Vehicle-oriented information transmission safety monitoring and early warning method and system and vehicle

Abstract

The invention relates to a vehicle-oriented information transmission safety monitoring and early warning method and system and a vehicle, and relates to the field of information security, and the method comprises the steps: collecting a data flow index in real time from a vehicle information transmission link, and extracting a data feature set; the big data is interacted to obtain historical transmission monitoring records, and analysis and proximity selection are carried out to obtain historical abnormal transmission records; clustering analysis is conducted on the historical abnormal transmission records based on an elbow method, N abnormal transmission sample sets are determined, N is a positive integer larger than or equal to 2, and each sample set corresponds to one abnormal transmission state; according to the plurality of abnormal transmission sample sets, respectively constructing and training a plurality of weak recognizers, and obtaining an abnormal behavior detection model through integrated learning; and inputting the data feature set into an abnormal behavior detection model for detection, and executing safety early warning according to a detection result, thereby achieving the technical effect of improving the accuracy and adaptability of vehicle information transmission safety monitoring.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a vehicle-oriented information transmission security monitoring and early warning method, system, and vehicle. Background Art

[0002] With the development of connected vehicle technology, data exchange between vehicles is becoming increasingly frequent. To ensure the security of data transmission, real-time monitoring of data traffic within vehicle information transmission links is necessary. Traditional monitoring methods rely on static rules or thresholds to identify abnormal behavior. These methods often lack sufficient flexibility and accuracy when faced with complex and changing network attacks and abnormal behavior. Summary of the Invention

[0003] The present invention addresses the technical problems in the existing technology, such as the difficulty of static rules in adapting to the ever-changing network environment and attack patterns, the difficulty of a single anomaly detection model in capturing the characteristics of multiple abnormal behaviors, and the lack of effective use of historical data, which leads to the inability to learn from past events and improve detection accuracy. The present invention provides a vehicle-oriented information transmission security monitoring and early warning method, system, and vehicle to solve these problems.

[0004] The technical solution of the present invention to solve the above technical problems is as follows:

[0005] In a first aspect, the present invention provides a vehicle-oriented information transmission security monitoring and early warning method:

[0006] Data flow indicators are collected from the vehicle information transmission link in real time, and a data feature set is extracted based on the data flow indicators.

[0007] The interactive big data obtains historical transmission monitoring records, and analyzes the historical transmission monitoring records for near-selection to obtain historical abnormal transmission records.

[0008] Based on the elbow method, cluster analysis is performed on the historical abnormal transmission records to determine N abnormal transmission sample sets, wherein each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2.

[0009] Based on the plurality of abnormal transmission sample sets, a plurality of weak identifiers are constructed and trained respectively, and the plurality of weak identifiers are integrated and learned to obtain an abnormal behavior detection model.

[0010] The data feature set is input into the abnormal behavior detection model for anomaly detection, and a security warning is executed based on the anomaly detection result.

[0011] In a second aspect, the present invention provides a vehicle-oriented information transmission safety monitoring and early warning system:

[0012] The data flow collection and feature extraction module is used to collect data flow indicators from the vehicle information transmission link in real time and extract data feature sets based on the data flow indicators.

[0013] The historical transmission monitoring record interaction module is used to interact with big data to obtain historical transmission monitoring records, and analyze the historical transmission monitoring records to perform near-selection and obtain historical abnormal transmission records.

[0014] The abnormal transmission sample set cluster analysis module is used to perform cluster analysis on the historical abnormal transmission records based on the elbow method to determine N abnormal transmission sample sets, wherein each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2.

[0015] The weak identifier construction and ensemble learning module is used to construct and train multiple weak identifiers based on multiple abnormal transmission sample sets, and perform ensemble learning on the multiple weak identifiers to obtain an abnormal behavior detection model.

[0016] The anomaly detection execution and security warning module is used to input the data feature set into the abnormal behavior detection model to perform anomaly detection and execute security warning according to the anomaly detection results.

[0017] In a third aspect, the present invention provides a vehicle, and the vehicle-oriented information transmission safety monitoring and early warning method provided by the present invention is applied to the vehicle.

[0018] The beneficial effects of the present invention are: by collecting data flow indicators from the vehicle information transmission link in real time, and extracting data feature sets based on the data flow indicators; interactive big data obtains historical transmission monitoring records, and parses the historical transmission monitoring records for proximity selection to obtain historical abnormal transmission records; based on the elbow method, cluster analysis is performed on the historical abnormal transmission records to determine N abnormal transmission sample sets, wherein each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2; based on multiple abnormal transmission sample sets, multiple weak identifiers are respectively constructed and trained, and multiple weak identifiers are integrated and learned to obtain an abnormal behavior detection model; the data feature set is input into the abnormal behavior detection model for abnormality detection, and a safety warning is executed according to the abnormal detection result, thereby achieving the technical effect of improving the accuracy and adaptability of vehicle information transmission safety monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of the process of the vehicle-oriented information transmission safety monitoring and early warning method provided by the present invention;

[0020] Figure 2 This is a structural diagram of the vehicle-oriented information transmission safety monitoring and early warning system provided by the present invention.

[0021] In the accompanying drawings, the components represented by the reference numerals are described as follows:

[0022] Data traffic collection and feature extraction module 11, historical transmission monitoring record interaction module 12, abnormal transmission sample cluster analysis module 13, weak identifier construction and ensemble learning module 14, anomaly detection execution and security warning module 15. DETAILED DESCRIPTION

[0023] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0024] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the specified features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0025] In the description of the present invention, the term "for example" is used to mean "used as an example, illustration or illustration". Any embodiment of the present invention described as "for example" is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any person skilled in the art to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes are not elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed herein.

[0026] Example 1:

[0027] like Figure 1 As shown, the embodiment of the present invention provides xxxx, including:

[0028] Data flow indicators are collected from the vehicle information transmission link in real time, and a data feature set is extracted based on the data flow indicators.

[0029] Specifically, data flow indicators refer to various parameters used to measure data transmission characteristics during vehicle information transmission, such as transmission rate, delay, packet loss rate, etc. The data feature set is a set of features extracted from the original data (data flow indicators) to describe and identify patterns or anomalies in the data.

[0030] By collecting data flow indicators of vehicle information transmission links in real time and extracting key feature sets, we can provide basic data support for vehicle behavior monitoring, communication optimization and anomaly detection.

[0031] In some embodiments, real-time data flow parameters are collected from the vehicle information transmission link, including:

[0032] Interactive target vehicle, determines the parameter sampling frequency according to the monitoring requirements of the target vehicle;

[0033] Based on the parameter sampling frequency, configuring an edge sampling device on the target vehicle;

[0034] The vehicle information transmission link is monitored in real time by the edge sampling device, and traffic characteristics, behavior characteristics, and content characteristics are collected and extracted, and output as the data feature set.

[0035] Specifically, the parameter sampling frequency refers to the frequency at which data flow metrics are sampled during the data collection process, which determines the level of detail collected. Edge sampling devices are devices deployed at the edge of the network, used to monitor and collect data from vehicle information transmission links in real time. Traffic characteristics, behavioral characteristics, and content characteristics refer to the size of data flow, the pattern of transmission behavior, and the characteristics of the data content, respectively.

[0036] Specifically, data flow indicators are collected from the vehicle information transmission link in real time, and data feature sets are extracted based on these indicators. First, the target vehicle is interacted with and the appropriate parameter sampling frequency is determined based on the monitoring requirements of the target vehicle. This step needs to consider the vehicle's communication characteristics and monitoring objectives to ensure that the collected data can meet the needs of subsequent analysis; then, based on the determined parameter sampling frequency, edge sampling devices are configured on the target vehicle. These edge sampling devices need to have highly efficient data collection capabilities to ensure real-time monitoring of the vehicle information transmission link;

[0037] Furthermore, the vehicle information transmission link is monitored in real time through edge sampling devices, and traffic characteristics, behavior characteristics, and content characteristics are collected and output as a data feature set. Among them, for example, traffic characteristics include transmission rate, data packet size, packet loss rate, etc.; behavior characteristics include transmission protocol type, link delay, transmission direction (upload / download), etc.; content characteristics include data payload type (such as text, video, sensor data), encryption type, hash value, etc.

[0038] Through the above steps, real-time data collection and feature extraction of the vehicle information transmission link are achieved. These data feature sets provide the necessary input for building an abnormal behavior detection model. By properly configuring the parameter sampling frequency and edge sampling devices, data collection can be ensured to be both efficient and resource-efficient.

[0039] The interactive big data obtains historical transmission monitoring records, and analyzes the historical transmission monitoring records for near-selection to obtain historical abnormal transmission records.

[0040] Specifically, the interactive big data platform obtains historical transmission monitoring records, parses and filters abnormal transmission records therein, and provides historical data support for anomaly detection and transmission optimization. For example, through an API or database query interface, it interacts with the vehicle big data monitoring platform to retrieve historical transmission monitoring records. The query parameters may include the target vehicle ID, time range, communication protocol type, etc.

[0041] Optionally, the acquired historical records are structured and stored according to fields such as timestamp, data transmission link, and monitoring indicators. For example, the data fields are: [timestamp][traffic characteristics][behavior characteristics][content characteristics][abnormal label].

[0042] Specifically, focus on the recent time period, that is, give priority to selecting transmission records within a recent period of time for key analysis, and output transmission records with anomalies to form a historical abnormal transmission record set.

[0043] In some embodiments, the interactive big data obtains historical transmission monitoring records, and parses the historical transmission monitoring records to perform near selection to obtain historical abnormal transmission records, including:

[0044] Based on the preset record extraction window, combined with the sliding window method, historical transmission monitoring records are extracted from recent to far and preprocessed;

[0045] Screening the preprocessing results, obtaining abnormal transmission data and storing it in the historical transmission monitoring record, and sliding the record extraction window to the next position for iterative collection;

[0046] The data volume of the historical transmission monitoring record is detected in real time until the data volume meets a preset target, and the historical transmission monitoring record is output.

[0047] Specifically, a record extraction window is a window used to extract a specific time period or a specific amount of data from a large data set. The sliding window method extracts continuous data subsets by sliding a fixed-size window (i.e., the record extraction window) across the data set.

[0048] Specifically, preprocessing is a series of steps performed on data before analysis, including cleaning, conversion, and normalization, to improve data quality. Abnormal transmission data refers to data that differs significantly from normal data patterns, indicating safety issues or abnormalities in vehicle information transmission.

[0049] In this embodiment, historical transmission monitoring records are first extracted and preprocessed using a sliding window method, starting with the most recent record, based on a preset time window size. This step allows useful information to be extracted from a large amount of data, providing a data foundation for subsequent anomaly detection. The preprocessing results are then screened, and data related to abnormal transmissions is obtained and stored in the historical transmission monitoring records. The record extraction window is then slid to the next position for iterative collection, i.e., the sliding window moves to the next position and the above process is repeated. Simultaneously, the data volume of the extracted historical transmission monitoring records is monitored in real time. Once the preset target data volume is reached, collection stops and these records are output, ensuring sufficient data support for building the anomaly detection model.

[0050] Through the above steps, we achieved the goal of efficiently extracting and processing abnormal transmission records from a large amount of historical data, ensuring that the anomaly detection model is trained and optimized based on the most relevant and comprehensive historical data. The combination of a sliding window method and iterative collection enables flexible processing of data from different time periods, improving the accuracy and real-time performance of anomaly detection. Furthermore, by monitoring data volume in real time until the preset target is met, we ensure the efficiency and effectiveness of the data collection process, providing a solid data foundation for vehicle information transmission safety monitoring and early warning.

[0051] Based on the elbow method, cluster analysis is performed on the historical abnormal transmission records to determine N abnormal transmission sample sets, wherein each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2.

[0052] Specifically, a cluster analysis is performed on historical abnormal transmission records to determine different abnormal transmission states, and then the historical abnormal transmission records obtained above are divided into multiple abnormal transmission sample sets, each sample set corresponding to an abnormal transmission state; the cluster analysis based on the elbow method can effectively determine the number of divisions of the abnormal transmission sample set, providing a scientific basis for the identification of abnormal transmission states and subsequent optimization.

[0053] In some embodiments, based on the elbow method, cluster analysis is performed on the historical abnormal transmission records to determine N abnormal transmission sample sets, where each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2, including:

[0054] Analyze the historical abnormal transmission records, obtain a historical data feature set, construct a feature vector, and normalize the feature vector;

[0055] The elbow method is used to analyze the intra-group square error of the eigenvector under different cluster numbers, and the rate of change of the intra-group square error is analyzed to determine the optimal cluster number K, where K is a positive integer and the intra-group square error is calculated as follows:

[0056]

[0057] Where SSE is the within-group square error; K is the number of clusters; x represents the data point corresponding to the eigenvector; μ k Characterizes the center of cluster k; C k Represents the set of data points in cluster k; x-μ k 2 Represents the square of the Euclidean distance between the data point x and the cluster center μk;

[0058] Cluster analysis is performed based on the optimal cluster number K to obtain N abnormal transmission sample sets.

[0059] Specifically, the elbow method is a method for determining the optimal number of clusters in cluster analysis. It determines the optimal number of clusters by analyzing the change in the squared error (SSE) under different numbers of clusters. A feature vector is a vector composed of a set of historical data features and is used to represent data points in a mathematical space.

[0060] Specifically, in the embodiment, the elbow method is used to perform cluster analysis on historical abnormal transmission records. First, key features are extracted from the historical abnormal transmission records to construct feature vectors. Then, these feature vectors are normalized to eliminate the dimensional influence between different features, making the cluster analysis more accurate. Then, the search range of the initial cluster number K is set and the corresponding cluster analysis is performed. By calculating the SSE under different cluster numbers, K and the corresponding SSE values are plotted into a graph, and the trend of SSE with increasing cluster number is observed. The "elbow point" where the SSE change rate suddenly decreases (i.e., the location where the SSE decline rate significantly slows down) is found to determine the optimal cluster number K. Finally, the determined cluster number K is used to perform cluster analysis on the feature vectors, and according to the N clusters in the clustering results, the historical abnormal transmission records are divided into N abnormal transmission sample sets. At this time, N is equal to the optimal cluster number K, and each sample set corresponds to an abnormal transmission state.

[0061] Through the above steps, we achieved effective cluster analysis of historical abnormal transmission records. This method ensures that the most representative abnormal sample sets are extracted from historical data, each corresponding to a specific abnormal state. Using the elbow method to determine the optimal number of clusters avoids overfitting and underfitting, improving clustering accuracy and efficiency.

[0062] Based on the plurality of abnormal transmission sample sets, a plurality of weak identifiers are constructed and trained respectively, and the plurality of weak identifiers are integrated and learned to obtain an abnormal behavior detection model.

[0063] Specifically, by constructing and training multiple weak identifiers based on multiple abnormal transmission sample sets, and applying an ensemble learning algorithm to combine the weak identifiers into an abnormal behavior detection model, higher abnormal behavior detection performance is achieved, wherein the multiple weak identifiers have different model structures or complexities, and correspond to multiple abnormal transmission states respectively.

[0064] Optionally, weak classification models used include decision trees, support vector machines (SVMs), simple linear classifiers (such as logistic regression), etc. By integrating and learning multiple weak identifiers, it helps to improve the generalization ability and accuracy of the detection model and reduce detection errors caused by overfitting or bias of a single model.

[0065] Specifically, each weak identifier focuses on a specific abnormal state, which helps reduce the complexity of the model and is conducive to parallel computing. At the same time, the combination of weak identifiers can cover a variety of abnormal transmission modes, thereby improving the model's adaptability to complex data scenarios.

[0066] In some embodiments, based on the plurality of abnormal transmission sample sets, a plurality of weak identifiers are constructed and trained respectively, and the plurality of weak identifiers are integrated and learned to obtain an abnormal behavior detection model, including:

[0067] Analyzing the abnormality recognition delays of the plurality of abnormal transmission sample sets, and defining the model structure constraints of the plurality of weak identifiers according to the abnormality recognition delays;

[0068] Analyzing the abnormal proportions of the plurality of abnormal transmission sample sets, and defining a constraint on the number of weak identifiers corresponding to each abnormal transmission state according to the abnormal proportions;

[0069] According to the model structure constraint and the weak identifier quantity constraint, a corresponding weak identifier library is constructed for each abnormal transmission state, and supervised training is performed on the multiple weak identifier libraries using multiple abnormal transmission sample sets;

[0070] A plurality of weak identifiers are randomly and repeatedly extracted from the plurality of weak identifier libraries that have completed supervised training, and integrated learning is performed to form the abnormal behavior detection model.

[0071] Specifically, a weak identifier is a single classifier or predictor with performance slightly better than random guessing. Model structure constraints are restrictions on the model structure, defined based on the needs of a specific problem. For example, anomaly recognition latency is based on anomaly. The anomaly percentage refers to the proportion of abnormal data in the abnormal transmission sample set.

[0072] Specifically, the weak identifier library is a set of weak identifiers constructed for each abnormal transmission state, which is used for subsequent ensemble learning. Combining the prediction results of multiple weak learners through ensemble learning helps to improve the performance of the overall model.

[0073] Specifically, in an embodiment, multiple weak identifiers are constructed and trained based on multiple abnormal transmission sample sets, and integrated learning is performed to obtain an abnormal behavior detection model. First, the abnormal recognition delay of each abnormal transmission sample set is analyzed, and the model structure constraints of the weak identifier are defined according to these delays to ensure that the model can recognize abnormalities within an acceptable time. In other words, the abnormal recognition delay can reflect the difficulty of recognizing different types of abnormalities. The abnormality with higher abnormal recognition delay corresponds to a higher performance model structure; then, the proportion of abnormal data in each abnormal transmission sample set is analyzed, and the number of weak identifiers corresponding to each abnormal transmission state is defined according to these proportions. In other words, the more frequent the abnormal type, the more weak identifiers it corresponds to. At the same time, the constraint on the number of weak identifiers is also used to limit the minimum number of models required for each abnormal type, ensuring that all types of abnormalities have a lower limit of recognition capability. Then, according to the model structure constraints and the constraint on the number of weak identifiers, a corresponding weak identifier library is constructed for each abnormal transmission state, and these weak identifier libraries are supervised trained using the abnormal transmission sample set. Next, multiple weak identifiers are randomly and repeatedly extracted from the weak identifier library that has completed supervised training, and they are combined into an abnormal behavior detection model using an ensemble learning method.

[0074] The role of this step in the entire scheme is to improve the performance and robustness of the anomaly detection model by building and training multiple weak identifiers and utilizing ensemble learning techniques.

[0075] Through the above steps, we achieved effective recognition and detection capabilities for various abnormal transmission states, ensuring that the abnormal behavior detection model has higher accuracy and adaptability when facing different types of abnormal transmission states. By analyzing anomaly recognition latency and anomaly ratio to define constraints on the model structure and the number of weak recognizers, we ensured the real-time and effectiveness of the model in practical applications. Furthermore, the use of ensemble learning further improved the model's performance, enabling it to combine the strengths of multiple weak recognizers and enhance its ability to identify abnormal behavior.

[0076] The data feature set is input into the abnormal behavior detection model for anomaly detection, and a security warning is executed based on the anomaly detection result.

[0077] Specifically, an abnormal behavior detection model is used to analyze real-time data to identify data points or behaviors that do not conform to normal patterns. After abnormal behavior is detected, an early warning mechanism is automatically triggered to notify relevant personnel or systems to take corresponding security measures.

[0078] Specifically, in an embodiment, a data feature set is input into an abnormal behavior detection model for anomaly detection, and a security warning is executed based on the detection results. First, the data feature set collected in real time is input into the abnormal behavior detection model. The feature set contains key information such as traffic characteristics, behavior characteristics, and content characteristics; then, the abnormal behavior detection model analyzes the input data feature set, determines whether the current data is abnormal, and identifies the abnormal pattern therein (i.e., the type and degree of abnormality); once the model detects abnormal behavior, a security warning is executed according to preset rules, including sending an alarm notification, taking automatic defense measures, or recording abnormal events for subsequent analysis.

[0079] Through the above steps, real-time anomaly detection and security warnings are achieved for vehicle information transmission links. This approach ensures that any abnormal behavior during data transmission can be quickly identified and actioned, helping to maintain the security and stability of vehicle information transmission and providing strong protection for vehicle network security.

[0080] In some implementations, the method further includes:

[0081] Obtaining feedback information, and statistically calculating early warning deviation indicators based on the feedback information;

[0082] When the warning deviation index satisfies the preset feedback adjustment constraint, the corresponding deviation warning record is extracted from the feedback information to perform feedback optimization of the abnormal behavior detection model.

[0083] By obtaining feedback information, statistically calculating early warning deviation indicators, and optimizing the abnormal behavior detection model based on preset feedback adjustment constraints, we can ensure continuous improvement of model performance and adaptability to actual application scenarios.

[0084] Specifically, the sources of feedback information include manual review and annotation results, false alarm / missing alarm records of the automated verification system, feedback logs of on-site operators, etc.; the definitions of warning deviation indicators include: false alarm rate, that is, the proportion of normal behaviors incorrectly marked by the model; missing alarm rate, that is, the proportion of abnormal behaviors not detected by the model; cumulative deviation value, that is, the total number of false alarms and missing alarms within a certain time period.

[0085] Specifically, the feedback adjustment constraint is used to determine whether the abnormal behavior detection model needs to be optimized and adjusted. When the warning deviation indicator meets the feedback adjustment constraint, the specific records of false alarms and missed alarms are located from the feedback information, and a data set containing feature information, warning labels and actual labels is extracted to form a deviation sample set; then, the deviation sample set is used as an enhanced data set, and the abnormal behavior detection model is incrementally trained based on the deviation sample set to improve the model's ability to identify abnormal behavior.

[0086] In some implementations, the feedback adjustment constraints include cumulative constraints, periodic constraints, and continuous constraints, wherein the cumulative constraint is defined as a threshold value for the number of accumulated false alarms and missed alarms within a specific time period; the periodic constraint is defined as a fixed time period threshold; and the continuous constraint is defined as a threshold value for the number of consecutive deviations.

[0087] Specifically, the feedback adjustment constraint is used to determine whether the abnormal behavior detection model needs to be optimized and adjusted. The constraints include:

[0088] Cumulative constraint defines the cumulative number of false alarms and missed alarms exceeding the set threshold range. For example, if the number of false alarms exceeds 20 times or the number of missed alarms exceeds 10 times in a week, feedback optimization is triggered; periodic constraint defines the changes in feedback records within a fixed period. For example, the detection model is periodically optimized and adjusted once a month; continuous constraint defines the occurrence of deviation records for multiple times in a row. For example, if 5 consecutive feedbacks are missed alarms, feedback optimization is triggered.

[0089] The vehicle-oriented information transmission security monitoring and early warning method provided by the embodiment of the present invention has at least the following technical effects:

[0090] By collecting data flow indicators from the vehicle information transmission link in real time and extracting data feature sets based on the data flow indicators; interactive big data obtains historical transmission monitoring records, and parses the historical transmission monitoring records for proximity selection to obtain historical abnormal transmission records; based on the elbow method, cluster analysis is performed on the historical abnormal transmission records to determine N abnormal transmission sample sets, where each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2; based on multiple abnormal transmission sample sets, multiple weak identifiers are constructed and trained respectively, and multiple weak identifiers are integrated and learned to obtain an abnormal behavior detection model; the data feature set is input into the abnormal behavior detection model for anomaly detection, and a safety warning is executed according to the anomaly detection results, thereby achieving the technical effect of improving the accuracy and adaptability of vehicle information transmission safety monitoring.

[0091] Example 2:

[0092] like Figure 2As shown, based on the same inventive concept as the vehicle-oriented information transmission security monitoring and early warning method provided in Example 1, the embodiment of the present invention also provides a vehicle-oriented information transmission security monitoring system, including:

[0093] The data flow collection and feature extraction module 11 is used to collect data flow indicators from the vehicle information transmission link in real time and extract data feature sets based on the data flow indicators.

[0094] The historical transmission monitoring record interaction module 12 is used to interact with big data to obtain historical transmission monitoring records, and analyze the historical transmission monitoring records to perform near-selection and obtain historical abnormal transmission records.

[0095] The abnormal transmission sample set cluster analysis module 13 is used to perform cluster analysis on the historical abnormal transmission records based on the elbow method to determine N abnormal transmission sample sets, wherein each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2.

[0096] The weak identifier construction and ensemble learning module 14 is used to construct and train multiple weak identifiers based on multiple abnormal transmission sample sets, and perform ensemble learning on the multiple weak identifiers to obtain an abnormal behavior detection model.

[0097] The anomaly detection execution and security warning module 15 is used to input the data feature set into the abnormal behavior detection model to perform anomaly detection and execute security warning according to the anomaly detection result.

[0098] In some embodiments, the data flow collection and feature extraction module 11 in the system performs the following steps:

[0099] Interactive target vehicle,determines the parameter sampling frequency according to the monitoring requirements of the target vehicle.

[0100] Based on the parameter sampling frequency, an edge sampling device is configured on the target vehicle.

[0101] The vehicle information transmission link is monitored in real time by the edge sampling device, and traffic characteristics, behavior characteristics, and content characteristics are collected and extracted, and output as the data feature set.

[0102] In some embodiments, the execution steps of the historical transmission monitoring record interaction module 12 in the system include:

[0103] Interactive target vehicle,determines the parameter sampling frequency according to the monitoring requirements of the target vehicle.

[0104] Based on the parameter sampling frequency, an edge sampling device is configured on the target vehicle.

[0105] The vehicle information transmission link is monitored in real time by the edge sampling device, and traffic characteristics, behavior characteristics, and content characteristics are collected and extracted, and output as the data feature set.

[0106] In some embodiments, the execution steps of the abnormal transmission sample set cluster analysis module 13 in the system include:

[0107] Based on the preset record extraction window, the sliding window method is combined to extract historical transmission monitoring records from near to far and perform preprocessing.

[0108] The pre-processing results are screened, abnormal transmission data is obtained and stored in the historical transmission monitoring record, and the record extraction window is slid to the next position for iterative collection.

[0109] The data volume of the historical transmission monitoring record is detected in real time until the data volume meets a preset target, and the historical transmission monitoring record is output.

[0110] In some embodiments, the weak identifier construction and ensemble learning module 14 in the system may execute the following steps:

[0111] The historical abnormal transmission records are analyzed to obtain a historical data feature set, construct a feature vector, and perform normalization processing on the feature vector.

[0112] The elbow method is used to analyze the intra-group square error of the eigenvector under different cluster numbers, and the rate of change of the intra-group square error is analyzed to determine the optimal cluster number K, where K is a positive integer and the intra-group square error is calculated as follows:

[0113]

[0114] Where SSE is the within-group squared error. K is the number of clusters. x represents the data point corresponding to the eigenvector. μ k Characterizes the center of cluster k. C k Represents the set of data points in cluster k. k 2 Characterizes the square of the Euclidean distance between the data point x and the cluster center μk.

[0115] Cluster analysis is performed based on the optimal cluster number K to obtain N abnormal transmission sample sets.

[0116] In some embodiments, the execution steps of the anomaly detection execution and safety warning module 15 in the system include:

[0117] The abnormality recognition delays of the plurality of abnormal transmission sample sets are analyzed, and model structure constraints of the plurality of weak identifiers are defined according to the abnormality recognition delays.

[0118] The abnormal proportions of the plurality of abnormal transmission sample sets are analyzed, and a constraint on the number of weak identifiers corresponding to each abnormal transmission state is defined according to the abnormal proportions.

[0119] According to the model structure constraint and the weak identifier quantity constraint, a corresponding weak identifier library is constructed for each abnormal transmission state, and supervised training is performed on the multiple weak identifier libraries using multiple abnormal transmission sample sets.

[0120] A plurality of weak identifiers are randomly and repeatedly extracted from the plurality of weak identifier libraries that have completed supervised training, and integrated learning is performed to form the abnormal behavior detection model.

[0121] In some embodiments, the system further comprises a feedback optimization module for:

[0122] Acquire feedback information, and statistically calculate an early warning deviation index based on the feedback information. When the early warning deviation index meets the preset feedback adjustment constraint, extract the corresponding deviation early warning record from the feedback information to perform feedback optimization of the abnormal behavior detection model.

[0123] Furthermore, in the feedback optimization module, the feedback adjustment constraints include a cumulative constraint, a periodic constraint, and a continuous constraint. The cumulative constraint is defined as a threshold for the number of accumulated false positives and missed negatives within a specific time period. The periodic constraint is defined as a fixed time period threshold. The continuous constraint is defined as a threshold for the number of consecutive deviations.

[0124] It should be noted that, in the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0125] In a third embodiment, the present application further provides a vehicle, and the vehicle-oriented information transmission safety monitoring and early warning method in the first embodiment is applied to the vehicle.

[0126] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0128] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0129] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0130] Although preferred embodiments of the present invention have been described, additional changes and modifications to these embodiments may occur to those skilled in the art once the basic inventive concepts become known.

[0131] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the present invention and its equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A vehicle-oriented information transmission safety monitoring and early warning method, characterized in that: The method comprises: Collecting data flow indicators from the vehicle information transmission link in real time, and extracting data feature sets based on the data flow indicators; Interacting with big data to obtain historical transmission monitoring records, and parsing the historical transmission monitoring records to perform near-selection and obtain historical abnormal transmission records; Based on the elbow method, cluster analysis is performed on the historical abnormal transmission records to determine N abnormal transmission sample sets, wherein each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2; Based on the plurality of abnormal transmission sample sets, respectively constructing and training a plurality of weak identifiers, and performing ensemble learning on the plurality of weak identifiers to obtain an abnormal behavior detection model; The data feature set is input into the abnormal behavior detection model for anomaly detection, and a security warning is executed based on the anomaly detection result.

2. The vehicle-oriented information transmission safety monitoring and early warning method according to claim 1, characterized in that: Real-time data flow parameters are collected from the vehicle information transmission link, including: Interactive target vehicle, determines the parameter sampling frequency according to the monitoring requirements of the target vehicle; Based on the parameter sampling frequency, configuring an edge sampling device on the target vehicle; The vehicle information transmission link is monitored in real time by the edge sampling device, and traffic characteristics, behavior characteristics, and content characteristics are collected and extracted, and output as the data feature set.

3. The vehicle-oriented information transmission safety monitoring and early warning method according to claim 2, characterized in that: Interactive big data obtains historical transmission monitoring records, and analyzes the historical transmission monitoring records for near-selection to obtain historical abnormal transmission records, including: Based on the preset record extraction window, combined with the sliding window method, historical transmission monitoring records are extracted from recent to far and preprocessed; Screening the preprocessing results, obtaining abnormal transmission data and storing it in the historical transmission monitoring record, and sliding the record extraction window to the next position for iterative collection; The data volume of the historical transmission monitoring record is detected in real time until the data volume meets a preset target, and the historical transmission monitoring record is output.

4. The vehicle-oriented information transmission safety monitoring and early warning method according to claim 3, characterized in that: Based on the elbow method, cluster analysis is performed on the historical abnormal transmission records to determine N abnormal transmission sample sets, where each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2, including: Analyze the historical abnormal transmission records, obtain a historical data feature set, construct a feature vector, and normalize the feature vector; The elbow method is used to analyze the intra-group square error of the eigenvector under different cluster numbers, and the rate of change of the intra-group square error is analyzed to determine the optimal cluster number K, where K is a positive integer and the intra-group square error is calculated as follows: Where SSE is the within-group square error; K is the number of clusters; x represents the data point corresponding to the eigenvector; μ k Characterizes the center of cluster k; C k Represents the set of data points in cluster k; x-μ k 2 Represents the square of the Euclidean distance between the data point x and the cluster center μk; Cluster analysis is performed based on the optimal cluster number K to obtain N abnormal transmission sample sets.

5. The vehicle-oriented information transmission safety monitoring and early warning method according to claim 4, characterized in that: Based on the plurality of abnormal transmission sample sets, a plurality of weak identifiers are constructed and trained respectively, and the plurality of weak identifiers are integrated and learned to obtain an abnormal behavior detection model, including: Analyzing the abnormality recognition delays of the plurality of abnormal transmission sample sets, and defining the model structure constraints of the plurality of weak identifiers according to the abnormality recognition delays; Analyzing the abnormal proportions of the plurality of abnormal transmission sample sets, and defining a constraint on the number of weak identifiers corresponding to each abnormal transmission state according to the abnormal proportions; According to the model structure constraint and the weak identifier quantity constraint, a corresponding weak identifier library is constructed for each abnormal transmission state, and supervised training is performed on the multiple weak identifier libraries using multiple abnormal transmission sample sets; A plurality of weak identifiers are randomly and repeatedly extracted from the plurality of weak identifier libraries that have completed supervised training, and integrated learning is performed to form the abnormal behavior detection model.

6. The vehicle-oriented information transmission safety monitoring and early warning method according to claim 5, characterized in that: The method further comprises: Obtaining feedback information, and statistically calculating early warning deviation indicators based on the feedback information; When the warning deviation index satisfies the preset feedback adjustment constraint, the corresponding deviation warning record is extracted from the feedback information to perform feedback optimization of the abnormal behavior detection model.

7. The vehicle-oriented information transmission safety monitoring and early warning method according to claim 6, characterized in that: The feedback adjustment constraints include cumulative constraints, periodic constraints and continuous constraints, wherein the cumulative constraint is defined as the threshold value of the number of false alarms and missed alarms accumulated within a specific time period; the periodic constraint is defined as a fixed time period threshold; and the continuous constraint is defined as the threshold value of the number of consecutive deviations.

8. The vehicle-oriented information transmission safety monitoring and early warning system is characterized by: The system is used to execute the vehicle-oriented information transmission security monitoring and early warning method according to any one of claims 1 to 7, and the system includes: A data flow collection and feature extraction module, configured to collect data flow indicators from the vehicle information transmission link in real time and extract a data feature set based on the data flow indicators; A historical transmission monitoring record interaction module is used to interact with big data to obtain historical transmission monitoring records, and parse the historical transmission monitoring records to perform near-selection and obtain historical abnormal transmission records; an abnormal transmission sample set cluster analysis module, configured to perform cluster analysis on the historical abnormal transmission records based on the elbow method to determine N abnormal transmission sample sets, wherein each abnormal transmission sample set corresponds to an abnormal transmission state, and N is a positive integer greater than or equal to 2; A weak identifier construction and ensemble learning module is used to construct and train multiple weak identifiers based on multiple abnormal transmission sample sets, and to perform ensemble learning on the multiple weak identifiers to obtain an abnormal behavior detection model; The anomaly detection execution and security warning module is used to input the data feature set into the abnormal behavior detection model to perform anomaly detection and execute security warning according to the anomaly detection results.

9. The vehicle-oriented information transmission safety monitoring and early warning system according to claim 8 is characterized in that: The system also includes a feedback optimization module for obtaining feedback information and statistically calculating a warning deviation index based on the feedback information; when the warning deviation index meets the preset feedback adjustment constraint, the corresponding deviation warning record is extracted from the feedback information to perform feedback optimization of the abnormal behavior detection model.

10. A vehicle, characterized in that: The vehicle-oriented information transmission safety monitoring and early warning method described in any one of claims 1 to 7 is applied to the vehicle.

Images