Vehicle anomaly detection method and system based on operation data
By calculating the correlation of vehicle operating parameters, screening approximate invariant features and using neural network models for prediction, the problems of high hardware cost and low efficiency of sensor abnormality detection in intelligent driving environment are solved, and low-cost, comprehensive abnormality detection and unknown attack response are achieved.
Patent Information
- Application Number
- CN202510603491.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-12
- Publication Date
- 2025-08-08
AI Technical Summary
In the prior art, in the intelligent driving environment, sensor abnormality detection has the problem of high hardware cost, low efficiency and inability to effectively prevent unknown attacks.
By calculating the correlation of vehicle operating parameters, filtering approximate invariant features as detection indicators, using neural network models for prediction, detecting abnormal states in real time, avoiding the addition of additional redundant sensors and maintaining attack mode dictionaries.
It realizes low-cost and comprehensive abnormality detection, improves the accuracy and robustness of detection, and can effectively deal with unknown attacks and abnormal situations.
Smart Images
Figure CN120452084A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of vehicle anomaly detection, and in particular to a vehicle anomaly detection method and system based on operating data. Background Art
[0002] In the context of intelligent driving, connected vehicles are equipped with sensors such as ultrasonic radar and global positioning systems. These sensors collect vehicle operating parameters and input them into the vehicle's onboard computing unit, where they are integrated with internet data for intelligent decision-making scenarios such as vehicle control and intelligent scheduling. However, the widespread use of sensors and high-performance onboard units also introduces more cybersecurity threats to vehicles. Attacks from both inside and outside the vehicle can cause anomalies in vehicle status sensor parameters such as speed and fuel level, posing risks to intelligent driving that relies on sensor data. Safety detection is an efficient technology for detecting vehicle anomalies. Promptly identifying and eliminating safety risks in vehicle perception scenarios through detection is crucial for the safe management of intelligent driving.
[0003] In the vehicle state perception scenario, detecting anomalies in the operating parameters collected by sensors is an effective technology for preventing vehicle anomalies. Existing technologies generally detect abnormal conditions by adding redundant controllers or sensor components and using signature-based methods. Although detection based on redundant sensors is effective, it also adds additional space, power consumption, and cost requirements to the vehicle. Signature-based anomaly detection compares the vehicle's operating mode with the attack patterns of known attacks to detect attacks. Being attacked is a type of abnormal vehicle state. Signature-based anomaly detection is highly efficient, but it takes time to maintain an attack pattern dictionary containing known attacks. It is not effective against unknown attacks and cannot comprehensively and effectively prevent unknown anomalies. Summary of the Invention
[0004] The purpose of the present invention is to provide a vehicle anomaly detection method and system based on operating data, which performs numerical prediction and comparison based on the real-time operating parameters of vehicle sensors to achieve anomaly detection more accurately, comprehensively and quickly and reduce the hardware cost of anomaly detection.
[0005] To achieve the above objectives, the present invention discloses a vehicle anomaly detection method based on operating data, which includes:
[0006] Acquiring operating parameters of the vehicle during operation, the operating parameters including a plurality of different data dimensions and operating data corresponding to each of the data dimensions;
[0007] Calculating correlations between the data dimensions based on the operating data corresponding to the data dimensions;
[0008] Taking any of the data dimensions as a detection indicator, screening the data dimension whose correlation with the detection indicator is greater than or equal to a preset first threshold as a reference indicator for the detection indicator, and training a prediction model with a neural network architecture based on the operating data corresponding to the reference indicator;
[0009] Inputting the operating data corresponding to the reference index during the current operation of the vehicle into the prediction model to obtain a prediction value corresponding to the detection index;
[0010] When the error value between the predicted value and the actual value of the detection index is greater than a preset second threshold, the vehicle is marked as being in an abnormal state.
[0011] Specifically, before calculating the correlation between the data dimensions, it is necessary to perform preprocessing operations on the operating data corresponding to each data dimension. The preprocessing operations include one or more of synchronizing timestamps, removing outliers, interpolating, and normalizing.
[0012] Specifically, the detection method further includes a preset detection period, and within one of the preset detection periods, the detection method predicts the value of the detection indicator based on the detection model and the operating data corresponding to the reference indicator within the preset detection period;
[0013] The duration of the preset detection period is adjusted based on the change rate of the operating data corresponding to each of the data dimensions.
[0014] Furthermore, the error value calculation method includes the first method or the second method described below; the first method is: calculating the cumulative value and variance of the difference between the predicted value and the actual value within the preset detection period, and the error value is the sum of the mean of the cumulative value and the variance;
[0015] In the second method, the calculation formula of the error value is:
[0016] CUSUM(t)=max(0,CUSUM(t-1)+(μ t -Δμ))
[0017] Wherein, t represents the t-th prediction within the preset detection period, CUSUM(t) is the accumulated error value at the t-th prediction, CUSUM(t-1) is the accumulated error value at the t-1-th prediction, μ t is the difference between the predicted value and the actual value at the t-th prediction, and Δμ is the mean of the cumulative values of the differences between the predicted value and the actual value at the t-th prediction.
[0018] Specifically, the correlation calculation method includes calculating the Pearson correlation coefficient between the data dimensions.
[0019] The present invention also discloses a vehicle anomaly detection system based on operating data, characterized in that the detection system works based on the above-mentioned vehicle anomaly detection method based on operating data.
[0020] The present invention also discloses a vehicle anomaly detection system based on operating data, which is characterized by comprising:
[0021] one or more processors;
[0022] Memory;
[0023] and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for executing the vehicle abnormality detection method based on operating data as described above.
[0024] The present invention also discloses a computer-readable storage medium, which includes a computer program. The computer program can be executed by a processor to implement the vehicle abnormality detection method based on operating data as described above.
[0025] Compared with the prior art, the vehicle anomaly detection method and system based on operating data disclosed in the above technical solution of the present invention, its detection method first calculates the correlation between each data dimension. Calculating the correlation between each data dimension is conducive to finding approximately invariant features. Approximately invariant features are a type of features whose statistical features (such as mean, variance, etc.) remain highly stable under different data distributions or time periods. Screening approximately invariant features for training is conducive to improving the generalization ability of the prediction model, reducing the risk of overfitting, etc. Any data dimension in the data dimension is used as a detection indicator, and the data dimension whose correlation with the detection indicator is greater than or equal to the first threshold is screened as the reference indicator of the detection indicator. The detection indicator and the reference indicator are approximately invariant features. Training is performed based on the operating data corresponding to the reference indicator to obtain a prediction model that can predict the value of the detection indicator at the next moment. This process only involves the software level and does not require the addition of redundant sensors, saving hardware costs. Secondly, predictions based on real-time operating parameters do not require the maintenance of an attack pattern dictionary, and their operating data can more intuitively reflect the vehicle's status. Whether it is under unknown attack or other abnormal conditions, detection can be performed based on the operating data, and the detection method is more comprehensive. In addition, the prediction model trained with this reference indicator is lightweight. Anomaly detection is achieved by comparing the predicted value with the actual value collected by the sensor, which improves the accuracy and robustness of detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] Figure 1 Flowchart of the detection method in an embodiment of the present invention.
[0027] Figure 2 2 is an architectural diagram of a prediction model in an embodiment of the present invention. DETAILED DESCRIPTION
[0028] In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the embodiments and the accompanying drawings.
[0029] This embodiment discloses a vehicle anomaly detection method and system based on operating data to improve the efficiency, accuracy and comprehensiveness of vehicle anomaly detection and reduce the cost of anomaly detection. Figure 1 ,The specific steps of the vehicle anomaly detection method based on operating data are:
[0030] S1: Acquire operating parameters of the vehicle during operation. Operating parameters include multiple data dimensions and operating data corresponding to each data dimension. In this embodiment, the operating parameters are collected by sensors. The collected data dimensions include wheel speeds corresponding to the four wheels, vehicle speed, engine speed, lateral acceleration, longitudinal acceleration, steering wheel angle, and braking status. The operating data is the data corresponding to the corresponding data dimension during the vehicle's operation.
[0031] S2: Calculate the correlation between the data dimensions based on the operating data corresponding to each data dimension.
[0032] S3: Taking any data dimension as a detection indicator, screening data dimensions whose correlation with the detection indicator is greater than or equal to a preset first threshold as reference indicators for the detection indicator.
[0033] S4: Training a prediction model with a neural network architecture based on the operating data corresponding to the reference indicators.
[0034] S5: Inputting the operation data corresponding to the reference index during the current vehicle operation process into the prediction model to obtain a prediction value corresponding to the detection index.
[0035] It's worth noting that currently in the automotive field, existing technology utilizes operational parameters other than detection indicators to train models and use these models to predict the next value of the detection indicator. The principles behind this are not detailed here.
[0036] S6: Calculate the error between the predicted value and the actual value of the detection indicator.
[0037] S7: Determine whether the error value is greater than a preset second threshold. If so, jump to step S71. If not, return to step S5. The value of the second threshold is not limited and can be set by the operation and maintenance personnel according to actual conditions.
[0038] S71: Mark the vehicle as being in an abnormal state.
[0039] Compared to existing technologies, the vehicle anomaly detection method based on operational data disclosed in this invention demonstrates significant advantages. At the data processing level, this method first calculates the correlations between a large number of operational parameters generated during vehicle operation, laying the foundation for screening highly correlated data dimensions. These highly correlated data dimensions serve as reference indicators, or approximately invariant features. Approximately invariant features are features whose statistical characteristics (such as mean and variance) remain highly stable across different data distributions or time periods. Selecting approximately invariant features for training can improve the generalization ability of prediction models and reduce the risk of overfitting. Using any data dimension as a detection indicator, we select a data dimension whose correlation with the detection indicator is greater than a preset first threshold as a reference indicator. The relationship between this detection indicator and the reference indicator is an approximately invariant feature. Training based on the operating data corresponding to the reference indicator yields a prediction model capable of predicting the value of the detection indicator at the next moment. This process involves only software, eliminating the need for additional redundant sensors and saving hardware costs. Furthermore, predictions based on real-time operating parameters do not require maintaining an attack pattern dictionary, and their operating data can more intuitively reflect the vehicle's status. Whether it is an unknown attack or other anomaly, detection can be performed based on this operating data, resulting in a more comprehensive detection approach. Furthermore, the prediction model trained using this reference indicator is lightweight. Anomaly detection is achieved by comparing predicted values with actual values collected by sensors, improving detection accuracy and robustness.
[0040] In summary, the present invention achieves efficient processing of vehicle operating parameters and accurate detection of anomalies by accurately screening approximately invariant features and adopting a lightweight prediction model. Detection based on actual operating parameters does not require the addition of redundant hardware equipment, maintenance of attack dictionaries, or the construction of a large vehicle dynamics model. This reduces detection costs, and the detection is more accurate and comprehensive, providing a strong guarantee for safe vehicle operation.
[0041] Specifically, in this embodiment, the method for selecting the detection index is: taking each data dimension as a benchmark, calculate the number of data dimensions among the remaining data dimensions whose correlation with the benchmark is greater than or equal to the first threshold, and take the data dimension with the largest number as the detection standard. For example: assuming that the vehicle speed is used as the benchmark, the number of data dimensions whose correlation with the vehicle speed is greater than or equal to the first threshold is 3, and taking the lateral acceleration as the benchmark, the number of data dimensions whose correlation with the lateral acceleration is greater than or equal to the first threshold is 1, then the vehicle speed is used as the detection index. Using the data dimension with the most correlation greater than or equal to the first threshold as the benchmark and making predictions based on it can better reflect the influence relationship between the various data dimensions in the operating parameters, so as to make more accurate predictions.
[0042] Specifically, the method for calculating the correlation includes calculating the Pearson correlation coefficient between each data dimension. When the Pearson correlation coefficient is greater than a first preset threshold value, the data dimensions corresponding to the Pearson correlation coefficient are highly correlated. Taking one of the data dimensions as a detection indicator, the other data dimension is a reference indicator corresponding to the detection indicator. In this embodiment, the first threshold is preset to 0.8. When the Pearson correlation coefficient between one data dimension and another data dimension is greater than or equal to 0.8, they can be considered to be highly correlated. In this embodiment, Table 1 shown below is used as an example for explanation:
[0043] Table 1 Typical data dimensions
[0044] Data Dimensions describe unit Wheel speed (4) The speed of each wheel km / h Speed Vehicle speed km / h Engine speed Engine crankshaft speed rpm Lateral / longitudinal acceleration IMU output reflects the speed change trend m / s Steering wheel angle Characterizing the vehicle's steering behavior - Braking status Braking status -
[0045] Table 1 shows several typical operating parameters collected by sensors during vehicle inspection. Assuming the Pearson correlation coefficient between vehicle speed and wheel speeds 1 / 2 / 3 / 4 is greater than 0.95, the Pearson correlation coefficient between vehicle speed and engine speed is approximately 0.87, and the Pearson correlation coefficient between vehicle speed and braking status is approximately -0.75. Furthermore, vehicle speed, wheel speeds 1 / 2 / 3 / 4, and engine speed are highly correlated, and vehicle speed has the most data dimensions with correlations greater than or equal to a first threshold, vehicle speed can be selected as the inspection metric, and wheel speeds 1 / 2 / 3 / 4 and engine speed can be used as reference metrics for training to obtain a prediction model.
[0046] Specifically, before calculating the Pearson correlation coefficient between each data dimension, it is necessary to perform preprocessing operations on the running data corresponding to each data dimension. The preprocessing operations include one or more of synchronizing timestamps, removing outliers, interpolating, and normalizing.
[0047] In this embodiment, the detection method first synchronizes the timestamps of the data collected as shown in Table 1 above, and then removes the outliers in each data dimension, and interpolates the blank areas of the operating data after removing the outliers to ensure the integrity of the operating data. Finally, all the operating data are normalized. Normalization can specifically use the Z-score or Min-Max standardization method to normalize the operating data. After completing the above preprocessing operations, the correlation is calculated based on the preprocessed operating data.
[0048] Specifically, it also includes a preset detection period, during which the detection method predicts the value of the detection indicator based on the detection model and the operating data corresponding to the reference indicator during the preset detection period;
[0049] The duration of the preset detection cycle is adjusted based on the rate of change of the operating data corresponding to each data dimension.
[0050] In this embodiment, taking the vehicle speed change rate as an example, when the vehicle speed change rate is greater, the possibility of the vehicle being in an abnormal state is greater. When the vehicle speed is stable (i.e., the change rate is less than 1km / h / s), the detection can set the duration of the preset detection cycle to 3 to 5s. When accelerating / braking suddenly (i.e., the change rate is greater than 3km / h / s), the risk of abnormality increases, and the preset detection cycle duration is shortened to less than 1s. The operator can set the detailed value of the preset detection cycle according to actual needs. The adjustment of this embodiment can also be based on a preset delay parameter. When the change rate of the operating data is small, the duration of the preset detection cycle is increased in the form of the current preset detection cycle duration + delay parameter. When the change rate of the operating data is large, the duration of the preset detection cycle is reduced in the form of the current preset detection cycle duration - delay parameter.
[0051] It should be noted that the adjustment of the preset detection period by this detection method is not limited to the vehicle speed change rate, and can be a combination of two or even more of the change rates of the operating data corresponding to all the collected data dimensions. In a preset detection period, the detection method collects operating data at a frequency of 10 Hz.
[0052] Generally speaking, the longer the preset detection period and the more operational data, the higher the prediction accuracy. However, in actual vehicle operation, the earlier anomalies are detected and safety measures are implemented, the less harm they cause. Dynamically changing the preset detection period can increase the chances of detecting abnormal behavior before it causes serious consequences, further ensuring vehicle safety.
[0053] Specifically, the error value calculation method includes the following first method or second method:
[0054] The first method is to calculate the cumulative value and variance of the difference between the predicted value and the actual value within a preset detection period, and the error value is the sum of the mean and variance of the cumulative value;
[0055] In the second method, the error value is calculated as follows:
[0056] CUSUM(t)=max(0,CUSUM(t-1)+(μ t -Δμ))
[0057] Where t represents the t-th prediction within the preset detection period, CUSUM(t) is the cumulative error value at the t-th prediction, CUSUM(t-1) is the cumulative error value at the t-1-th prediction, and μ t is the difference between the predicted value and the actual value at the t-th prediction, and Δμ is the mean of the cumulative difference between the predicted value and the actual value at the t-th prediction.
[0058] In this embodiment, the error value calculation method is divided into the two calculation methods mentioned above. In actual detection, the two calculation methods will be combined and calculated simultaneously. When the error value calculated by any calculation method (the current accumulated error value in the second method) exceeds the preset second threshold, it is marked as an abnormal state, an alarm is triggered, and a safety mechanism is adopted.
[0059] See Figure 2 As shown, in this embodiment, the neural network framework of the prediction model consists of a CNN layer, an RNN layer, a fully connected layer and an autoregressive model. The input of the prediction model is the operating parameters corresponding to the reference indicators and collected by the sensor. Among them, the CNN layer is used to extract local features in the operating data corresponding to the reference indicators, and the RNN layer is used to extract the time series features of the time series data in the preset time series sensor. Subsequently, the fully connected layer integrates these features and outputs the prediction results of the detection indicators. The autoregressive model decomposes the prediction results into linear components, and integrates them with the prediction results of the detection indicators for output, thereby improving the prediction accuracy of the nonlinear neural network for the operating data corresponding to the reference indicators with non-periodic characteristics.
[0060] The present invention also discloses a vehicle abnormality detection system based on operating data, characterized in that the detection system works based on the above-mentioned detection method.
[0061] The present invention also discloses a vehicle anomaly detection system based on operating data, which includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the programs include instructions for executing the detection method as described above. The processor can adopt a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for executing relevant programs to execute the detection method of the embodiment of the method of the present application.
[0062] The present invention also discloses a computer-readable storage medium, which includes a computer program, and the computer program can be executed by a processor to complete the detection method as described above. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrations. The available medium can be a read-only memory (ROM), or a random access memory (RAM), or a magnetic medium, such as a floppy disk, a hard disk, a tape, a magnetic disk, or an optical medium, such as a digital versatile disc (DVD), or a semiconductor medium, such as a solid state drive (SSD).
[0063] The present application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the above-described detection method.
[0064] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope of the present invention.
Claims
1. A vehicle anomaly detection method based on operating data, characterized in that: include: Acquiring operating parameters of the vehicle during operation, the operating parameters including a plurality of different data dimensions and operating data corresponding to each of the data dimensions; Calculating correlations between the data dimensions based on the operating data corresponding to the data dimensions; Taking any of the data dimensions as a detection indicator, screening the data dimension whose correlation with the detection indicator is greater than or equal to a preset first threshold as a reference indicator for the detection indicator, and training a prediction model with a neural network architecture based on the operating data corresponding to the reference indicator; Inputting the operating data corresponding to the reference index during the current operation of the vehicle into the prediction model to obtain a prediction value corresponding to the detection index; When the error value between the predicted value and the actual value of the detection index is greater than a preset second threshold, the vehicle is marked as being in an abnormal state.
2. The vehicle abnormality detection method based on operating data according to claim 1, characterized in that: Before calculating the correlation between the data dimensions, it is necessary to perform preprocessing operations on the operating data corresponding to the data dimensions. The preprocessing operations include one or more of synchronizing timestamps, removing outliers, interpolating, and normalizing.
3. The vehicle abnormality detection method based on operating data according to claim 1, characterized in that: The method further comprises a preset detection period, wherein the detection method predicts the value of the detection index based on the detection model and the operating data corresponding to the reference index within the preset detection period. The duration of the preset detection period is adjusted based on the change rate of the operating data corresponding to each of the data dimensions.
4. The vehicle abnormality detection method based on operating data according to claim 3, characterized in that: The calculation method of the error value includes the first method or the second method described below; The first method is: calculating the cumulative value and variance of the difference between the predicted value and the actual value within the preset detection period, and the error value is the sum of the mean of the cumulative value and the variance; In the second method, the calculation formula of the error value is: CUSUM(t)=max(0,CUSUM(t-1)+(μ t -Δμ)) Wherein, t represents the t-th prediction within the preset detection period, CUSUM(t) is the accumulated error value at the t-th prediction, CUSUM(t-1) is the accumulated error value at the t-1-th prediction, μ t is the difference between the predicted value and the actual value at the t-th prediction, and Δμ is the mean of the cumulative values of the differences between the predicted value and the actual value at the t-th prediction.
5. The vehicle abnormality detection method based on operating data according to claim 1, characterized in that: The correlation calculation method includes calculating the Pearson correlation coefficient between the data dimensions.
6. A vehicle anomaly detection system based on operating data, characterized in that: The detection system operates based on the detection method according to any one of claims 1 to 5.
7. A vehicle anomaly detection system based on operating data, characterized in that: include: one or more processors; Memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs comprising instructions for executing the detection method according to any one of claims 1 to 5.
8. A computer-readable storage medium, characterized in that The invention comprises a computer program, wherein the computer program can be executed by a processor to implement the detection method according to any one of claims 1 to 5.