rules are input into the LLM model, the LLM model will convert these rules into specific anomaly detection algorithms or anomaly detection functions, and apply the converted algorithms or functions to the parsed SOME / IP message data (i.e., target message change data) for anomaly detection. For example, the anomaly check rules generated according to the specific specification defined in the SOME / IP protocol stack that "all SOME / IP messages including headers and payloads should be encoded in network byte order and big-endian mode" will be converted by the LLM model into specific Python functions (which can be called proxy tools), and the subsequent execution of the proxy tools can determine whether the message is abnormal.

[0081] At the same time, the LLM model pre-processes the target message change data to extract key field information (such as service ID, method ID, message ID, etc.), and executes the proxy tool to identify potential abnormal patterns in the message data, that is, to detect errors in the communication process to generate target detection results. Among them, abnormal patterns include invalid service calls, timeouts and no responses, repeated requests, etc.; for example, by comparing the expected communication process with the actual recorded message changes, communication errors such as timeouts and no responses, repeated requests, etc. can be detected.

[0082] Furthermore, in one embodiment, after the step of outputting the target detection result, the method further includes:

[0083] If there are abnormal results in the target detection results, the preset SOME / IP protocol specification is retrieved through the large language model to output the target protocol specification and abnormal explanation information corresponding to the abnormal result.

[0084] Exemplarily, in this embodiment, for the detected abnormal patterns and communication errors, the LLM model will dynamically retrieve the relevant SOME / IP protocol specifications and SOME / IP protocol matrix table through links, etc., to provide detailed explanations and corresponding protocol reference information. For example, LLM can find that certain services frequently have abnormal patterns of timeouts and non-responses within a specific time period by analyzing key fields such as service ID, method ID, and message ID in the message data, and provide corresponding explanations and protocol reference information.

[0085] Furthermore, in one embodiment, the method further includes:

[0086] When receiving keyword search information input by the user, a SOME / IP message corresponding to the keyword search information is screened out from all target SOME / IP messages for output, wherein the keyword search information includes one or more of a message ID, a service ID, a method ID, a client ID and a server ID;

[0087] When non-keyword search information input by the user is received, semantic understanding of the non-keyword search information is performed based on the large language model, and all target SOME / IP messages are searched according to the semantic understanding result to output the SOME / IP message corresponding to the non-keyword search information.

[0088] Exemplarily, in this embodiment, a keyword-based matching retrieval function and a semantic-based large model retrieval function will be provided; among them, based on the keyword-based matching retrieval function, the user can perform precise matching retrieval on message data based on specific service ID, method ID, client ID and other key fields, that is, the user can quickly locate the relevant message data fragments by entering specific keywords, and return the retrieval results in relevance or chronological order, so as to efficiently find the messages that need to be analyzed.

[0089] In this embodiment, the LLM technology can be used to support semantic-based retrieval functions, that is, the user does not need to provide accurate keywords, but can initiate a retrieval request through a natural language description, such as "find all messages involving timeout errors" or "display all requests initiated by a specific client". The LLM model will dynamically query and compare the SOME / IP protocol specifications and message data by deeply understanding the semantics of the user input, so as to return the message and interpretation information that best matches the user's needs.

[0090] It should be understood that, traditionally, after completing the analysis and detection of SOME / IP messages, the analysis and detection results need to be written manually, which is not only non-standard and difficult to read, but also often only communicated verbally between personnel for the sake of speed, so that technical personnel often need to re-check the SOME / IP messages to re-verify the problem, which is not conducive to the record of the problem. This embodiment will automatically generate a visual report of SOME / IP messages based on message analysis, abnormality diagnosis and user query, where the content of the visual report includes but is not limited to: (1) abnormality detection results, that is, listing all detected abnormal messages and their detailed information, and in-depth explanations of abnormal situations obtained by automatically retrieving relevant SOME / IP specifications based on LLM technology; (2) service and method call statistics, that is, the system counts the call frequency of each service ID and method ID, and displays the most commonly used services and methods in the message in the form of charts; (3) query and retrieval results, that is, for the query request initiated by the user, the report will summarize the retrieval results and combine semantic analysis to give the system's inferences and suggestions; (4) additional protocol references, that is, the report can also be accompanied by relevant SOME / IP protocol matrix tables and document links to facilitate users to refer to specific protocol specifications during the analysis process. It should be noted that the final generated report supports exporting to formats such as PDF or HTML, so that users can circulate and archive it according to their needs for subsequent debugging and analysis.

[0091] In summary, this embodiment aims to efficiently convert the captured SOME / IP message data into structured data suitable for LLM model processing, and then use the LLM model for intelligent analysis and anomaly detection, providing a new solution for rapid detection and response of vehicle Ethernet anomalies, so as to improve the security and stability of vehicle network communication; wherein, this embodiment can not only improve the efficiency and accuracy of message detection and enhance the anomaly detection capability, but also has strong adaptability and scalability, and can also realize intelligent semantic retrieval and automatic generation of structured reports; specifically, in order to improve the efficiency and accuracy of message detection, the LLM conversion method can quickly and accurately parse SOME / IP Messages, automatically extract key information (such as service ID, method ID, client ID, etc.) and retrieve relevant protocol specifications. It can be seen that the automated anomaly detection and semantic retrieval functions reduce the workload of manual parsing and retrieval, and significantly improve the analysis efficiency. For enhanced anomaly detection capabilities, by automatically identifying communication anomalies in SOME / IP messages and comparing them with SOME / IP protocol specifications, hidden errors and non-compliant behaviors can be effectively discovered. In addition, the dynamic retrieval of the SOME / IP protocol matrix and SOME / IP protocol documents can provide an accurate explanation for each anomaly, helping technicians quickly locate and fix problems, and achieve rapid detection and response to vehicle network anomalies.

[0092] With respect to adaptability and scalability, the parsing method based on LLM has strong adaptability and scalability, that is, as the model is continuously optimized, the performance of the parsing method can be continuously improved, and the parsing method can be easily expanded to support other types of messages or protocols by modifying the input and configuration parameters; with respect to intelligent semantic retrieval, the semantic retrieval function based on LLM allows users to describe their needs in natural language. In SOME / IP message parsing, this means that natural language can be used to interact with the model, and parsing rules and configuration parameters can be specified in a more intuitive and flexible way, so that the model can deeply understand the user's intention and retrieve relevant data. This flexible retrieval method improves the user experience of the model, and is particularly suitable for scenarios with high complexity of message data; with respect to automatic generation of structured reports, this embodiment supports the generation of structured message analysis reports, which include anomaly detection results, service call statistics, and detailed protocol references, etc., to help users systematically understand problems in SOME / IP communications. This function reduces the burden of manual data collation and analysis, and improves the convenience of report generation and sharing.

[0093] In a second aspect, an embodiment of the present application also provides a message detection device based on a large model.

[0094] In one embodiment, referring to Figure 2 , Figure 2This is a functional module diagram of an embodiment of a message detection device based on a large model of the present application. Figure 2 As shown, the message detection device based on the large model includes:

[0095] A format conversion module, which is used to perform format conversion on the parsed SOME / IP message information corresponding to each target SOME / IP message to obtain a structured format text, wherein the structured format text includes the message content, timestamp, service ID and method ID corresponding to each target SOME / IP message;

[0096] A relationship table construction module, which is used to parse each structured data in the structured format text based on a preset SOME / IP protocol matrix table to generate a target relationship table, wherein the target relationship table includes a mapping relationship between a server, a client, a service ID, and a method ID corresponding to each target SOME / IP message;

[0097] A data determination module, which is used to determine the target message change data according to the target relationship table;

[0098] The message detection module is used to input the target message change data and the preset anomaly detection rules into the preset large language model for message detection to output the target detection result.

[0099] Furthermore, in one embodiment, the data determination module is specifically used to:

[0100] For each mapping relationship in the target relationship table, determine the corresponding target message ID based on the service ID and method ID;

[0101] The message content and timestamp corresponding to each mapping relationship with the same target message ID are compared to determine the target message change data.

[0102] Furthermore, in one embodiment, the message detection module is specifically used for:

[0103] The target message change data and the anomaly detection rule are input into the large language model so that the large language model generates an anomaly detection function based on the anomaly detection rule, and performs message detection on the target message change data according to the anomaly detection function to obtain a target detection result.

[0104] Furthermore, in one embodiment, the message detection module is also used for:

[0105] If there are abnormal results in the target detection results, the preset SOME / IP protocol specification is retrieved through the large language model to output the target protocol specification and abnormal explanation information corresponding to the abnormal result.

[0106] Furthermore, in one embodiment, the device further comprises a data retrieval module, which is used to:

[0107] When receiving keyword search information input by the user, a SOME / IP message corresponding to the keyword search information is screened out from all target SOME / IP messages for output, wherein the keyword search information includes one or more of a message ID, a service ID, a method ID, a client ID and a server ID;

[0108] When non-keyword search information input by the user is received, semantic understanding of the non-keyword search information is performed based on the large language model, and all target SOME / IP messages are searched according to the semantic understanding result to output the SOME / IP message corresponding to the non-keyword search information.

[0109] Furthermore, in one embodiment, the device further includes a message parsing module, which is used to:

[0110] Perform data pre-cleaning on each received initial SOME / IP message to remove irrelevant messages, interrupted messages and incomplete messages to obtain multiple target SOME / IP messages;

[0111] Each target SOME / IP message is parsed based on the SOME / IP protocol parsing library to obtain parsed SOME / IP message information corresponding to each target SOME / IP message.

[0112] Among them, the functional implementation of each module in the above-mentioned large model-based message detection device corresponds to the various steps in the above-mentioned large model-based message detection method embodiment, and its functions and implementation processes will not be repeated here one by one.

[0113] In a third aspect, an embodiment of the present application provides a large model-based message detection device, which may be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0114] Reference Figure 3 , Figure 3 The hardware structure diagram of the large model-based message detection device involved in the embodiment of the present application is shown in FIG. In the embodiment of the present application, the large model-based message detection device may include a processor, a memory, a communication interface, and a communication bus.

[0115] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0116] The communication interface includes an input / output (I / O) interface, a physical interface, and a logical interface, etc., which are used to realize the interconnection of devices inside the large model-based message detection device, and an interface used to realize the interconnection between the large model-based message detection device and other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, an optical fiber interface, an ATM interface, etc.; the user device can be a display, a keyboard, etc.

[0117] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0118] The processor may be a general-purpose processor, and the general-purpose processor may call the message detection program based on the large model stored in the memory, and execute the message detection method based on the large model provided in the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). Among them, the method executed when the message detection program based on the large model is called may refer to the various embodiments of the message detection method based on the large model of the present application, which will not be repeated here.

[0119] Those skilled in the art will understand that Figure 3 The hardware structure shown in the figure does not constitute a limitation on the present application, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0120] In a fourth aspect, an embodiment of the present application also provides a computer-readable storage medium.

[0121] The readable storage medium of the present application stores a large model-based message detection program, wherein when the large model-based message detection program is executed by a processor, the steps of the large model-based message detection method described above are implemented.

[0122] Among them, the method implemented when the large model-based message detection program is executed can refer to the various embodiments of the large model-based message detection method of the present application, and will not be repeated here.

[0123] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0124] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0125] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0126] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0127] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0128] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0129] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A message detection method based on a large model, characterized in that: The following steps are involved: Performing format conversion on the parsed SOME / IP message information corresponding to each target SOME / IP message to obtain a structured format text, wherein the structured format text includes message content, a timestamp, a service ID, and a method ID corresponding to each target SOME / IP message; Parsing the structured format text based on a preset SOME / IP protocol matrix table, preset relationships between electronic control units ECU, preset corresponding relationships between clients and servers, and all services between each pair of clients and servers to generate a target relationship table, wherein the target relationship table includes a mapping relationship between a server, a client, a service ID, and a method ID corresponding to each target SOME / IP message; Determine target message change data according to the target relationship table; The target message change data and the preset anomaly detection rules are input into the preset large language model for message detection to output the target detection results.

2. The message detection method based on a large model as claimed in claim 1, characterized in that: Determining target message change data according to the target relationship table includes: For each mapping relationship in the target relationship table, determine the corresponding target message ID based on the service ID and method ID; The message content and timestamp corresponding to each mapping relationship with the same target message ID are compared to determine the target message change data.

3. The message detection method based on a large model as claimed in claim 1, characterized in that: The target message change data and the preset anomaly detection rules are input into the preset large language model LLM for message detection to output the target detection result, including: The target message change data and the anomaly detection rule are input into the large language model so that the large language model generates an anomaly detection function based on the anomaly detection rule, and performs message detection on the target message change data according to the anomaly detection function to obtain a target detection result.

4. The message detection method based on a large model as claimed in claim 1, characterized in that: After the step of outputting the target detection result, the method further includes: If there are abnormal results in the target detection results, the preset SOME / IP protocol specification is retrieved through the large language model to output the target protocol specification and abnormal explanation information corresponding to the abnormal result.

5. The message detection method based on a large model as claimed in claim 1, characterized in that: The method further comprises: When receiving keyword search information input by the user, a SOME / IP message corresponding to the keyword search information is screened out from all target SOME / IP messages for output, wherein the keyword search information includes one or more of a message ID, a service ID, a method ID, a client ID and a server ID; When non-keyword search information input by the user is received, semantic understanding of the non-keyword search information is performed based on the large language model, and all target SOME / IP messages are searched according to the semantic understanding result to output the SOME / IP message corresponding to the non-keyword search information.

6. The message detection method based on a large model as claimed in claim 1, characterized in that: Before the step of converting the format of the parsed SOME / IP message information corresponding to each target SOME / IP message, the method further includes: Perform data pre-cleaning on each received initial SOME / IP message to remove irrelevant messages, interrupted messages and incomplete messages to obtain multiple target SOME / IP messages; Each target SOME / IP message is parsed based on the SOME / IP protocol parsing library to obtain parsed SOME / IP message information corresponding to each target SOME / IP message.

7. A message detection device based on a large model, characterized in that: include: A format conversion module, which is used to perform format conversion on the parsed SOME / IP message information corresponding to each target SOME / IP message to obtain a structured format text, wherein the structured format text includes the message content, timestamp, service ID and method ID corresponding to each target SOME / IP message; A relationship table construction module, which is used to parse each structured data in the structured format text based on a preset SOME / IP protocol matrix table to generate a target relationship table, wherein the target relationship table includes a mapping relationship between a server, a client, a service ID, and a method ID corresponding to each target SOME / IP message; A data determination module, which is used to determine the target message change data according to the target relationship table; The message detection module is used to input the target message change data and the preset anomaly detection rules into the preset large language model for message detection to output the target detection result.

8. The message detection device based on a large model as claimed in claim 7, characterized in that: The data determination module is specifically used for: For each mapping relationship in the target relationship table, determine the corresponding target message ID based on the service ID and method ID; The message content and timestamp corresponding to each mapping relationship with the same target message ID are compared to determine the target message change data.

9. A message detection device based on a large model, characterized in that: The large model-based message detection device includes a processor, a memory, and a large model-based message detection program stored in the memory and executable by the processor, wherein when the large model-based message detection program is executed by the processor, the steps of the large model-based message detection method as described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a large model-based message detection program, wherein when the large model-based message detection program is executed by a processor, the steps of the large model-based message detection method as described in any one of claims 1 to 6 are implemented.

Images