Method, apparatus, and vehicle for anomaly detection

Abstract

An anomaly detection method, apparatus, and vehicle are disclosed. The method includes acquiring first motion state information of the vehicle, which is determined based on signals from a first sensor of the vehicle and / or reference information obtained through an external communication network (S801); determining a first parameter and a second parameter based on the first motion state information, wherein the first parameter is associated with a state parameter indicated by the first motion state information, and the second parameter is associated with the dynamic state of the vehicle (S802); and determining the location of the anomaly based on the first parameter and the second parameter (S803). This method can be applied to IoT devices such as intelligent vehicles and new energy vehicles. It not only detects anomalies but also locates them, enabling the IoT devices to take appropriate measures, thus helping to improve the security of IoT devices.

Description

Technical Field

[0001] This application relates to the field of security, and more specifically, to a method, apparatus, and vehicle for anomaly detection. Background Technology

[0002] With the development of intelligent driving technology, vehicle-to-vehicle (V2V) wireless communication can enable information sharing between vehicles, such as route planning, vehicle acceleration, and vehicle speed, allowing vehicles to rely on information transmitted by other vehicles for navigation. Vehicle safety in this technology heavily depends on V2V communication network signals and onboard sensor signals. However, V2V communication networks and onboard sensors are vulnerable to attacks that can cause signal anomalies, thereby affecting vehicle safety. Currently, however, there is no solution capable of timely and effective detection of abnormal signals and location of anomalies. Summary of the Invention

[0003] This application provides a method, apparatus, and vehicle for anomaly detection, which can accurately detect abnormal signals and locate the location of anomalies without relying on a large amount of data, so as to guide the vehicle to take corresponding measures and help improve vehicle safety.

[0004] The method provided in this application can be applied to vehicles, which are vehicles in a broad sense, including means of transportation (such as automobiles, commercial vehicles, passenger cars, trucks, motorcycles, airplanes, trains, ships, etc.), industrial vehicles (such as forklifts, trailers, tractors, etc.), engineering vehicles (such as excavators, bulldozers, cranes, etc.), agricultural equipment (such as lawnmowers, harvesters, etc.), amusement equipment, toy vehicles, etc. This application does not specifically limit the type of vehicle.

[0005] Firstly, an anomaly detection method is provided, which can be executed by a vehicle; or by a chip or circuit used in the vehicle; or by a control component such as an advanced driving assistance system (ADAS) or a vehicle control unit (VCU); or, the method can be executed by a cloud server communicating with the vehicle, which is not limited in this application.

[0006] The method includes: acquiring first motion state information of a vehicle, the first motion state information being determined based on signals from a first sensor of the vehicle and / or reference information obtained through an external communication network; determining a first parameter and a second parameter based on the first motion state information, the first parameter being associated with a state parameter indicated by the first motion state information, and the second parameter being associated with the dynamic state of the vehicle; and determining the location where the anomaly occurred based on the first parameter and the second parameter.

[0007] The above technical solution does not rely on a large amount of training data or statistical data, nor does it rely on other vehicles and / or roadside infrastructure to provide a large amount of redundant information. Based on the real-time motion status information of the vehicle, it can determine whether the vehicle has an anomaly and the location of the anomaly, which can improve the accuracy and timeliness of anomaly detection.

[0008] For example, the first motion state information may include one or more parameters among the vehicle's current position, speed, acceleration, relative distance to other vehicles, relative speed, desired acceleration, and tracking error. The desired acceleration is the acceleration that the vehicle's controller expects the vehicle to achieve, and this desired acceleration, after being executed by the vehicle's actuators, can become the vehicle's actual acceleration.

[0009] For example, the reference information may include one or more of the following: speed, position, acceleration, planned driving path, and steering wheel angle of other vehicles around the vehicle (e.g., the vehicle immediately in front of the vehicle).

[0010] For example, the external communication network can be a vehicle-to-everything (V2X) communication network, or a vehicle-to-infrastructure (V2I) communication network, or a V2V communication network, or other external communication networks. This application does not specifically limit it in this regard.

[0011] For example, an anomaly in the first sensor could be caused by a malfunction in the sensor itself, or by an attack on the sensor by an attacker; an anomaly in the vehicle's intranet could be caused by at least one of the following: attacks on control components such as the MDC and VDC, CAN network congestion, or unauthorized devices (such as malicious sensors, counterfeit parts, etc.) accessing the vehicle. For example, CAN network congestion could be caused by the on-board diagnostics (OBD) system continuously sending request information to the CAN after being inserted into the electronic control unit (ECU).

[0012] For example, the value of the state parameter indicated by the first motion state information can be directly obtained from the vehicle's first sensor. For instance, if the state parameter is speed and the first sensor is a speed sensor, then the specific value of the speed can be directly obtained from the speed sensor. Alternatively, the value of the state parameter indicated by the first motion state information can be calculated and determined from the signal of the vehicle's first sensor. For instance, if the state parameter is the relative speed of the vehicle with other vehicles and the first sensor is a millimeter-wave radar, then the specific value of the relative speed can be calculated and determined based on the signal of the millimeter-wave radar. Or, the value of the state parameter indicated by the first motion state information can be... If the state parameter is determined by calculation based on reference information, for example, if the state parameter is the desired acceleration, then the specific value of the desired acceleration can be calculated based on information such as the planned driving path, speed, and acceleration of the nearest preceding vehicle included in the reference information; or, the value of the state parameter indicated by the first motion state information can be determined by calculation based on the signal of the first sensor and the reference information. For example, if the state parameter is the desired acceleration, the reference information only includes the planned driving path of the nearest preceding vehicle, and the first sensor is a millimeter-wave radar, then the specific value of the desired acceleration can be calculated based on the planned driving path of the nearest preceding vehicle and the signal of the millimeter-wave radar.

[0013] In conjunction with the first aspect, in certain implementations of the first aspect, determining the first parameter and the second parameter based on the first motion state information includes: determining the first parameter based on the first motion state information and the first predicted state information, the first parameter including a first residual (or innovation) associated with the first sensor, the first predicted state information being determined based on the second motion state information of the vehicle at the previous moment; determining the location of the anomaly based on the first parameter and the second parameter includes: determining that the first sensor and / or the vehicle's in-vehicle network is abnormal when the value of the first residual is greater than a first preset threshold.

[0014] For example, the in-vehicle network may include one or more of the following: controller area network (CAN), local interconnect network (LIN), controller area network – flexible data (CAN-FD), and Ethernet.

[0015] For example, the first preset threshold can be determined based on the inherent properties of the first sensor, such as the noise threshold of the first sensor. For instance, taking a millimeter-wave radar as the first sensor, the first residual is the residual corresponding to the relative velocity signal. Therefore, the first preset threshold can be 0.1 m / s, or 0.15 m / s, or other values. The first preset threshold can be determined through theoretical calculation or through a machine learning algorithm; this application does not specifically limit its determination.

[0016] For example, "the first residual is associated with the first sensor" can be understood as the value of the first residual being determined based on the signal of the first sensor. It is understood that when the first sensor is attacked or malfunctions, the signal of the first sensor will be abnormal; or when the in-vehicle network malfunctions, the signal of the first sensor transmitted within the in-vehicle network may also be abnormal. Both of these abnormalities may cause the value of the first residual to exceed a first preset threshold. Therefore, the relationship between the value of the first residual and the first preset threshold can be used to determine whether the first sensor and / or the in-vehicle network is malfunctioning.

[0017] In some possible implementations, when the first parameter only includes the first residual, it is impossible to determine whether the anomaly occurred in the sensor or the in-vehicle network. When the first parameter also includes a third residual, the specific location of the anomaly can be determined based on the first and third residuals. For example, if the first parameter also includes a third residual, which is also associated with the vehicle's first sensor, the method further includes: determining that the first sensor has experienced an anomaly when the value of the first residual is greater than a first preset threshold and the value of the third residual is greater than a third preset threshold.

[0018] Compared with traditional anomaly detection based on statistical methods and machine learning algorithms, the above technical solution does not rely on a large amount of training data or statistical data, nor does it rely on a large amount of redundant information provided by other vehicles and / or roadside infrastructure. Based on the vehicle's real-time motion state information and the motion state information of the previous moment, it can determine whether the vehicle has an anomaly, which can improve the accuracy and timeliness of anomaly detection.

[0019] In conjunction with the first aspect, in some implementations of the first aspect, the first parameter further includes a second residual, which is associated with the second sensor of the vehicle. Determining the first parameter and the second parameter based on the first motion state information includes: determining the second parameter based on the first parameter; when the first motion state information is associated with the external communication network, determining the location of the anomaly based on the first parameter and the second parameter includes: determining that the external communication network has an anomaly when the value of each residual in the first parameter is less than or equal to a preset threshold corresponding to each residual, and the second parameter is greater than a second preset threshold.

[0020] For example, an anomaly in the external communication network can be caused by at least one of the following: the vehicle's external communication network is attacked, abnormal reference information is intentionally sent by other vehicles or equipment (such as servers, roadside infrastructure, etc.), or abnormal reference information is caused by malfunction or attack of other vehicles or equipment.

[0021] For example, "the second residual is associated with the vehicle's second sensor" can be understood as the value of the second residual being determined based on the signal from the second sensor. In some possible implementations, the first sensor and the second sensor are the same sensor.

[0022] The association of the first motion state information with the external communication network includes: the first motion state information being determined based on reference information received through the external communication network, or the first motion state information being determined based on the signal from the first sensor and the reference information.

[0023] For example, the second parameter can be a quadratic form of the first parameter. In some possible implementations, the second parameter can characterize the impact of at least one of the abnormal signals from the first sensor, the in-vehicle network, and the external communication network on the vehicle's dynamic state. It should be understood that the aforementioned noise may include inherent noise from the sensor or communication network, or it may include signal disturbances caused by attacks or malfunctions.

[0024] In some possible implementations, the first parameter may only include the first residual and the second residual. In this case, "the values ​​of the residuals in the first parameter are all less than or equal to the corresponding preset thresholds" can be understood as: the value of the first residual is less than or equal to the first preset threshold, and the value of the second residual is less than or equal to the preset threshold corresponding to the second residual. If the first parameter includes a third residual in addition to the first and second residuals, then "the values ​​of the residuals in the first parameter are all less than or equal to the corresponding preset thresholds" can be understood as: the value of the first residual is less than or equal to the first preset threshold, the value of the second residual is less than or equal to the preset threshold corresponding to the second residual, and the value of the third residual is less than or equal to the preset threshold corresponding to the third residual.

[0025] For example, the second preset threshold can be 1, or it can be other values, and this application does not specifically limit it.

[0026] In the above technical solution, anomaly localization can be performed based on the first and second parameters. Specifically, based on the residual value in the first parameter and the second parameter, it can be determined which part of the vehicle's external communication network, sensors, and in-vehicle network is malfunctioning, which helps in taking a series of measures to address the anomaly. For example, taking a V2V communication network as an example, after determining that the V2V communication network is malfunctioning, the vehicle can be controlled to disable its intelligent driving function or its external communication function; alternatively, the intelligent driving function can be maintained, and external communication can be conducted through a backup V2V communication network. It is evident that the above technical solution helps improve vehicle safety and the driving experience.

[0027] In conjunction with the first aspect, in some implementations of the first aspect, determining the first parameter based on the first motion state information and the first predicted state information includes: determining a third parameter based on the second motion state information and the second predicted state information of the vehicle at the previous moment; determining a fourth parameter based on the first motion state information and the first predicted state information; and determining the first parameter based on the third parameter and the fourth parameter.

[0028] For example, the first parameter can be the sum of the third and fourth parameters. Taking the first residual in the first parameter as determined based on the signal of the first sensor as an example, in this technical solution, the first residual can be understood as the sum of the residual determined based on the signal of the first sensor at the previous moment and the residual determined based on the signal of the first sensor at the current moment.

[0029] In the above technical solution, by determining whether the accumulated value of the residual over a certain period of time exceeds a preset threshold, an anomaly is considered to have occurred in the first sensor and / or the vehicle network when the accumulated value exceeds the preset threshold. This solution can reduce the impact of the randomness of the residual signal at a single moment on the detection results, which helps to improve the detection rate and further improve the accuracy of anomaly detection.

[0030] In conjunction with the first aspect, in some implementations of the first aspect, the first sensor includes at least one of the following: lidar, millimeter-wave radar, ultrasonic radar, velocity sensor, accelerometer, camera device, and global navigation satellite system (GNSS).

[0031] For example, an acceleration sensor may include an inertial measurement unit (IMU), an accelerometer, etc.; a speed sensor may include a rotational speed sensor, a wheel speed sensor, etc.

[0032] In conjunction with the first aspect, in some implementations of the first aspect, the state parameters indicated by the first motion state information include at least one of the following for the vehicle at the current moment: position, speed, acceleration, relative speed with other vehicles, desired acceleration, and tracking error; wherein the desired acceleration is the desired acceleration of the vehicle determined based on the reference information and / or the signal from the first sensor.

[0033] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: sending information to the vehicle's controller that the first sensor and / or the internal communication network has malfunctioned, so that the controller may reduce the level of intelligent driving or disable the intelligent driving function.

[0034] In the above technical solution, when an anomaly is detected in the vehicle, the vehicle controller is notified of the anomaly at the corresponding location, which helps the vehicle to take appropriate measures in a timely manner and improves vehicle safety.

[0035] Secondly, an anomaly detection device is provided, comprising: an acquisition unit for acquiring first motion state information of a vehicle, the first motion state information being determined based on signals from a first sensor of the vehicle and / or reference information obtained through an external communication network; a first determination unit for determining a first parameter and a second parameter based on the first motion state information, the first parameter being associated with a state parameter indicated by the first motion state information, and the second parameter being associated with the dynamic state of the vehicle; and a second determination unit for determining the location where the anomaly occurs based on the first parameter and the second parameter.

[0036] In conjunction with the second aspect, in some implementations of the second aspect, the first determining unit is configured to: determine a first parameter based on the first motion state information and the first predicted state information, the first parameter including a first residual associated with the first sensor, the first predicted state information being determined based on the second motion state information of the vehicle at the previous moment; the second determining unit is configured to determine that the first sensor and / or the vehicle's in-vehicle network is malfunctioning when the value of the first residual is greater than a first preset threshold.

[0037] In conjunction with the second aspect, in some implementations of the second aspect, the first parameter further includes a second residual, which is associated with the second sensor of the vehicle. When the first motion state information is associated with the external communication network, the first determining unit is further configured to: determine the second parameter based on the first parameter; the second determining unit is further configured to: determine that the external communication network is abnormal when the value of each residual in the first parameter is less than or equal to a preset threshold corresponding to each residual, and the second parameter is greater than a second preset threshold.

[0038] In conjunction with the second aspect, in some implementations of the second aspect, the first determining unit is configured to: determine a third parameter based on the second motion state information and the second predicted state information of the vehicle at the previous moment; determine a fourth parameter based on the first motion state information and the first predicted state information; and determine the first parameter based on the third parameter and the fourth parameter.

[0039] In conjunction with the second aspect, in some implementations of the second aspect, the first sensor includes at least one of the following: lidar, millimeter-wave radar, ultrasonic radar, velocity sensor, accelerometer, camera device, or Global Navigation Satellite System (GNSS).

[0040] In conjunction with the second aspect, in some implementations of the second aspect, the state parameters indicated by the first motion state information include at least one of the following for the vehicle at the current moment: position, speed, acceleration, relative speed with other vehicles, desired acceleration, and tracking error; wherein the desired acceleration is the desired acceleration of the vehicle determined based on the reference information and / or the signal from the first sensor.

[0041] In conjunction with the second aspect, in some implementations of the second aspect, the device further includes a transceiver unit for sending information to the vehicle's controller that the first sensor and / or the internal communication network has malfunctioned, so that the controller may reduce the level of intelligent driving or disable the intelligent driving function.

[0042] Thirdly, an anomaly detection apparatus is provided, the apparatus comprising a processing unit and a storage unit, wherein the storage unit is used to store instructions, and the processing unit executes the instructions stored in the storage unit to cause the apparatus to perform the method in any possible implementation of the first aspect.

[0043] Optionally, the processing unit may include at least one processor, and the storage unit may be a memory, wherein the memory may be an on-chip storage unit (e.g., registers, caches, etc.) or an off-chip storage unit within a mobile carrier (e.g., read-only memory, random access memory, etc.).

[0044] Fourthly, a vehicle is provided that includes the means in any of the second or third aspects described above.

[0045] Fifthly, a server is provided that includes the apparatus described in any of the second or third aspects above.

[0046] Sixthly, an anomaly detection system is provided, comprising a server and a vehicle. The server acquires first motion state information of the vehicle, which is determined based on signals from a first sensor of the vehicle and / or reference information obtained through an external communication network. The server determines a first parameter based on the first motion state information and first predicted state information, the first parameter including a first residual associated with the first sensor. The first predicted state information is determined based on second motion state information of the vehicle at the previous moment. When the value of the first residual exceeds a first preset threshold, the server determines that the first sensor and / or the vehicle's in-vehicle network is abnormal. The server sends information indicating the anomaly to the vehicle. The vehicle controls to reduce the level of intelligent driving or disable the intelligent driving function based on the anomaly.

[0047] In a seventh aspect, a computer program product is provided, comprising: computer program code, which, when executed on a computer, causes the computer to perform the method in any possible implementation of the first aspect.

[0048] It should be noted that the above-mentioned computer program code can be stored in whole or in part on the first storage medium, wherein the first storage medium can be packaged together with the processor or packaged separately from the processor, and this application does not make specific limitations in this regard.

[0049] Eighthly, a computer-readable medium is provided that stores instructions which, when executed by a processor, cause the processor to implement the method in any possible implementation of the first aspect.

[0050] In a ninth aspect, a chip is provided that includes circuitry for performing the method in any possible implementation of the first aspect described above. Attached Figure Description

[0051] Figure 1 This is a functional block diagram of the vehicle provided in the embodiments of this application;

[0052] Figure 2 This is a schematic diagram of a residual-based detector provided in an embodiment of this application;

[0053] Figure 3 This is a schematic diagram of an anomaly detection system architecture provided in an embodiment of this application;

[0054] Figure 4 This is a schematic flowchart illustrating an anomaly detection method provided in an embodiment of this application;

[0055] Figure 5This is a schematic diagram illustrating the residual change during detection based on the method provided in the embodiments of this application;

[0056] Figure 6 This is a schematic diagram illustrating the residual change during detection based on the method provided in the embodiments of this application;

[0057] Figure 7 This is a schematic diagram illustrating the residual change during detection based on the method provided in the embodiments of this application;

[0058] Figure 8 This is a schematic flowchart illustrating an anomaly detection method provided in an embodiment of this application;

[0059] Figure 9 This is a schematic block diagram of an anomaly detection device provided in an embodiment of this application;

[0060] Figure 10 This is a schematic block diagram of an anomaly detection device provided in an embodiment of this application. Detailed Implementation

[0061] In the description of the embodiments of this application, unless otherwise stated, " / " means "or", for example, A / B can mean A or B; "and / or" in this document describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. In this application, "at least one" means one or more, and "more" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0062] The use of prefixes such as "first" and "second" in this application embodiment is solely for distinguishing different descriptive objects and does not limit the position, order, priority, quantity, or content of the described objects. The use of ordinal numbers and other prefixes to distinguish descriptive objects in this application embodiment does not constitute a limitation on the described objects. The description of the described objects is found in the claims or the context of the embodiments, and the use of such prefixes should not constitute unnecessary restrictions.

[0063] As mentioned above, with the development of intelligent driving technology, information sharing between vehicles can be achieved based on V2V communication networks. This includes information such as planned routes, vehicle acceleration, and vehicle speed, which enable other vehicles to plan their driving parameters. These driving parameters include, but are not limited to, speed, acceleration, and route. Cooperative intelligent driving systems can effectively improve the efficiency and safety of intelligent transportation and reduce energy consumption. The security of cooperative intelligent driving systems heavily relies on V2V communication networks and onboard sensors. However, both V2V communication networks and onboard sensors can malfunction, thus affecting the security of cooperative intelligent driving systems. For example, V2V communication networks are vulnerable to attacks such as Sybil, denial of service, bogus attacks, and replay attacks, causing delays or blockages in the V2V communication process. Furthermore, attackers can transmit attack signals to vehicles through V2V communication networks. While authentication technology can prevent attacks to some extent, it cannot prevent malicious V2V network signals sent by legitimate vehicles for personal gain. Vehicle sensor signals may also become abnormal due to sensor malfunction or cyberattacks, which in turn may cause abnormal information to be sent to other vehicles.

[0064] In the current technological context, anomaly detection in V2V communication network signals and vehicle sensor signals is typically based on statistical methods and machine learning algorithms. However, these methods all rely on the amount of data. The accuracy of anomaly detection based on machine learning algorithms depends on the richness of the training set; when the amount of data is insufficient, it is also difficult to summarize the statistical characteristics of anomalous signals. Therefore, current technologies may lead to false positives and false negatives in anomaly detection.

[0065] In view of this, this application provides a method, apparatus, and vehicle for anomaly detection, which can determine whether an anomaly has occurred based on the vehicle's real-time motion state information, and can determine the location of the anomaly based on the values ​​of parameters determined by the motion state information and predicted parameter information. It can accurately detect abnormal signals and locate the anomaly location without relying on large amounts of data, thereby guiding the vehicle to take appropriate measures and helping to improve vehicle safety.

[0066] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0067] Figure 1This is a functional block diagram of a vehicle 100 provided in an embodiment of this application. The vehicle 100 may include a sensing system 120, a computing platform 150, and a communication system 160. The sensing system 120 may include one or more sensors for sensing information about the environment surrounding the vehicle 100. For example, the sensing system 120 may include a positioning system, which may be a Global Positioning System (GPS), or a BeiDou system or other positioning systems, an IMU, lidar, millimeter-wave radar, ultrasonic radar, and one or more of a camera device.

[0068] Some or all of the functions of vehicle 100 can be controlled by computing platform 150. Computing platform 150 may include processors 151 to 15n (n being a positive integer). A processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction read and execute capabilities, such as a central processing unit (CPU), microprocessor, graphics processing unit (GPU) (which can be understood as a type of microprocessor), or digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. These logical relationships are fixed or reconfigurable. For example, the processor may be a hardware circuit implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as a field-programmable gate array (FPGA). In reconfigurable hardware circuits, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the processor loading instructions to implement the functions of some or all of the above units. In addition, it can also be hardware circuits designed for artificial intelligence, which can be understood as a type of ASIC, such as a neural network processing unit (NPU), tensor processing unit (TPU), deep learning processing unit (DPU), etc. Furthermore, the computing platform 150 may also include a memory for storing instructions. Some or all of the processors 151 to 15n can call and execute the instructions in the memory to achieve the corresponding functions.

[0069] Vehicle 100 communicates with cloud servers, other vehicles, and roadside infrastructure through communication system 160.

[0070] In some possible implementations, vehicle 100 may include ADAS, which utilizes one or more sensors in perception system 120 (including but not limited to: lidar, millimeter-wave radar, camera device, ultrasonic sensor, global positioning system, inertial measurement unit) and / or communication system 160 to acquire information from the vehicle's surroundings, and analyze and process the acquired information to achieve functions such as obstacle perception, target recognition, vehicle positioning, automatic vehicle following, path planning, driver monitoring / alerts, etc., thereby improving the safety, automation and comfort of vehicle driving.

[0071] At different levels of autonomous driving (L0-L5), ADAS can achieve different levels of automated driving assistance based on artificial intelligence algorithms and information acquired by multiple sensors. The aforementioned levels of autonomous driving (L0-L5) are based on the classification standards of the Society of Automotive Engineers (SAE). Level L0 is no automation; Level L1 is driver assistance; Level L2 is partial automation; Level L3 is conditional automation; Level L4 is high automation; and Level L5 is full automation. From L1 to L3, the task of monitoring road conditions and reacting is jointly completed by the user and the system, requiring the user to take over dynamic driving tasks. Levels L4 and L5 allow the user to completely transform into a passenger. Currently, the functions that ADAS can achieve mainly include, but are not limited to: adaptive cruise control, automatic emergency braking, automatic parking, blind spot monitoring, forward cross-traffic alert / braking, rear cross-traffic alert / braking, forward collision warning, lane departure warning, lane keeping assist, rear collision warning, traffic sign recognition, traffic jam assist, and highway assist. It should be understood that the above-mentioned functions can have specific modes at different levels of intelligent driving (L0-L5). The higher the level of intelligent driving, the more intelligent the corresponding mode, and the higher the accuracy of the perception and control algorithms required.

[0072] Figure 2 A schematic diagram of an anomaly detection system architecture provided in an embodiment of this application is shown. This system can be configured in... Figure 1 The computing platform shown; or it can be set up in a cloud server, which can be connected to Figure 1The system connects vehicles 100 to perform anomaly detection. It includes a state observer and a monitor. The monitor detects whether anomalies occur in the vehicles, while the state observer determines, based on the residual value, which part of the sensor, the in-vehicle communication network (hereinafter referred to as the in-vehicle network), or the external communication network the anomaly occurs in. For example, the residual is the difference between the estimated and measured values ​​of the sensors at the current moment, where the estimated values ​​are predicted based on sensor measurements from the previous moment when no attack or anomaly occurred. In some possible implementations, the state observer's function can also be implemented using a Kalman filter.

[0073] Figure 3 A schematic diagram of another anomaly detection system architecture provided in an embodiment of this application is shown. Exemplarily, Figure 3 The system shown can be configured entirely in Figure 1 The vehicle 100 shown; or may be partially set in Figure 1 Of the vehicles 100 shown, some are configured on a cloud server. For example, the anomaly detection module is configured on the cloud server. Figure 3 The modules in the system shown, excluding the anomaly detection module, are configured in... Figure 1 The system, as shown in vehicle 100, includes a sensing module, a communication module, an anomaly detection module, a planning and control module, and an actuator. The sensing module may include... Figure 1 The sensing system 120 shown includes one or more sensors; the communication module may include Figure 1 The communication system 160 shown can acquire reference information through an external communication network, allowing the vehicle to plan driving parameters such as speed, acceleration, and driving path based on this reference information; the anomaly detection module may include... Figure 2The system shown is used to detect and locate whether a vehicle is experiencing an anomaly. The planning and control module controls the vehicle based on the indication information output by the anomaly detection module. In one example, taking a vehicle based on CACC as an example, when the anomaly detection module outputs an indication of a V2V communication network anomaly, the planning and control module controls the vehicle to degrade from CACC to ACC based on this indication. In another example, when the anomaly detection module outputs an indication of sensor anomaly and / or internal communication network anomaly, the planning and control module controls the intelligent driving function to be disabled, or controls the intelligent driving level to be downgraded from a higher level to a lower level (e.g., from L3 to L1). In yet another example, when the anomaly detection module outputs an indication that the vehicle is not experiencing an anomaly, the planning and control module plans the motion trajectory, calculates the corresponding control quantity based on the planned motion trajectory, and outputs the control quantity to the actuator. When the actuator executes the control quantity, it controls the vehicle to travel according to the planned motion trajectory. In some possible implementations, the actuator may also include the steering and braking control system in vehicle 100.

[0074] For example, the intelligent driving function involved in this application refers to the function for controlling a vehicle implemented through software programs, which may include, but is not limited to, path planning function, perception function, fusion function, adaptive cruise control (ACC) function, navigation cruise assistant (NCA) function, and integrated cruise assistant (ICA) function. Turning off the intelligent driving function may include turning off one or more of the above functions.

[0075] It should be understood that the above module is only an example, and in actual applications, it may be added or removed as needed. For example, Figure 3 In the system architecture shown, the anomaly detection module and the planning control module can be merged into one module.

[0076] Figure 4 A schematic flowchart of an anomaly detection method 400 provided in an embodiment of this application is shown. Exemplarily, method 400 can be applied to... Figure 1 Of the 100 vehicles shown, or, may be... Figure 2 The system shown can be executed, or it can also be executed by... Figure 3 The anomaly detection module in the system shown is executed. The method 400 may include:

[0077] S401, acquire first motion state information of the vehicle, which is determined based on signals from the vehicle's first sensor and / or reference information acquired through an external communication network.

[0078] For example, the vehicle can be vehicle 100 in the above embodiments, or it can be other vehicles.

[0079] For example, the first sensor may include at least one of the following: lidar, millimeter-wave radar, ultrasonic radar, velocity sensor, accelerometer, camera device, GNSS.

[0080] For example, the first motion state information includes at least one of the following for the vehicle at the current moment: position, speed, acceleration, relative speed with other vehicles, desired acceleration, and tracking error, wherein the desired acceleration is the acceleration that the vehicle is expected to achieve, determined based on the aforementioned reference information and / or the signal from the first sensor.

[0081] For example, the reference information may include, but is not limited to, information such as the planned driving paths, speeds, and accelerations of vehicles surrounding the vehicle.

[0082] In some possible implementations, the external communication network can be a V2X communication network, or a V2I communication network, or a V2V communication network, or other external communication networks. This application does not specifically limit this.

[0083] S402, a first parameter is determined based on the first motion state information and the first predicted state information. The first parameter includes a first residual, which is associated with the first sensor. The first predicted state information is determined based on the second motion state information of the vehicle at the previous moment.

[0084] For example, the first motion state information can be Figure 2 The measured values ​​shown, the first predicted state information can be Figure 2 The estimated value shown.

[0085] S403, when the first residual is greater than the first preset threshold, it is determined that the first sensor and / or the vehicle's in-vehicle network is abnormal.

[0086] For example, the in-vehicle network may include one or more of Ethernet, CAN, LIN, and CAN-FD.

[0087] It should be understood that when the first sensor is attacked or malfunctions, the signal of the first sensor will be abnormal; or when the in-vehicle network is abnormal, the signal of the first sensor transmitted in the in-vehicle network may also be abnormal. The above-mentioned abnormalities may cause the first residual to be greater than the first preset threshold. Therefore, the relationship between the first residual and the first preset threshold can be used to determine whether the first sensor and / or the in-vehicle network is abnormal.

[0088] For example, taking a millimeter-wave radar as the first sensor, the first residual is the residual corresponding to the relative velocity signal. The first preset threshold can be 0.1 m / s, or 0.15 m / s, or other values. The first preset threshold can be determined based on the inherent properties of the first sensor, for example, the first preset threshold can be determined based on the noise threshold of the first sensor. Specifically, the first preset threshold can be determined by theoretical calculation or by machine learning algorithm. This application embodiment does not specifically limit this.

[0089] In some possible implementations, the first parameter also includes a second residual associated with the vehicle's second sensor. When the first motion state information is associated with the external communication network, the second parameter is determined based on the first parameter. When each residual in the first parameter is less than or equal to a preset threshold corresponding to each residual, and the second parameter is greater than a second preset threshold, it is determined that the external communication network has malfunctioned.

[0090] For example, the second preset threshold can be 1, or it can be other values. This application embodiment does not specifically limit this.

[0091] Understandably, the second parameter can characterize the impact of at least one of the abnormal signals from the first sensor, the in-vehicle network, and the external communication network on the vehicle's dynamic state. Therefore, when an anomaly occurs in the first sensor and / or the in-vehicle network, this second parameter will also exceed a second preset threshold.

[0092] Optionally, determining the first parameter based on the first motion state information and the first predicted state information includes: determining a third parameter based on the second motion state information and the second predicted state information of the vehicle at the previous moment; determining a fourth parameter based on the first motion state information and the first predicted state information; and determining the first parameter based on the third parameter and the fourth parameter.

[0093] It is understandable that the second predicted state information is determined based on the vehicle's motion state information, that is, the second motion state information is the measured value at the previous moment, and the second predicted state information is the estimated value at the previous moment.

[0094] The anomaly detection method provided in this application, compared with traditional anomaly detection based on statistical methods and machine learning algorithms, does not rely on large amounts of training data or statistical data, nor does it rely on redundant information provided by other vehicles and / or roadside infrastructure. Based on the vehicle's real-time motion state information and the motion state information of the previous moment, it can determine whether the vehicle has experienced an anomaly, thus improving the accuracy and timeliness of anomaly detection. Furthermore, anomaly localization can be performed based on a first parameter and a second parameter. Specifically, based on the residual value in the first parameter and the second parameter, it can be determined which part of the vehicle's external communication network, sensors, and in-vehicle network is experiencing an anomaly, facilitating subsequent measures to address the anomaly and contributing to improved vehicle safety and driving experience.

[0095] In some possible implementations, the above-described anomaly detection method 400 can be implemented using a state observer and a monitor.

[0096] For example, taking the vehicle as the i-th vehicle in a vehicle platoon based on cooperative adaptive cruise control (CACC), the design method of the state observer and monitor involved in the embodiments of this application is explained below in conjunction with steps 1 to 3. It should be understood that CACC is a type of cooperative intelligent driving system in which each vehicle in CACC can understand the dynamics of other vehicles in the future period of time based on information shared in real time by surrounding vehicles received through the V2V communication network, thereby responding in advance.

[0097] Step 1: The following vehicle system model can be constructed based on the vehicle's longitudinal motion state:

[0098]

[0099] Where, x i =[ξ i v i a i u i Δv i a i-1 ] T ,([·] T (representing the transpose of a matrix), It is x i The derivative with respect to time, ξ i For tracking error, v i Let a be the actual speed of the i-th vehicle. i and a i-1 Let Δv be the actual acceleration of the i-th and (i-1)-th vehicles, respectively. i U is the relative speed between the i-th car and the (i-1)-th car. iand u i-1 Let δ be the expected acceleration of the i-th and (i-1)-th vehicles, respectively. i This is an abnormal signal from the V2V communication network, possibly injected by a malicious vehicle or caused by an anomaly in the V2V network; ω ui The disturbances present in V2V communication networks may be caused by factors such as network packet loss, latency, and quantization, and satisfy the following conditions: To disturb the boundary, It should be understood that K is the set of positive real numbers. p k d [] represents the gain of the vehicle controller. h is the time interval constant, τ represents the drivetrain dynamics constant, and k p and k d It is also a constant. The controller is used to meet the basic performance requirements of vehicle control. For example, the basic performance requirements of vehicle control include the stability of the vehicle tracking error system, the required convergence speed of the vehicle tracking error system, and the chordal stability of the vehicle platoon, etc.

[0100] It should be noted that, in the embodiments of this application, the actual speed v of the vehicle... i and actual acceleration a i The relative speed Δv between the i-th and (i-1)-th vehicles can be obtained by measuring the vehicle's speed sensor and acceleration sensor, respectively. i The desired acceleration u of the vehicle can be determined by processing radar data (such as lidar, millimeter-wave radar, ultrasonic radar, etc.). i To determine the process based on reference information obtained from other vehicles via V2V communication networks, such as the other vehicle's speed, acceleration, and travel path, u i The expected acceleration to be achieved by the vehicle is determined based on the above information. Tracking error ξ i (k)=d i (k)-(s i +hv i (k)), where d i (k) represents the actual distance between the i-th vehicle and the (i-1)-th vehicle at time k, which can be obtained from radar measurements; s i +hv i (k) represents the desired distance between the i-th car and the (i-1)-th car at the k-th time, v i (k) represents the speed of the i-th vehicle at time k, which can be measured by a speed sensor; h represents the time interval during which the vehicle is expected to maintain a certain speed. The specific value of h can be set by the vehicle user or it can be the default value when the vehicle leaves the factory. This application embodiment does not specifically limit this value; s iThe desired distance between two vehicles when they come to a complete stop (or standstill distance), s i The specific value can be the default value set when the vehicle leaves the factory. In some possible implementations, s i The specific value varies depending on the vehicle type; for example, for small cars, the value is... i You can use 4.92 feet, or any value between 4.5 and 5.5 feet; for trucks, the value can be greater than 5.5 feet.

[0101] Assuming each vehicle has millimeter-wave radar, accelerometer, and speed sensor, it can directly or indirectly measure ξ. i ,v i ,a i ,u i ,Δv i The vehicle's sensor signals can then be represented as follows:

[0102]

[0103] Where, ω i For sensor noise and satisfy To disturb the boundary, The disturbance boundary is determined by the inherent properties of the sensors and the in-vehicle network, or it can be determined through machine learning methods; this application does not specifically limit this. i =[ω i1 ω i2 ω i3 ω i4 ω i5 ] T , respectively corresponding to ξ i ,v i ,a i ,u i ,Δv i Noise in the signal. δ i ′ represents an abnormal sensor signal, which may be caused by sensor malfunction, malicious sensor attack, or in-vehicle network anomaly. Since the received network signals are discrete when the vehicle is in an abnormal state, equations (1) and (2) are discretized to obtain the following system model:

[0104] x i (k+1)=Ax i (k)+B1u i (k)+B2(u i-1 (k)+δ i (k)+ω ui (k)),

[0105] yi (k)=Cx i (k)+ω i (k)+δ i ′(k), (3)

[0106] in, e is the natural constant, x i (k) represents the state value of the vehicle at time k.

[0107] Step 2, design the vehicle state observer based on the vehicle system model as follows:

[0108]

[0109] Where L is the gain of the state observer to be determined.

[0110] Let the estimation error of the state observer Then e i The dynamics of (k) can be described by the following equation:

[0111]

[0112] in, By solving the linear matrix inequality (LMI), the observer gain L can be determined such that when the in-vehicle network, vehicle sensors, and V2V communication network are all normal (i.e., δ...), the observer gain L is determined. i (k)=0, δ i When ′(k)=0), it satisfies Approaching x i (k), i.e., estimation error e i (k) approaches 0. For specific design methods, refer to the design of the Luenberger observer.

[0113] make

[0114] Then we can obtain the following formula:

[0115]

[0116]

[0117] As can be seen from formula (7), r i (k) Directly affected by abnormal signals δ′ from sensors or in-vehicle network i Influenced by (k), and indirectly affected by the abnormal signal δ of the V2V network communication network. i The effect of (k-1). No anomalies were observed in the in-vehicle network, onboard sensors, or V2V network, i.e., δ.i (k-1) and δ′ i When (k) are all 0, we have:

[0118] r i (k+1)=CAe i (k)+ω i (k+1),(8)

[0119] Furthermore, e i (k), ω i (k+1), r i (k+1) all approach 0.

[0120] From formulas (2) and (6), we can know that r i (k)=[r i1 (k)r i2 (k)r i3 (k)r i4 (k)r i5 (k)] T , where r i1 (k) to r i5 (k) respectively correspond to ξ i ,v i ,a i ,u i ,Δv i The noise of the signal, in r i1 (k) to r i5 (k) If any item exceeds the corresponding noise threshold, it means that the signal corresponding to that item is abnormal, and then the abnormality can be located.

[0121] For example, r i The noise threshold for each term in the table represents the upper and lower bounds of the noise for the corresponding signal, i.e., r. ij The noise threshold is equal to ω ij The upper and lower bounds, etc., where r ij and ω ij r i and ω i The j-th term.

[0122] In some possible implementations, ω ij Satisfy |ω ij (k)|≤τ j If j∈{1,2,3,4,5}, then if |r ij (k)|>τ j Then it is considered that r ij The corresponding signal is abnormal, and the location of the abnormality can be determined based on the abnormal signal.

[0123] It is understandable that the tracking error ξ iIt needs to be determined based on speed sensor data and radar data, v i and a i The values ​​can be obtained from the vehicle's speed sensor and acceleration sensor, respectively. i The relative speed Δv between vehicle i and vehicle i-1 is determined by processing information obtained from other vehicles via a V2V communication network. i This can be determined by the vehicle processing radar data (such as lidar, millimeter-wave radar, ultrasonic radar, etc.). Therefore, if |r i1 (k)|>τ1, so ξ can be determined. i Signal abnormality, if r ij If only this one anomaly is detected, it can be determined that there is an anomaly in the vehicle's in-vehicle network; if |r i2 (k)|>τ2, which determines v i The signal is abnormal, thus indicating that the speed sensor is malfunctioning; if |r i3 (k)|>τ3, which determines a i The signal is abnormal, thus indicating that the accelerometer sensor is malfunctioning; if |r i4 (k)|>τ4, which determines u i The signal is abnormal, which leads to the conclusion that there is an anomaly in the vehicle's in-vehicle network; if |r i5 (k)|>τ5, which determines Δv i Signal abnormality, if r ij If only this one anomaly is detected, it can be determined that there is an anomaly in the radar and / or the vehicle's internal network. Because r i1 Associated with multiple sensors, therefore in some possible implementations, τ1 can be set to a more conservative value, such that in the event of a radar anomaly, and r i5 In the case of >τ5, r i1 ≤τ1; or, such that when the speed sensor malfunctions, and r i2 In the case of >τ2, r i1 ≤τ1.

[0124] It should be noted that when a sensor malfunctions, this malfunction will cause an estimation error e. i (k) will therefore deviate from 0, causing the residual signals of other sensors to also deviate from 0. Therefore, when performing anomaly localization, it is necessary to determine the moment when the residual signal becomes abnormal, and to determine the location of the anomaly based on the residual signal that first becomes abnormal.

[0125] Step 3: Design a monitor based on the residual signal. This monitor can detect whether the vehicle is experiencing any abnormalities.

[0126] We can consider the quadratic form of the residual signal, and define... in Given a positive semidefinite matrix, consider a monitor of the following form:

[0127] if The monitor will then output an alarm message to indicate that an abnormality has occurred in the vehicle system, that is, the value of the alarm signal changes from 0 to 1.

[0128] Therefore, when designing Π, we need to ensure that it is an ellipsoid. It contains all the possibilities that ω can be generated. ui (k) and ω i The dynamic trajectory of the residual system (7) caused by (k). In addition, the volume of the ellipsoid should be minimized by adjusting Π, so that the detection method is more sensitive to abnormal signals.

[0129] Furthermore, based on the above z i (k) can determine whether the vehicle has experienced an anomaly, based on the above r i (k) can pinpoint the specific location of the anomaly. For example, at time k, r i , z i The relationship with the location where the anomaly occurred can be shown in Table 1.

[0130] Table 1 r i , z i Relationship with the location where the anomaly occurred

[0131] ≤1 - No abnormalities >1 <![CDATA[r i1 ≤τ1,r i2 ≤τ2,r i3 ≤τ3,r i4 ≤τ4,r i5 ≤τ5]]> V2V communication network malfunction >1 <![CDATA[r i1 >τ1,r i5 >τ5,r i2 ≤τ2,r i3 ≤τ3,r i4 ≤τ4,]]> Radar malfunction >1 <![CDATA[r i1 >τ1,r i2 ≤τ2,r i3 ≤τ3,r i4 ≤τ4,r i5 ≤τ5]]> In-vehicle network malfunction >1 <![CDATA[r i5 >τ5,r i1 ≤τ1,r i2 ≤τ2,r i3 ≤τ3,r i4 ≤τ4]]> Radar / Vehicle Network Anomaly >1 <![CDATA[r i2 >τ2,r i1 ≤τ1,r i3 ≤τ3,r i4 ≤τ4,r i5 ≤τ5]]> Speed ​​sensor malfunction >1 <![CDATA[r i3 >τ3,r i1 ≤τ1,r i2 ≤τ2,r i4 ≤τ4,r i5 ≤τ5]]> Accelerometer malfunction >1 <![CDATA[r i4 >t4]]> In-vehicle network malfunction

[0132] As mentioned above, when setting the thresholds corresponding to each residual signal, since r i1 Associated with multiple sensors, therefore r i1 The corresponding threshold τ1 is set relatively conservatively.

[0133] In some possible implementations, r i If it can be a form of the first parameter in method 400, then r ij This can be the first residual, with the corresponding τ j This is the first preset threshold. Correspondingly, z i It can be one form of the second parameter in method 400. In some possible implementations, r... ij In this case, any residual other than the first residual can be the second residual.

[0134] Figures 5 to 7 The results of anomaly detection based on the anomaly detection method provided in the embodiments of this application are shown.

[0135] In one example, if the millimeter-wave radar malfunctions between the 15th and 40th seconds, then the anomaly detection method provided in this application embodiment, such as... Figure 5 As shown in (a), z can be detected from the 15th to the 40th second. i >1, and simultaneously, an alarm signal can be detected from the monitor output between the 15th and 40th second, such as Figure 5 As shown in (b), an alarm signal of 0 indicates no alarm signal is output; an alarm signal of 1 indicates an alarm signal is output. Furthermore, due to anomalies in the millimeter-wave radar, both the tracking error signal and the relative velocity signal will become abnormal simultaneously, thus causing r... i1 and r i5 Exceeding a preset threshold, such as Figure 5 As shown in (c) in the diagram. Furthermore, from... Figure 5 As can be seen in (c), at the 15th second, r i1 and r i5 Simultaneous mutation. Due to radar sensor anomalies, the estimation error e is increased. i (k) deviates from 0, therefore after the 15th second, it is affected by e i (k) influence, r i2 and r i3 It also deviates from 0. Therefore, based on the residual that first exceeds the preset threshold, it can be determined that the radar sensor is malfunctioning.

[0136] In another example, an anomaly occurs in the vehicle's in-vehicle network between the 15th and 40th seconds, and this anomaly causes an abnormal signal to be injected into the desired acceleration. Based on the anomaly detection method provided in this application embodiment, such as... Figure 6 As shown in (a), z can be detected from the 15th to the 40th second. i >1, and at the same time, such as Figure 6 As shown in (b), an alarm signal can be detected from the 15th to the 40th second. Furthermore, due to an anomaly in the in-vehicle network causing an anomaly in the desired acceleration signal, r... i5 Exceeding a preset threshold, such as Figure 6 As shown in (c) in the diagram. Furthermore, from... Figure 6 As can be seen in (c), at the 15th second, r i4 A sudden change occurred. Due to an anomaly in the vehicle's internal network, the estimation error e increased. i (k) deviates from 0, therefore after the 15th second, it is affected by e i (k) influence, r i1 r i2 r i3 and r i5 It also deviates from 0. Therefore, based on the residual that first exceeds the preset threshold, it can be determined that an anomaly has occurred in the vehicle's in-vehicle network.

[0137] In another example, if an anomaly occurs in the V2V communication network between the 15th and 40th seconds, then the anomaly detection method provided in this application embodiment, such as... Figure 7 As shown in (a), z can be detected from the 15th to the 40th second. i >1, and simultaneously, an alarm signal can be detected from the monitor output between the 15th and 40th second, such as Figure 7 As shown in (b) above. Because anomalies in the V2V communication network do not directly affect r... i Therefore, as Figure 7 As shown in (c), due to the anomaly of the V2V communication network, r i1 and r i5 It still fluctuates around 0 and will not exceed the corresponding preset threshold. Therefore, based on r i and z i The relationship between the data and a preset threshold can be used to determine if an anomaly has occurred in the V2V communication network.

[0138] In some possible implementations, the residual signal at a single time step is random. Therefore, the threshold τ at a single time step... j The setting might be more conservative, which could lead to anomaly detectors based on a single time point being rather conservative and not sensitive enough to anomalous signals. To improve the accuracy of the detection method, let R be... i (k)=[r i (k-T+1) T r i (k-T+2) T …r i (k) T ] T That is, to calculate the sum of the residual signals from the Tth time before the current time to the current time T, we can use this R... i (k) and a preset threshold determine whether a vehicle has malfunctioned. When a vehicle malfunctions, R... i (k) will be greater than the preset threshold. Further, define... in It is a positive semi-definite matrix, in Z i When (k) > 1, it is determined that the vehicle has encountered an anomaly. For example, at time k, R i Z i The relationship between the location of the anomaly and the location of the anomaly is shown in Table 2. T1 to T5 are the corresponding preset thresholds.

[0139] Table 2 R i Z i Relationship with the location where the anomaly occurred

[0140] ≤1 - No abnormalities >1 <![CDATA[R i1 ≤T1,R i2 ≤T2,R i3 ≤T3,R i4 ≤T4,R i5 ≤T5]]> V2V communication network malfunction >1 <![CDATA[R i1 >T1,R i5 >T5,R i2 ≤T2,R i3 ≤T3,R i4 ≤T4,]]> Radar malfunction >1 <![CDATA[R i1 >T1,R i2 ≤T2,R i3 ≤T3,R i4 ≤T4,R i5 ≤T5]]> In-vehicle network malfunction >1 <![CDATA[R i5 >T5,R i1 ≤T1,R i2 ≤T2,R i3 ≤T3,R i4 ≤T4]]> Radar / Vehicle Network Anomaly >1 <![CDATA[R i2 >T2,R i1 ≤T1,R i3 ≤T3,R i4 ≤T4,R i5 ≤T5]]> Speed ​​sensor malfunction >1 <![CDATA[R i3 >T3,R i1 ≤T1,R i2 ≤T2,R i4 ≤T4,R i5 ≤T5]]> Accelerometer malfunction >1 <![CDATA[R i4 >T4]]> In-vehicle network malfunction

[0141] The residual signal at time T prior to the current time can be a form of the third parameter in method 400, and the residual signal at the current time can be a form of the fourth parameter in method 400. In some possible implementations, In this case, any residual other than the first residual can be the second residual.

[0142] In some possible implementations, anomaly detection of vehicles can also be performed using a Kalman filter. For example, if we assume V2V network noise ω... ui (k), and sensor noise ω i (k) are all Gaussian white noise, and satisfy the following conditions: in and They are ω ui (k) and ω i The covariance matrix of (k). Based on the vehicle system model shown in equations (1) to (3), a Kalman filter can be designed. This Kalman filter can perform the following two steps: prediction and update:

[0143] predict:

[0144]

[0145] renew:

[0146]

[0147] For each time step, define the residual signal. Then we have {r i The sequence (k), k=1,2,…} is Gaussian white noise with a mean of 0, and its covariance matrix is ​​Σ=CPC T +R. Anomaly detection can be achieved by combining hypothesis testing methods. For example, at least one of the following methods can be used to detect anomalies by examining the residual signal: sequential ratio testing (SPRT), cumulative sum (CUSUM), generalized likelihood ratio (GLR), and compound scalar testing (CST).

[0148] In some possible implementations, H0(δ) in the absence of exceptions i (k) and δ i (k) equals 0), therefore

[0149] H0:={E(ri (k))=0,E(r i (k) T r i (k))=Σ};

[0150] When an anomaly occurs, H1 has

[0151] H1:={E(r i (k))≠0,E(r i (k) T r i (k))≠Σ}.

[0152] It should be noted that the anomaly detection method provided in this application is applicable not only to CACC driving scenarios, but also to ACC, NCA, or ICA driving scenarios. Furthermore, the above embodiments are illustrated using vehicle-related examples; it should be understood that schemes for anomaly detection of Internet of Things (IoT) devices such as drones, smart homes, and smart grids, based on the concepts of this application, should also be included within the scope of protection of this application.

[0153] Figure 8 A schematic flowchart of an anomaly detection method 800 provided in an embodiment of this application is shown. Exemplarily, this method 800 can be applied to... Figure 1 Of the 100 vehicles shown, or, may be... Figure 2 The system shown can be executed, or it can also be executed by... Figure 3 The anomaly detection module in the system shown is executed. The method 800 may include:

[0154] S801, acquire first motion state information of the vehicle, which is determined based on signals from the vehicle's first sensor and / or reference information acquired through an external communication network.

[0155] For example, the specific process of this step can be referred to the description of S401 in method 400, and will not be repeated here.

[0156] S802, a first parameter and a second parameter are determined based on the first motion state information, wherein the first parameter is associated with the noise of the state parameter indicated by the first motion state information, and the second parameter is associated with the dynamic state of the vehicle.

[0157] For example, the first parameter can be the first parameter in the above embodiments, such as r i or R i The second parameter can be the second parameter in the above embodiments, for example, z. i or Z i .

[0158] S803, based on the first parameter and the second parameter, determine the location where the anomaly occurred.

[0159] For example, the specific method for determining the location of the anomaly based on the first parameter and the second parameter can be referred to the description in the above embodiments, and will not be repeated here.

[0160] The anomaly detection method provided in this application does not rely on a large amount of training data or statistical data, nor does it rely on a large amount of redundant information provided by other vehicles and / or roadside infrastructure. It can determine whether the vehicle has an anomaly and the location of the anomaly based on the real-time motion status information of the vehicle, thereby improving the accuracy and timeliness of anomaly detection.

[0161] In the various embodiments of this application, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions between the various embodiments are consistent and can be referenced by each other. Technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0162] The above text combines Figures 2 to 8 The methods provided in the embodiments of this application are described in detail below. Figure 9 and Figure 10 The apparatus provided in the embodiments of this application is described in detail. It should be understood that the description of the apparatus embodiments corresponds to the description of the method embodiments. Therefore, for content not described in detail, please refer to the method embodiments above. For the sake of brevity, it will not be repeated here.

[0163] Figure 9 A schematic block diagram of an anomaly detection device 900 provided in an embodiment of this application is shown. The device 900 includes an acquisition unit 910, a first determination unit 920, and a second determination unit 930.

[0164] The device 900 may include methods for performing Figure 4 or Figure 8 The unit of the method in the device 900. Furthermore, each unit in the device 900 and the other operations and / or functions described above are respectively for implementing... Figure 4 or Figure 8 The corresponding flow of the method implementation in the example.

[0165] Among them, when the device 900 is used to perform Figure 8 When performing method 800, the acquisition unit 910 can be used to execute S801 in method 800, the first determination unit 920 can be used to execute S802 in method 800, and the second determination unit 930 can be used to execute S803 in method 800.

[0166] Specifically, the acquisition unit 910 is used to acquire first motion state information of the vehicle, which is determined based on signals from the vehicle's first sensor and / or reference information obtained through an external communication network; the first determination unit 920 is used to determine a first parameter and a second parameter based on the first motion state information, whereby the first parameter is associated with a state parameter indicated by the first motion state information and the second parameter is associated with the vehicle's dynamic state; and the second determination unit 930 is used to determine the location where the anomaly occurred based on the first parameter and the second parameter.

[0167] Optionally, the first determining unit 920 is used to determine a first parameter based on the first motion state information and the first predicted state information. The first parameter includes a first residual, which is associated with the first sensor. The first predicted state information is determined based on the second motion state information of the vehicle at the previous moment. The second determining unit 930 is used to determine that the first sensor and / or the vehicle's in-vehicle network is abnormal when the value of the first residual is greater than a first preset threshold.

[0168] Optionally, the first parameter further includes a second residual, which is associated with the vehicle's second sensor. When the first motion state information is associated with the external communication network, the first determining unit 920 is further configured to: determine the second parameter based on the first parameter; the second determining unit 930 is further configured to: determine that the external communication network is abnormal when the value of each residual in the first parameter is less than or equal to a preset threshold corresponding to each residual, and the second parameter is greater than a second preset threshold.

[0169] Optionally, the first determining unit 920 is configured to: determine a third parameter based on the second motion state information and the second predicted state information of the vehicle at the previous moment; determine a fourth parameter based on the first motion state information and the first predicted state information; and determine the first parameter based on the third parameter and the fourth parameter.

[0170] Optionally, the first sensor includes at least one of the following: lidar, millimeter-wave radar, ultrasonic radar, velocity sensor, accelerometer, camera device, or Global Navigation Satellite System (GNSS).

[0171] Optionally, the state parameters indicated by the first motion state information include at least one of the following for the vehicle at the current moment: position, speed, acceleration, relative speed with other vehicles, desired acceleration, and tracking error; wherein the desired acceleration is the desired acceleration of the vehicle determined based on the reference information and / or the signal from the first sensor.

[0172] Optionally, the device further includes a transceiver unit for sending information about an anomaly in the first sensor and / or the internal communication network to the vehicle's controller, so that the controller may reduce the level of intelligent driving or disable the intelligent driving function.

[0173] For example, the aforementioned acquisition unit 910 can be configured in Figure 2 In the observer shown, the aforementioned first determining unit 920 can also be configured in Figure 2 In the observer shown, the second determining unit 930 can be set in Figure 2 In the monitor shown. Alternatively, the device 900 can be set in Figure 3 In the anomaly detection module shown.

[0174] It should be understood that the division of units in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, the units in the device can be implemented by a processor calling software; for example, the device includes a processor connected to memory, which stores instructions. The processor calls the instructions stored in memory to implement any of the above methods or to implement the functions of each unit in the device. The processor can be, for example, a general-purpose processor, such as a CPU or microprocessor, and the memory can be internal or external to the device. Alternatively, the units in the device can be implemented as hardware circuits. The functions of some or all units can be implemented through the design of the hardware circuits, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an ASIC, and the functions of some or all units are implemented through the design of the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a PLD, such as an FPGA, which can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files, thereby implementing the functions of some or all units. All units of the above devices can be implemented entirely through processor calling software, or entirely through hardware circuits, or partially through processor calling software with the remaining parts implemented through hardware circuits.

[0175] In this application embodiment, a processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction reading and execution capabilities, such as a CPU, microprocessor, GPU, or DSP. In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. These logical relationships are fixed or reconfigurable. For example, the processor may be a hardware circuit implemented as an ASIC or PLD, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the processor loading instructions to implement the functions of some or all of the above units. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as an NPU, TPU, or DPU.

[0176] As can be seen, each unit in the above device can be one or more processors (or processing circuits) configured to implement the above methods, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0177] Furthermore, the units in the above devices can be integrated in whole or in part, or they can be implemented independently. In one implementation, these units are integrated together as a system-on-a-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or implementing the functions of the units in the device. The at least one processor may be of different types, such as CPU and FPGA, CPU and artificial intelligence processor, CPU and GPU, etc.

[0178] In specific implementation, the operations performed by the acquisition unit 910, the first determination unit 920, and the second determination unit 930 can be executed by the same processor, or they can be executed by different processors, for example, by multiple processors respectively. In specific implementation, the one or more processors mentioned above can be configured as follows: Figure 1 The processor in the computing platform 150 shown can also be a processor located in a cloud server. In specific implementations, the aforementioned device 900 can be a chip located in the vehicle 100 or a chip located in a cloud server.

[0179] Figure 10 This is a schematic block diagram of an anomaly detection device according to an embodiment of this application. Figure 10The anomaly detection device 1000 shown may include a processor 1010, a transceiver 1020, and a memory 1030. The processor 1010, transceiver 1020, and memory 1030 are connected via internal interconnection. The memory 1030 stores instructions, and the processor 1010 executes the instructions stored in the memory 1030 to receive / send certain parameters via the transceiver 1020. Optionally, the memory 1030 may be coupled to the processor 1010 via an interface or integrated with the processor 1010.

[0180] It should be noted that the transceiver 1020 described above may include, but is not limited to, transceiver devices such as input / output interfaces, to enable communication between device 1000 and other devices or communication networks.

[0181] The memory 1030 can be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM).

[0182] Transceiver 1020 uses transceiver devices, such as, but not limited to, transceivers, to enable communication between device 1000 and other devices or communication networks.

[0183] In some possible implementations, the device 1000 can be set in Figure 1 The computing platform 150 shown, or it can also be set in Figure 3 The anomaly detection module shown can also be set up in a cloud server.

[0184] This application embodiment also provides a server, which may include the above-described device 900 or the above-described device 1000.

[0185] This application embodiment also provides a vehicle, which may include the above-described device 900 or the above-described device 1000.

[0186] This application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to implement the method in this application embodiment.

[0187] This application also provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to implement the methods described in this application.

[0188] This application also provides a chip, including circuitry, for executing the methods described in this application.

[0189] In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software. The method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or by a combination of hardware and software modules within the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, power-on erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, detailed descriptions are omitted here.

[0190] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0191] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0192] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0193] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0194] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0195] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or a part thereof, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, external hard drives, ROM, RAM, magnetic disks, or optical disks.

[0196] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method of anomaly detection, characterized by, include: Acquire first motion state information of the vehicle, wherein the first motion state information is determined based on the signals of the vehicle's first sensor and the signals of the vehicle's second sensor; A first parameter is determined based on the first motion state information. The first parameter includes a first residual and a second residual. The first residual is associated with the first sensor, and the second residual is associated with the second sensor. The first parameter is associated with the noise of the state parameter indicated by the first motion state information. Based on the first parameter, a second parameter is determined, the second parameter being associated with the dynamic state of the vehicle; Determine whether an anomaly has occurred based on the second parameter; In the event of an anomaly, the location of the anomaly is determined based on the first parameter to be at least one of the following: the in-vehicle network, the first sensor, the second sensor, and the vehicle-to-vehicle communication network.

2. The method of claim 1, wherein, The step of determining whether an anomaly has occurred based on the second parameter includes: When the second parameter is greater than the second preset threshold, an anomaly is determined to have occurred; The step of determining the location of the anomaly based on the first parameter as at least one of the following: the in-vehicle network, the first sensor, the second sensor, and the vehicle-to-vehicle communication network, includes: When the value of the first residual is greater than the first preset threshold, it is determined that the first sensor and / or the in-vehicle network is abnormal.

3. The method of claim 1, wherein, The step of determining whether an anomaly has occurred based on the second parameter includes: When the second parameter is greater than the second preset threshold, an anomaly is determined to have occurred; When the first motion state information is associated with reference information obtained through the vehicle-to-vehicle communication network, determining the location of the anomaly based on the first parameter as at least one of the in-vehicle network, the first sensor, the second sensor, and the vehicle-to-vehicle communication network includes: When the value of each residual in the first parameter is less than or equal to the preset threshold corresponding to each residual, it is determined that the vehicle-to-vehicle communication network has malfunctioned.

4. The method of any one of claims 1 to 3, wherein, Determining the first parameter based on the first motion state information includes: The third parameter is determined based on the second motion state information and the second predicted state information of the vehicle at the previous moment; The fourth parameter is determined based on the first motion state information and the first predicted state information, wherein the first predicted state information is determined based on the second motion state information of the vehicle at the previous moment. The first parameter is determined based on the third parameter and the fourth parameter.

5. The method of any one of claims 1 to 3, wherein, The first sensor includes at least one of the following: lidar, millimeter-wave radar, ultrasonic radar, velocity sensor, accelerometer, camera device, and Global Navigation Satellite System (GNSS).

6. The method as described in claim 3, characterized in that, The state parameters indicated by the first motion state information include at least one of the following for the vehicle at the current moment: position, speed, acceleration, relative speed with other vehicles, desired acceleration, and tracking error; Wherein, the desired acceleration is the desired acceleration of the vehicle determined based on the reference information and / or the signal from the first sensor.

7. The method according to any one of claims 1 to 3, characterized in that, The method further includes: The system sends information about an anomaly in the first sensor and / or the in-vehicle network to the vehicle's controller, so that the controller can reduce the level of intelligent driving or disable the intelligent driving function.

8. An anomaly detection device, characterized in that, include: The acquisition unit is used to acquire first motion state information of the vehicle, wherein the first motion state information is determined based on the signals of the vehicle's first sensor and the signals of the vehicle's second sensor. The first determining unit is configured to determine a first parameter based on the first motion state information. The first parameter includes a first residual and a second residual. The first residual is associated with the first sensor, the second residual is associated with the second sensor, and the first parameter is associated with the noise of the state parameter indicated by the first motion state information. The first determining unit is further configured to: determine a second parameter based on the first parameter, wherein the second parameter is associated with the dynamic state of the vehicle; The second determining unit is used to determine whether an anomaly has occurred based on the second parameter; In the event of an anomaly, the location of the anomaly is determined based on the first parameter to be at least one of the following: the in-vehicle network, the first sensor, the second sensor, and the vehicle-to-vehicle communication network.

9. The apparatus as claimed in claim 8, characterized in that, When the second parameter is greater than the second preset threshold, the second determining unit determines that an anomaly has occurred; The second determining unit is used to: determine that the first sensor and / or the in-vehicle network is abnormal when the value of the first residual is greater than the first preset threshold.

10. The apparatus as claimed in claim 8, characterized in that, When the second parameter is greater than the second preset threshold, the second determining unit determines that an anomaly has occurred; When the first motion state information is associated with reference information obtained through the vehicle-to-vehicle communication network, The second determining unit is further configured to: determine that the vehicle-to-vehicle communication network is abnormal when the value of each residual in the first parameter is less than or equal to a preset threshold corresponding to each residual.

11. The apparatus as claimed in any one of claims 8 to 10, characterized in that, The first determining unit is used for: The third parameter is determined based on the second motion state information and the second predicted state information of the vehicle at the previous moment; The fourth parameter is determined based on the first motion state information and the first predicted state information, wherein the first predicted state information is determined based on the second motion state information of the vehicle at the previous moment. The first parameter is determined based on the third parameter and the fourth parameter.

12. The apparatus as claimed in any one of claims 8 to 10, characterized in that, The first sensor includes at least one of the following: lidar, millimeter-wave radar, ultrasonic radar, velocity sensor, accelerometer, camera device, and Global Navigation Satellite System (GNSS).

13. The apparatus as claimed in claim 10, characterized in that, The state parameters indicated by the first motion state information include at least one of the following for the vehicle at the current moment: position, speed, acceleration, relative speed with other vehicles, desired acceleration, and tracking error; Wherein, the desired acceleration is the desired acceleration of the vehicle determined based on the reference information and / or the signal from the first sensor.

14. The apparatus as claimed in any one of claims 8 to 10, characterized in that, The device further includes a transceiver unit for sending information about an anomaly occurring in the first sensor and / or the in-vehicle network to the vehicle's controller, so that the controller may reduce the level of intelligent driving or disable the intelligent driving function.

15. An anomaly detection device, characterized in that, include: Memory, used to store computer programs; A processor for executing a computer program stored in the memory to cause the apparatus to perform the method as described in any one of claims 1 to 7.

16. A vehicle, characterized in that, Includes the apparatus as described in any one of claims 8 to 15.

17. A server, characterized in that, Includes the apparatus as described in any one of claims 8 to 15.

18. A computer-readable storage medium, characterized in that, It stores instructions that, when executed by a processor, cause the processor to implement the method as described in any one of claims 1 to 7.

19. A chip, characterized in that, The chip includes circuitry for performing the method as described in any one of claims 1 to 7.

20. A computer program product, characterized in that, The computer program product includes: computer program code, which, when run on a computer, causes the computer to perform the method as described in any one of claims 1 to 7.

Images