A CAN bus gateway intelligent adaptive control method

Abstract

The present invention belongs to the technical field of gateway adaptive control, and discloses a method for intelligent adaptive control of a CAN bus gateway; the method comprises: extracting infotainment domain feature data from message metadata of a CAN subnet of an infotainment domain, generating a network intrusion diagnosis score and mapping it into a network intrusion threat level; based on a driving scenario and a network intrusion threat level, generating a reasonable instruction set and an unreasonable instruction set through an instruction setting model; if a new control instruction matches reasonably, it is released; if a match is unreasonable, it is intercepted and an abnormality count is counted; if a match fails, a comprehensive rationality score is generated based on the network intrusion threat level, the driving scenario, the infotainment domain feature data and the new control instruction; the control instruction is released or intercepted according to the comprehensive rationality score, and an abnormality count is counted; when the abnormality count reaches a preset maximum abnormality number, an abnormal instruction is generated; the application can intelligently adjust control authority and accurately block forged control frames or abnormal instructions in different driving contexts.

Description

Technical Field

[0001] The present invention relates to the technical field of gateway adaptive control, and more particularly to an intelligent adaptive control method for a CAN bus gateway. Background Art

[0002] As a mainstream in-vehicle communication protocol, the CAN bus is widely used for data exchange between multiple subsystems, including infotainment systems, powertrain control systems, and autonomous driving modules. To enhance communication security between domains with different security levels, a CAN bus gateway is typically deployed between the infotainment and powertrain domains, serving as a core component for cross-domain data forwarding and access control. Currently, some in-vehicle systems have introduced basic protection mechanisms such as message filtering, ID whitelists, and fixed rule sets to attempt to filter and restrict commands from the non-secure infotainment domain, preventing network intrusions from posing a direct threat to the powertrain control system.

[0003] However, existing technologies primarily rely on static policy matching, fixed threshold judgments, or preset instruction sets for control. These technologies lack the ability to dynamically perceive the vehicle's actual operating status and complex contextual scenarios, making it difficult to respond to cross-domain attacks and forged instruction injection into the network. The risk levels of network intrusion behavior and instruction execution vary greatly across different driving scenarios, making existing gateway systems unable to implement context-based dynamic policy matching and instruction release decisions. Furthermore, current instruction sets are mostly fixed configurations, unable to perform credibility judgment or automatic classification of unknown instructions, and lacking adaptive learning and evolution capabilities. This results in a high misjudgment rate and slow defense response, making it difficult to meet the highly dynamic and high-precision requirements for vehicle communication security in intelligent driving environments.

[0004] Therefore, there is an urgent need for an intelligent control method for CAN bus gateway that can integrate communication behavior characteristics, driving scenarios and command intentions and support dynamic command identification, so as to improve the intrusion identification capability and response control accuracy of the gateway system in complex environments. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art and achieve the above-mentioned purpose, the present invention provides the following technical solution: a CAN bus gateway intelligent adaptive control method, comprising:

[0006] Analyze and process the message metadata of the infotainment domain CAN subnet received by the CAN bus gateway within a unit time to obtain infotainment domain feature data;

[0007] Conduct network intrusion analysis based on infotainment domain feature data to obtain a network intrusion diagnosis score, and then categorize the network intrusion threat level based on the network intrusion diagnosis score;

[0008] Analyze and process vehicle driving data per unit time to obtain driving scenarios;

[0009] Based on the driving scenario and the network intrusion threat level, the instruction setting model generates a reasonable instruction set and an unreasonable instruction set; if the new control instruction matches reasonably, it will be released; if the match is unreasonable, it will be intercepted and the anomaly count will be counted; if the match fails, a comprehensive rationality score will be generated based on the network intrusion threat level, driving scenario, infotainment domain feature data and the new control instruction through the comprehensive rationality scoring model. Based on the comprehensive rationality score, the control instruction will be released or intercepted and the anomaly count will be counted. When the anomaly count reaches the preset maximum number of anomalies, an abnormal instruction will be generated to complete the intelligent adaptive control of network intrusion.

[0010] Furthermore, the method for intelligent adaptive control of network intrusion includes:

[0011] Input the driving scenario and network intrusion threat level into the instruction setting model to obtain the reasonable instruction set and unreasonable instruction set corresponding to the current driving scenario and network intrusion threat level; the initial value of the abnormality count variable is preset to 0;

[0012] When a new control instruction arrives at the CAN bus gateway, it is matched with the reasonable instruction set and the unreasonable instruction set respectively;

[0013] If the new control instruction successfully matches the reasonable instruction set, it is judged that the new control instruction is acceptable, and the CAN bus gateway allows the new control instruction to enter the vehicle power domain for execution; if the new control instruction successfully matches the unreasonable instruction set, it is judged that the new control instruction is unacceptable, the abnormality count variable is increased by one, and the CAN bus gateway intercepts the new control instruction and does not allow the new control instruction to enter the vehicle power domain;

[0014] If the new control instruction fails to match the reasonable instruction set and the unreasonable instruction set, further processing is performed on the new control instruction;

[0015] When the abnormality count variable is greater than or equal to the preset maximum number of abnormalities, the CAN bus gateway issues an abnormality instruction.

[0016] Furthermore, the method for further processing the new control instruction includes:

[0017] Input the network intrusion threat level, driving scenario, infotainment domain feature data, and new control instructions into the comprehensive rationality scoring model to obtain the corresponding comprehensive rationality score;

[0018] If the comprehensive rationality score is greater than or equal to the preset comprehensive rationality score threshold, the new control instruction is judged to be a reasonable instruction, the CAN bus gateway allows the new control instruction to enter the vehicle power domain for execution, and adds the new control instruction to the reasonable instruction set;

[0019] If the comprehensive rationality score is less than the preset comprehensive rationality score threshold, the new control instruction is judged to be an unreasonable instruction. The CAN bus gateway intercepts the new control instruction and does not allow the new control instruction to enter the vehicle power domain. The abnormal count variable is increased by one and the new control instruction is added to the unreasonable instruction set.

[0020] Furthermore, the message metadata of the infotainment domain CAN subnet includes a message identifier, a data length code, a message timestamp, an access port number, and a bus occupancy rate; and the method for acquiring the infotainment domain characteristic data includes:

[0021] Count the number of occurrences of each message identifier in groups according to the message identifier; construct each message identifier and the corresponding number of occurrences into a message identifier number tuple, that is, obtain BC message identifier number tuples, where the first digit of each message identifier number tuple is the message identifier, and the second digit is the number of occurrences corresponding to the message identifier;

[0022] Extract time series features based on BC message identification number tuples and corresponding message timestamps to obtain time series feature data corresponding to BC message identification number tuples;

[0023] Group and count the number of packets received by each access port per unit time. Construct each access port number and its corresponding number of packets into an access port count tuple, thus obtaining DK access port count tuples, where the first digit of each access port count tuple is the access port number, and the second digit is the number of packets received by the access port number.

[0024] Perform port distribution analysis based on DK access port count tuples to obtain port abnormality flags corresponding to the DK access port count tuples, where the port abnormality flags include yes and no;

[0025] Perform load analysis based on the data length code and the bus occupancy rate to obtain a load abnormality flag, wherein the load abnormality flag includes a yes or no flag;

[0026] The timing feature data corresponding to the BC message identification number tuples, the port abnormality identification and load abnormality identification corresponding to the DK access port count tuples are constructed into the infotainment domain feature data.

[0027] Furthermore, a method for obtaining time series feature data corresponding to BC message identification number tuples includes:

[0028] S100: Set the initial value of bc to 1, and the value range of bc is 1 to BC;

[0029] S101: Obtain the message timestamp corresponding to each occurrence of the message identifier in the bc-th message identifier number tuple, and obtain timestamp of the message and The message timestamps are constructed into a message timestamp time sequence corresponding to the bc-th message identification number tuple;

[0030] S102: Calculate the time interval between adjacent message timestamps based on the message timestamp time series, and obtain message timestamp interval;

[0031] S103: From Get the minimum and maximum values ​​of the message timestamp intervals from the message timestamp intervals; The average value of the message timestamp interval is calculated to obtain the message timestamp interval mean; The variance of the message timestamp interval is calculated to obtain the message timestamp interval variance;

[0032] S104: constructing the minimum value of the message timestamp interval, the maximum value of the message timestamp interval, the mean value of the message timestamp interval and the variance of the message timestamp interval into the time series feature data corresponding to the bc-th message identification number tuple;

[0033] S105: Let bc=bc+1. If bc is less than or equal to BC, continue executing S101 to S104. If bc is greater than BC, obtain the time series feature data corresponding to BC message identification number tuples, and end the current process.

[0034] Furthermore, a method for obtaining a port abnormality identifier corresponding to the DK access port count tuple includes:

[0035] S200: Let the initial value of dk be 1, and the value range of dk be 1 to DK; divide the unit time into T time sub-segments;

[0036] S201: Obtain the dkth access port number from the dkth access port count tuple; obtain the number of messages received by the dkth access port number from the dkth access port count tuple, and record it as the total number of received messages; count the number of messages received by the dkth access port number in each time sub-segment to obtain a message count sequence of the dkth access port number in T time sub-segments;

[0037] S202: Calculate the quotients of the number of messages in the message counting sequence and the total number of received messages in sequence to obtain a message counting proportion sequence;

[0038] S203: Calculate the variance based on the message count proportion sequence to obtain the message count proportion variance; if the message count proportion variance is greater than or equal to the preset message count proportion variance threshold, set the port abnormality flag corresponding to the dk-th access port count tuple to yes; if the message count proportion variance is less than the preset message count proportion variance threshold, set the port abnormality flag corresponding to the dk-th access port count tuple to no;

[0039] S204: Let dk=dk+1. If dk is less than or equal to DK, continue executing S201 to S203; if dk is greater than DK, end the current process.

[0040] Furthermore, the method for obtaining the load abnormality identifier includes:

[0041] S300: Divide the unit time into T time segments; set the initial value of t to 1, and the value range of t to be 1 to T; set the initial value of the load abnormality counting variable FZ to 0;

[0042] S301: Obtain the data length code and bus occupancy corresponding to the t-th time sub-segment;

[0043] S302: Calculate the load occupancy ratio corresponding to the t-th time sub-segment based on the data length code and the bus occupancy rate; if the load occupancy ratio is greater than or equal to a preset load occupancy ratio threshold, set FZ=FZ+1;

[0044] S303: Let t = t + 1. If t is less than or equal to T, continue S301 to S302; if t is greater than T, execute S304;

[0045] S304: Take FZ and T as the quotient to obtain the load abnormality ratio; if the load abnormality ratio is greater than or equal to the preset load abnormality ratio threshold, set the load abnormality flag to yes; if the load abnormality ratio is less than the preset load abnormality ratio threshold, set the load abnormality flag to no.

[0046] Furthermore, the method for obtaining the network intrusion threat level includes:

[0047] Inputting the infotainment domain feature data into the network intrusion diagnosis scoring model to obtain the network intrusion diagnosis score;

[0048] The network intrusion diagnosis score is matched with a pre-built network intrusion threat level matching table to obtain a corresponding network intrusion threat level; the network intrusion threat level matching table includes the network intrusion diagnosis score and the corresponding network intrusion threat level.

[0049] Furthermore, the method for acquiring the driving scene includes:

[0050] Divide the unit time into R time windows;

[0051] Acquire vehicle operating status data for R time windows in real time, the vehicle operating status data including vehicle speed, acceleration, braking status, steering angle, acceleration duration, braking duration, lane change signal status, lane keeping status, and yaw rate;

[0052] Based on the vehicle's current location information, the vehicle is associated with a pre-installed or online navigation map system to obtain the type of road the vehicle is on.

[0053] The vehicle operating status data and road type of R time windows are input into the driving scene recognition model to obtain the driving scene.

[0054] Furthermore, the training method of the instruction setting model includes:

[0055] Pre-collecting an instruction setting dataset, the instruction setting dataset including ZL groups of instruction setting data and a reasonable instruction set and an unreasonable instruction set corresponding to the ZL groups of instruction setting data, where ZL is a positive integer greater than 0, and the instruction setting data including driving scenarios and network intrusion threat levels; dividing the instruction setting dataset into a training set and a validation set, wherein the training set is used to train an instruction setting model, and the validation set is used to evaluate the generalization performance of the instruction setting model;

[0056] During the instruction setting model training process, minimizing the cross-entropy loss function is used as the optimization goal. An early stopping strategy is used to monitor the performance of the validation set, and the network parameters are continuously adjusted to optimize the model performance. When the prediction accuracy on the validation set reaches the expected accuracy, the instruction setting model is determined to have converged and training is stopped. The instruction setting model is trained using a deep neural network based on a multilayer perceptron.

[0057] The instruction setting data is converted into feature vectors; the input layer of the instruction setting model receives the feature vectors, and the nonlinear relationship in the data is extracted through the hidden layer. Finally, the output layer of the instruction setting model calculates the probability distribution of reasonable instruction sets and unreasonable instruction sets through the softmax activation function, and outputs the reasonable instruction sets and unreasonable instruction sets corresponding to the maximum probability as the final prediction results.

[0058] Compared with the prior art, the technical effects and advantages of the CAN bus gateway intelligent adaptive control method of the present invention are as follows:

[0059] The intelligent adaptive control method for a CAN bus gateway provided by the present invention constructs multidimensional infotainment domain feature data based on infotainment domain message metadata collected per unit time, including message identifier timing characteristics, access port abnormality status, and bus load abnormality indicators. This data is then combined with the vehicle's current driving scenario and the identified network intrusion diagnosis score to generate a corresponding network intrusion threat level, thus implementing a context-sensitive dynamic threat identification mechanism. Furthermore, based on the driving scenario and threat level, a set of reasonable and unreasonable instructions for the current environment is generated for real-time identification of control instructions received by the CAN bus gateway. If a control instruction does not belong to any of the preset sets, the control instruction credibility is assessed by integrating the threat level, driving scenario, control intent, and infotainment domain feature data into a comprehensive rationality scoring model. The instruction set is then dynamically updated based on the scoring results, thereby establishing an intelligent gateway control mechanism with self-learning and self-evolution capabilities.

[0060] Compared with traditional static filtering or single-rule-based command release methods, this application can intelligently adjust control permissions in different driving contexts and accurately block the execution paths of forged control frames or abnormal commands, significantly improving the anti-intrusion capability, response flexibility and control security of the on-board CAN bus system. It is suitable for intelligent driving vehicles, domain controller gateways or security management platforms based on vehicle-cloud collaboration, and has good engineering practical value and promotion prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is a schematic diagram of a CAN bus gateway intelligent adaptive control system according to embodiment 1 of the present invention;

[0062] Figure 2 This is a flow chart of a CAN bus gateway intelligent adaptive control method according to embodiment 2 of the present invention;

[0063] Figure 3 This is a flow chart of a CAN bus gateway intelligent adaptive control method according to embodiment 3 of the present invention;

[0064] Figure 4 A flow chart of a method for intelligent adaptive control of network intrusion;

[0065] Figure 5 A flow chart of a method for further processing new control instructions;

[0066] Figure 6 A flow chart of a method for acquiring feature data in the infotainment domain;

[0067] Figure 7 This is a mind map of the intelligent adaptive control method for CAN bus gateway. DETAILED DESCRIPTION

[0068] The technical solutions in the embodiments of the present invention will be described in detail, clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. It should be noted that the specific embodiments described below are only used to better illustrate and describe the technical solutions of the present invention, and are intended to enable those skilled in the art to better understand and implement the present invention, and should not be construed as limiting the scope of protection of the present invention. Without departing from the spirit and essence of the present invention, those skilled in the art may modify, adjust or make equivalent replacements based on the contents disclosed in the present invention, and these should all be regarded as the scope of protection of the present invention.

[0069] Example 1:

[0070] See also Figure 1 As shown, this embodiment discloses a CAN bus gateway intelligent adaptive control system, including a first processing module, a threat diagnosis module, a second processing module and an intelligent control module. Each module realizes data transmission through wired and / or wireless connections.

[0071] The first processing module analyzes and processes the message metadata of the infotainment domain CAN subnet received by the CAN bus gateway per unit time to obtain infotainment domain characteristic data; the message metadata of the infotainment domain CAN subnet includes a message identifier, data length code, message timestamp, access port number, and bus occupancy rate.

[0072] It should be noted that the message identifier is directly read through the CAN receive interrupt of the FPGA or MCU. The message identifier is used to identify the message type and the issuing ECU. FPGA, MCU, and ECU are core components of the vehicle's electronic system. FPGA stands for field-programmable gate array, MCU stands for microcontroller unit, and ECU stands for electronic control unit. The data length code (DLC) refers to the number of valid bytes in a message and is used to assist in message payload extraction and protocol determination. When receiving a message, the CAN controller automatically decodes the message's DLC field, which records the number of data bytes in the message's payload. The DLC is used to measure the size of the message payload and is a key parameter for subsequent load analysis, bus occupancy assessment, and fusion feature extraction.

[0073] The message timestamp is the high-precision time value when a message is sent or received. Each message is accessed by a hardware interface (such as CAN1, CAN2, or CAN3) upon reception. The receiving module automatically adds information about the physical port from which the message originates. The access port number can be assigned a port tag by the MCU / FPGA in the message forwarding logic or provided directly by the driver layer. The access port number is used to identify the physical interface location of the message's source and is essential for determining the cross-domain direction of messages, modeling port-level behavior, identifying port loads, and analyzing the injection paths of unauthorized devices. Bus occupancy is calculated by periodically counting the bus transmission time within a unit time window on the MCU side as the ratio of the bus transmission time to the total time. This bus transmission time can be derived from the number of bytes per message frame, the bit rate, and the inter-frame interval. It can also be accumulated in real time in the FPGA using a hardware counter. Bus occupancy reflects the current bandwidth utilization of the CAN bus and is a key indicator for identifying abnormal behaviors such as bus congestion, broadcast storms, and injection attacks.

[0074] like Figure 6 As shown, the method for obtaining the infotainment domain feature data includes:

[0075] Count the number of occurrences of each message identifier in groups according to the message identifier; construct each message identifier and the corresponding number of occurrences into a message identifier number tuple, that is, obtain BC message identifier number tuples, where the first digit of each message identifier number tuple is the message identifier, and the second digit is the number of occurrences corresponding to the message identifier;

[0076] Extract time series features based on BC message identification number tuples and corresponding message timestamps to obtain time series feature data corresponding to BC message identification number tuples;

[0077] Group and count the number of packets received by each access port per unit time. Construct each access port number and its corresponding number of packets into an access port count tuple, thus obtaining DK access port count tuples, where the first digit of each access port count tuple is the access port number, and the second digit is the number of packets received by the access port number.

[0078] Perform port distribution analysis based on DK access port count tuples to obtain port abnormality flags corresponding to the DK access port count tuples, where the port abnormality flags include yes and no;

[0079] Perform load analysis based on the data length code and the bus occupancy rate to obtain a load abnormality flag, wherein the load abnormality flag includes a yes or no flag;

[0080] The timing feature data corresponding to the BC message identification number tuples, the port abnormality identification and load abnormality identification corresponding to the DK access port count tuples are constructed into the infotainment domain feature data.

[0081] The method for obtaining the time series feature data corresponding to BC message identification number tuples includes:

[0082] S100: Set the initial value of bc to 1, and the value range of bc is 1 to BC;

[0083] S101: Obtain the message timestamp corresponding to each occurrence of the message identifier in the bc-th message identifier number tuple, and obtain timestamp of the message and The message timestamps are constructed into a message timestamp time sequence corresponding to the bc-th message identification number tuple;

[0084] S102: Calculate the time interval between adjacent message timestamps based on the message timestamp time series, and obtain message timestamp interval;

[0085] The method for obtaining the message timestamp interval includes:

[0086]

[0087] is the time interval between the i+1th message timestamp and the ith message timestamp in the message timestamp time series, is the i+1th message timestamp in the message timestamp time sequence, The i-th message timestamp in the message timestamp time series, i ranges from 1 to .

[0088] S103: From Get the minimum and maximum values ​​of the message timestamp intervals from the message timestamp intervals; The average value of the message timestamp interval is calculated to obtain the message timestamp interval mean; The variance of the message timestamp interval is calculated to obtain the message timestamp interval variance;

[0089] The method for obtaining the message timestamp interval mean value includes:

[0090] ;

[0091] in, is the mean value of the message timestamp interval corresponding to the bc-th message identification number tuple, i is the index variable, is the i-th message timestamp in the message timestamp time series.

[0092] The method for obtaining the message timestamp interval variance includes:

[0093] ;

[0094] in, The variance of the message timestamp interval corresponding to the bc-th message identification number tuple.

[0095] S104: constructing the minimum value of the message timestamp interval, the maximum value of the message timestamp interval, the mean value of the message timestamp interval and the variance of the message timestamp interval into the time series feature data corresponding to the bc-th message identification number tuple;

[0096] S105: Let bc=bc+1. If bc is less than or equal to BC, continue executing S101 to S104. If bc is greater than BC, obtain the time series feature data corresponding to BC message identification number tuples, and end the current process.

[0097] It should be noted that the timing feature data is used to describe the transmission frequency stability and behavior regularity of the message identifier within a unit time. An example of the timing feature data key information table is shown in Table 1.

[0098] Table 1 Key information table of time series feature data

[0099]

[0100] The method for obtaining the port abnormality identifier corresponding to the DK access port count tuple includes:

[0101] S200: Let the initial value of dk be 1, and the value range of dk be 1 to DK; divide the unit time into T time sub-segments;

[0102] S201: Obtain the dkth access port number from the dkth access port count tuple; obtain the number of messages received by the dkth access port number from the dkth access port count tuple, and record it as the total number of received messages; count the number of messages received by the dkth access port number in each time sub-segment to obtain a message count sequence of the dkth access port number in T time sub-segments;

[0103] For example, the message counting sequence is ,in Indicates the number of received messages in the Tth time subsegment.

[0104] S202: Calculate the quotients of the number of messages in the message counting sequence and the total number of received messages in sequence to obtain a message counting proportion sequence;

[0105] For example, the message count percentage sequence is ,in Indicates the percentage of packets in the Tth time subsegment.

[0106] S203: Calculate the variance based on the message count proportion sequence to obtain the message count proportion variance; if the message count proportion variance is greater than or equal to the preset message count proportion variance threshold, set the port abnormality flag corresponding to the dk-th access port count tuple to yes; if the message count proportion variance is less than the preset message count proportion variance threshold, set the port abnormality flag corresponding to the dk-th access port count tuple to no;

[0107] The message count ratio variance threshold can be dynamically set by experts in this field according to the real-time network status. For example, the message count ratio variance threshold can be set to .

[0108] S204: Let dk=dk+1. If dk is less than or equal to DK, continue executing S201 to S203; if dk is greater than DK, end the current process.

[0109] It should be noted that this application calculates the message proportion sequence based on the message count distribution of the access port in T time sub-segments within a unit time, and introduces the variance of the proportion sequence as a port behavior fluctuation measurement indicator; by comparing with the preset message count proportion variance threshold, it is determined whether the port has abnormal injection, broadcast behavior or burst communication trend, and outputs a binary port anomaly identifier to facilitate subsequent sandbox strategies or intrusion detection models to perform port-level linkage control.

[0110] The method for obtaining the load abnormality identifier includes:

[0111] S300: Divide the unit time into T time segments; set the initial value of t to 1, and the value range of t to be 1 to T; set the initial value of the load abnormality counting variable FZ to 0;

[0112] S301: Obtain the data length code and bus occupancy corresponding to the t-th time sub-segment;

[0113] S302: Calculate the load occupancy ratio corresponding to the t-th time sub-segment based on the data length code and the bus occupancy rate; if the load occupancy ratio is greater than or equal to a preset load occupancy ratio threshold, set FZ=FZ+1;

[0114] The method for calculating the load occupancy ratio includes:

[0115] ;

[0116] in, is the load occupancy ratio corresponding to the t-th time sub-segment, is the data length code of the t-th time sub-segment, is the bus occupancy rate of the t-th time sub-segment, is a small positive number, that is It approaches 0 to avoid calculation anomalies caused by the denominator being zero.

[0117] It should be noted that the load occupancy ratio reflects the length of data transmitted per unit occupancy rate. If the data load density in a certain time subsegment is abnormally high, it indicates a buildup of malicious packets or high-frequency injection. The load occupancy ratio threshold can be set based on the average load occupancy ratio and the standard deviation of the load occupancy ratio during historical normal operation. For example, the load occupancy ratio threshold can be set between 93% and 97%.

[0118] S303: Let t = t + 1. If t is less than or equal to T, continue S301 to S302; if t is greater than T, execute S304;

[0119] S304: Take FZ and T as the quotient to obtain the load abnormality ratio; if the load abnormality ratio is greater than or equal to the preset load abnormality ratio threshold, set the load abnormality flag to yes; if the load abnormality ratio is less than the preset load abnormality ratio threshold, set the load abnormality flag to no.

[0120] It's important to note that the load anomaly ratio measures the proportion of anomalies within a unit of time. If the percentage of anomaly subsegments exceeds the threshold, it indicates continuous or intensive load anomalies within that unit of time. For example, the load anomaly ratio threshold can be set between 20% and 30%.

[0121] By combining data length codes and bus occupancy, a more accurate bus load signature can be obtained, improving the ability to monitor and warn of abnormal CAN bus loads. This fusion of characteristic data can be used to identify potential network congestion or malicious occupancy, and anomaly identification through threshold judgment can achieve more efficient monitoring and management of the CAN bus.

[0122] The threat diagnosis module performs network intrusion analysis based on the characteristic data of the infotainment domain to obtain a network intrusion diagnosis score, and then classifies the network intrusion threat level based on the network intrusion diagnosis score.

[0123] The method for obtaining the network intrusion threat level includes:

[0124] Inputting the infotainment domain feature data into the network intrusion diagnosis scoring model to obtain the network intrusion diagnosis score;

[0125] The network intrusion diagnosis score is matched with a pre-built network intrusion threat level matching table to obtain a corresponding network intrusion threat level; the network intrusion threat level matching table includes the network intrusion diagnosis score and the corresponding network intrusion threat level.

[0126] An example of a network intrusion threat level matching table is shown in Table 2:

[0127] Table 2 Network intrusion threat level matching table

[0128]

[0129] The second processing module analyzes and processes the vehicle driving data within a unit time to obtain a driving scene.

[0130] The method for acquiring the driving scene includes:

[0131] The unit time is divided into R time windows; the length of the time window can be set to 5 seconds, 10 seconds or other configurable time granularity to support short-term behavior pattern analysis.

[0132] Acquire vehicle operating status data for R time windows in real time, the vehicle operating status data including vehicle speed, acceleration, braking status, steering angle, acceleration duration, braking duration, lane change signal status, lane keeping status, and yaw rate;

[0133] Based on the vehicle's current positioning information (such as GPS coordinates and heading), a query is performed on the pre-installed or online navigation map system to obtain the type of road the vehicle is on; the road types include but are not limited to: expressways, urban expressways, ordinary urban roads, urban branch roads, ring roads, interchange ramps, rural roads or unpaved roads, etc.

[0134] The vehicle operating status data and road types of R time windows are input into the driving scenario recognition model to obtain driving scenarios; the driving scenarios include high-speed cruising, normal cruising, aggressive driving, low-speed commuting in the city, following a vehicle in urban congestion, cornering, long-term braking downhill, starting phase and sudden acceleration overtaking, etc.

[0135] The training method of the driving scene recognition model includes:

[0136] Pre-constructing a driving scene recognition dataset, the driving scene recognition dataset comprising Y groups of driving scene recognition data and driving scenes corresponding to the Y groups of driving scene recognition data, where Y is a positive integer greater than 0, and the driving scene recognition data comprising vehicle operating status data and road type; dividing the driving scene recognition dataset into a driving scene recognition data training set and a driving scene recognition data validation set, wherein the driving scene recognition data training set is used for parameter learning of a driving scene recognition model, and the driving scene recognition data validation set is used for real-time evaluation of the generalization ability of the driving scene recognition model;

[0137] During the training process of the driving scene recognition model, a decision tree model or a random forest model is used to convert the driving scene recognition data into a feature vector as input, and the nonlinear features in the data are extracted through the hidden layer. Finally, the softmax activation function is used in the output layer to generate the probability distribution of the driving scene, and the driving scene corresponding to the maximum probability is output as the final prediction result; the training process aims to minimize the cross-entropy loss function, and at the same time introduces an early stopping strategy to monitor the performance of the driving scene recognition data validation set. When the prediction accuracy on the driving scene recognition data validation set reaches the preset accuracy, the driving scene recognition model is judged to have converged and the training stops immediately.

[0138] The intelligent control module generates reasonable and unreasonable instruction sets based on the driving scenario and network intrusion threat level through the instruction setting model. If the new control instruction matches reasonably, it will be released; if the match is unreasonable, it will be intercepted and the anomaly count will be counted. If the match fails, a comprehensive rationality score will be generated based on the network intrusion threat level, driving scenario, infotainment domain feature data and the new control instruction through the comprehensive rationality scoring model. Based on the comprehensive rationality score, the control instruction will be released or intercepted and the anomaly count will be counted. When the anomaly count reaches the preset maximum number of anomalies, an abnormal instruction will be generated to complete the intelligent adaptive control of network intrusion.

[0139] like Figure 4 As shown, the method for intelligent adaptive control of network intrusion includes:

[0140] Input the driving scenario and network intrusion threat level into the instruction setting model to obtain the reasonable instruction set and unreasonable instruction set corresponding to the current driving scenario and network intrusion threat level; the initial value of the abnormality count variable is preset to 0;

[0141] When a new control instruction arrives at the CAN bus gateway, it is matched with the reasonable instruction set and the unreasonable instruction set respectively;

[0142] If the new control instruction successfully matches the reasonable instruction set, it is judged that the new control instruction is acceptable, and the CAN bus gateway allows the new control instruction to enter the vehicle power domain for execution; if the new control instruction successfully matches the unreasonable instruction set, it is judged that the new control instruction is unacceptable, the abnormality count variable is increased by one, and the CAN bus gateway intercepts the new control instruction and does not allow the new control instruction to enter the vehicle power domain;

[0143] If the new control instruction fails to match the reasonable instruction set and the unreasonable instruction set, further processing is performed on the new control instruction;

[0144] When the exception count variable is greater than or equal to a preset maximum number of exceptions (for example, the maximum number of exceptions can be set to 3), the CAN bus gateway issues an exception instruction.

[0145] like Figure 5 As shown, the method for further processing the new control instruction includes:

[0146] Input the network intrusion threat level, driving scenario, infotainment domain feature data, and new control instructions into the comprehensive rationality scoring model to obtain the corresponding comprehensive rationality score;

[0147] If the comprehensive rationality score is greater than or equal to the preset comprehensive rationality score threshold, the new control instruction is judged to be a reasonable instruction, the CAN bus gateway allows the new control instruction to enter the vehicle power domain for execution, and adds the new control instruction to the reasonable instruction set;

[0148] If the comprehensive rationality score is less than the preset comprehensive rationality score threshold, the new control instruction is judged to be an unreasonable instruction. The CAN bus gateway intercepts the new control instruction and does not allow the new control instruction to enter the vehicle power domain. The abnormal count variable is increased by one and the new control instruction is added to the unreasonable instruction set.

[0149] It should be noted that the comprehensive rationality score ranges from 0 to 1, inclusive. The larger the value of the comprehensive rationality score, the higher the rationality of the new control instruction. The comprehensive rationality score threshold can be set between 0.7 and 0.8, inclusive. For example, in this application, the comprehensive rationality score threshold can be set to 0.75.

[0150] The training method of the instruction setting model includes:

[0151] Pre-collecting an instruction setting dataset, the instruction setting dataset including ZL groups of instruction setting data and a reasonable instruction set and an unreasonable instruction set corresponding to the ZL groups of instruction setting data, where ZL is a positive integer greater than 0, and the instruction setting data including driving scenarios and network intrusion threat levels; dividing the instruction setting dataset into a training set and a validation set, wherein the training set is used to train an instruction setting model, and the validation set is used to evaluate the generalization performance of the instruction setting model;

[0152] During the instruction setting model training process, minimizing the cross-entropy loss function is used as the optimization goal. An early stopping strategy is used to monitor the performance of the validation set, and the network parameters are continuously adjusted to optimize the model performance. When the prediction accuracy on the validation set reaches the expected accuracy, the instruction setting model is determined to have converged and training is stopped. The instruction setting model is trained using a deep neural network based on a multilayer perceptron.

[0153] The instruction setting data is converted into feature vectors; the input layer of the instruction setting model receives the feature vectors, and the nonlinear relationship in the data is extracted through the hidden layer. Finally, the output layer of the instruction setting model calculates the probability distribution of reasonable instruction sets and unreasonable instruction sets through the softmax activation function, and outputs the reasonable instruction sets and unreasonable instruction sets corresponding to the maximum probability as the final prediction results.

[0154] It should be noted that the division of instruction sets under driving scenarios and network intrusion threat levels is shown in Table 3:

[0155] Table 3 Mapping table of driving scenarios and network intrusion threat level commands

[0156]

[0157] The training method of the comprehensive rationality scoring model includes:

[0158] Preliminarily collecting a comprehensive rationality score dataset, the comprehensive rationality score dataset including HL group comprehensive rationality score data and comprehensive rationality scores corresponding to the HL group comprehensive rationality score data, where HL is a positive integer greater than 0, and the comprehensive rationality score data including network intrusion threat level, driving scenario, infotainment domain feature data, and new control instructions; dividing the comprehensive rationality score dataset into a training set and a validation set, wherein the training set is used to train a comprehensive rationality score model, and the validation set is used to evaluate the generalization performance of the comprehensive rationality score model;

[0159] During the training process of the comprehensive rationality scoring model, minimizing the cross entropy loss function is used as the optimization goal. The performance of the validation set is monitored using an early stopping strategy, and the model performance is optimized by continuously adjusting the network parameters. When the prediction accuracy on the validation set reaches the expected accuracy, it is determined that the comprehensive rationality scoring model has converged and training is stopped. The comprehensive rationality scoring model is trained using a support vector machine model.

[0160] The comprehensive rationality score data is converted into feature vectors; the input layer of the comprehensive rationality score model receives the feature vectors, and the nonlinear relationship in the data is extracted through the hidden layer. Finally, the output layer of the comprehensive rationality score model calculates the probability distribution of the comprehensive rationality score through the softmax activation function, and outputs the comprehensive rationality score corresponding to the maximum probability as the final prediction result.

[0161] It should be noted that Figure 7 This is a brain diagram of the intelligent adaptive control method for the CAN bus gateway. This application introduces the multi-dimensional communication behavior characteristics of the infotainment domain as the basis for intrusion diagnosis, combines the semantic context of the vehicle's current driving scenario, builds a fusion network threat scoring mechanism, and sets a dynamically scalable set of reasonable and unreasonable instructions based on the network intrusion threat level, thereby realizing intelligent filtering, linkage judgment, and adaptive learning updates of key control commands. This method not only improves the judgment accuracy and environmental adaptability of the vehicle-mounted network security strategy, but also has sustainable evolution capabilities. It is suitable for intelligent gateways, domain controllers, and dynamic instruction management systems based on vehicle-road collaboration scenarios.

[0162] Example 2:

[0163] See also Figure 2 As shown, this embodiment provides a CAN bus gateway intelligent adaptive control method, including:

[0164] Analyze and process the message metadata of the infotainment domain CAN subnet received by the CAN bus gateway within a unit time to obtain infotainment domain feature data;

[0165] Conduct network intrusion analysis based on infotainment domain feature data to obtain a network intrusion diagnosis score, and then categorize the network intrusion threat level based on the network intrusion diagnosis score;

[0166] Analyze and process vehicle driving data per unit time to obtain driving scenarios;

[0167] Based on the driving scenario and the network intrusion threat level, the instruction setting model generates a reasonable instruction set and an unreasonable instruction set; if the new control instruction matches reasonably, it will be released; if the match is unreasonable, it will be intercepted and the anomaly count will be counted; if the match fails, a comprehensive rationality score will be generated based on the network intrusion threat level, driving scenario, infotainment domain feature data and the new control instruction through the comprehensive rationality scoring model. Based on the comprehensive rationality score, the control instruction will be released or intercepted and the anomaly count will be counted. When the anomaly count reaches the preset maximum number of anomalies, an abnormal instruction will be generated to complete the intelligent adaptive control of network intrusion.

[0168] Example 3:

[0169] See also Figure 3 As shown, this embodiment provides a CAN bus gateway intelligent adaptive control method, which also includes:

[0170] The comprehensive rationality score threshold is dynamically set based on the network intrusion threat level, driving scenario and infotainment domain feature data.

[0171] Methods for dynamically setting comprehensive rationality score thresholds based on network intrusion threat levels, driving scenarios, and infotainment domain feature data include:

[0172] The network intrusion threat level, driving scenario and infotainment domain feature data are input into the comprehensive rationality score threshold model to obtain a dynamically set comprehensive rationality score threshold.

[0173] The training method of the comprehensive rationality scoring threshold model includes:

[0174] Pre-constructing a comprehensive rationality score threshold data set, the comprehensive rationality score threshold data set including ZH group comprehensive rationality score threshold data and comprehensive rationality score thresholds corresponding to the ZH group comprehensive rationality score threshold data, where ZH is a positive integer greater than 0, and the comprehensive rationality score threshold data including network intrusion threat level, driving scenario, and infotainment domain feature data; dividing the comprehensive rationality score threshold data set into a comprehensive rationality score threshold data training set and a comprehensive rationality score threshold data validation set, wherein the comprehensive rationality score threshold data training set is used for parameter learning of a comprehensive rationality score threshold model, and the comprehensive rationality score threshold data validation set is used for real-time evaluation of the generalization ability of the comprehensive rationality score threshold model;

[0175] During the training process of the comprehensive rationality score threshold model, a deep neural network structure based on multi-layer perceptron is adopted to convert the comprehensive rationality score threshold data into a feature vector as input, extract the nonlinear features in the data through the hidden layer, and finally use the softmax activation function in the output layer to generate the probability distribution of the comprehensive rationality score threshold, and output the comprehensive rationality score threshold corresponding to the maximum probability as the final prediction result; the training process aims to minimize the cross-entropy loss function, and at the same time introduces an early stopping strategy to monitor the performance of the comprehensive rationality score threshold data validation set. When the prediction accuracy on the comprehensive rationality score threshold data validation set reaches the preset accuracy, it is determined that the comprehensive rationality score threshold model has converged and the training stops immediately.

[0176] It's important to note that by integrating network intrusion threat levels, driving scenarios, and infotainment domain feature data into the comprehensive plausibility scoring threshold model, a comprehensive plausibility scoring threshold is dynamically generated based on the current context. This effectively improves the flexibility and scenario-specific adaptability of control command credibility assessments. On the one hand, the system's tolerance for control commands varies under different threat levels. For example, at low threat levels, the judgment threshold can be appropriately relaxed to reduce false rejection rates, while at high threat levels, the judgment threshold needs to be increased to ensure system safety. On the other hand, the vehicle's risk sensitivity to control commands also varies under different driving scenarios. For example, in complex and dynamic scenarios like high-speed cruising or cornering, the system should strictly control command release, while in parking or slow-moving scenarios, the restrictions can be relaxed. Furthermore, by integrating infotainment domain feature data, the system can perceive current network behavior. For example, when communication anomalies, port anomalies, or message timing anomalies occur, the system can adaptively increase the comprehensive plausibility scoring threshold, thereby building a more robust security policy system.

[0177] Through the above-mentioned multi-dimensional feature joint modeling and dynamic threshold adjustment mechanism, problems such as "over-release" or "false alarm blocking" caused by the use of fixed scoring thresholds in traditional systems are avoided, an adaptive balance between security and availability is achieved, and the intelligent control capabilities and decision-making accuracy of the CAN bus gateway system in complex environments are enhanced.

[0178] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

[0179] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A CAN bus gateway intelligent adaptive control method, characterized in that: include: Analyze and process the message metadata of the infotainment domain CAN subnet received by the CAN bus gateway within a unit time to obtain infotainment domain feature data; Conduct network intrusion analysis based on infotainment domain feature data to obtain a network intrusion diagnosis score, and then categorize the network intrusion threat level based on the network intrusion diagnosis score; Analyze and process vehicle driving data per unit time to obtain driving scenarios; The driving scenario and network intrusion threat level are input into the instruction setting model to obtain the corresponding reasonable instruction set and unreasonable instruction set under the current driving scenario and network intrusion threat level. If the new control instruction matches reasonably, it will be released; if the match is unreasonable, it will be intercepted and the anomaly count will be counted. If the match fails, a comprehensive rationality score is generated by the comprehensive rationality scoring model based on the network intrusion threat level, driving scenario, infotainment domain feature data and new control instruction. Based on the comprehensive rationality score, the control instruction will be released or intercepted and the anomaly count will be counted. When the anomaly count reaches the preset maximum number of anomalies, an abnormal instruction will be generated to complete the intelligent adaptive control of network intrusion.

2. A CAN bus gateway intelligent adaptive control method according to claim 1, characterized in that: Methods for intelligent adaptive control of network intrusions include: The initial value of the preset exception count variable is 0; When a new control instruction arrives at the CAN bus gateway, it is matched with the reasonable instruction set and the unreasonable instruction set respectively; If the new control instruction successfully matches the reasonable instruction set, it is judged that the new control instruction is acceptable, and the CAN bus gateway allows the new control instruction to enter the vehicle power domain for execution; if the new control instruction successfully matches the unreasonable instruction set, it is judged that the new control instruction is unacceptable, the abnormality count variable is increased by one, and the CAN bus gateway intercepts the new control instruction and does not allow the new control instruction to enter the vehicle power domain; If the new control instruction fails to match the reasonable instruction set and the unreasonable instruction set, further processing is performed on the new control instruction; When the abnormality count variable is greater than or equal to the preset maximum number of abnormalities, the CAN bus gateway issues an abnormality instruction.

3. A CAN bus gateway intelligent adaptive control method according to claim 2, characterized in that: Methods for further processing of new control instructions include: Input the network intrusion threat level, driving scenario, infotainment domain feature data, and new control instructions into the comprehensive rationality scoring model to obtain the corresponding comprehensive rationality score; If the comprehensive rationality score is greater than or equal to the preset comprehensive rationality score threshold, the new control instruction is judged to be a reasonable instruction, the CAN bus gateway allows the new control instruction to enter the vehicle power domain for execution, and adds the new control instruction to the reasonable instruction set; If the comprehensive rationality score is less than the preset comprehensive rationality score threshold, the new control instruction is judged to be an unreasonable instruction. The CAN bus gateway intercepts the new control instruction and does not allow the new control instruction to enter the vehicle power domain. The abnormal count variable is increased by one and the new control instruction is added to the unreasonable instruction set.

4. A CAN bus gateway intelligent adaptive control method according to claim 1, characterized in that: The message metadata of the infotainment domain CAN subnet includes the message identifier, data length code, message timestamp, access port number, and bus occupancy rate; The method for acquiring the infotainment domain feature data includes: Count the number of occurrences of each message identifier in groups according to the message identifier; construct each message identifier and the corresponding number of occurrences into a message identifier number tuple, that is, obtain BC message identifier number tuples, where the first digit of each message identifier number tuple is the message identifier, and the second digit is the number of occurrences corresponding to the message identifier; Extract time series features based on BC message identification number tuples and corresponding message timestamps to obtain time series feature data corresponding to BC message identification number tuples; Group and count the number of packets received by each access port per unit time. Construct each access port number and its corresponding number of packets into an access port count tuple, thus obtaining DK access port count tuples, where the first digit of each access port count tuple is the access port number, and the second digit is the number of packets received by the access port number. Perform port distribution analysis based on DK access port count tuples to obtain port abnormality flags corresponding to the DK access port count tuples, where the port abnormality flags include yes and no; Perform load analysis based on the data length code and the bus occupancy rate to obtain a load abnormality flag, wherein the load abnormality flag includes a yes or no flag; The timing feature data corresponding to the BC message identification number tuples, the port abnormality identification and load abnormality identification corresponding to the DK access port count tuples are constructed into the infotainment domain feature data.

5. A CAN bus gateway intelligent adaptive control method according to claim 4, characterized in that: The method for obtaining the time series feature data corresponding to BC message identification number tuples includes: S100: Set the initial value of bc to 1, and the value range of bc is 1 to BC; S101: Obtain the message timestamp corresponding to each occurrence of the message identifier in the bc-th message identifier number tuple, and obtain timestamp of the message and The message timestamps are constructed into a message timestamp time sequence corresponding to the bc-th message identification number tuple; S102: Calculate the time interval between adjacent message timestamps based on the message timestamp time series, and obtain message timestamp interval; S103: From Get the minimum and maximum values ​​of the message timestamp intervals from the message timestamp intervals; The average value of the message timestamp interval is calculated to obtain the message timestamp interval mean; The variance of the message timestamp interval is calculated to obtain the message timestamp interval variance; S104: constructing the minimum value of the message timestamp interval, the maximum value of the message timestamp interval, the mean value of the message timestamp interval and the variance of the message timestamp interval into the time series feature data corresponding to the bc-th message identification number tuple; S105: Let bc=bc+1. If bc is less than or equal to BC, continue executing S101 to S104. If bc is greater than BC, obtain the time series feature data corresponding to BC message identification number tuples, and end the current process.

6. A CAN bus gateway intelligent adaptive control method according to claim 4, characterized in that: The method for obtaining the port abnormality identifier corresponding to the DK access port count tuple includes: S200: Let the initial value of dk be 1, and the value range of dk be 1 to DK; divide the unit time into T time sub-segments; S201: Obtain the dkth access port number from the dkth access port count tuple; obtain the number of messages received by the dkth access port number from the dkth access port count tuple, and record it as the total number of received messages; count the number of messages received by the dkth access port number in each time sub-segment to obtain a message count sequence of the dkth access port number in T time sub-segments; S202: Calculate the quotients of the number of messages in the message counting sequence and the total number of received messages in sequence to obtain a message counting proportion sequence; S203: Calculate the variance based on the message count proportion sequence to obtain the message count proportion variance; if the message count proportion variance is greater than or equal to the preset message count proportion variance threshold, set the port abnormality flag corresponding to the dk-th access port count tuple to yes; if the message count proportion variance is less than the preset message count proportion variance threshold, set the port abnormality flag corresponding to the dk-th access port count tuple to no; S204: Let dk=dk+1. If dk is less than or equal to DK, continue executing S201 to S203; if dk is greater than DK, end the current process.

7. A CAN bus gateway intelligent adaptive control method according to claim 4, characterized in that: The method for obtaining the load abnormality identifier includes: S300: Divide the unit time into T time segments; set the initial value of t to 1, and the value range of t to be 1 to T; set the initial value of the load abnormality counting variable FZ to 0; S301: Obtain the data length code and bus occupancy corresponding to the t-th time sub-segment; S302: Calculate the load occupancy ratio corresponding to the t-th time sub-segment based on the data length code and the bus occupancy rate; if the load occupancy ratio is greater than or equal to a preset load occupancy ratio threshold, set FZ=FZ+1; S303: Let t = t + 1. If t is less than or equal to T, continue S301 to S302; if t is greater than T, execute S304; S304: Take FZ and T as the quotient to obtain the load abnormality ratio; if the load abnormality ratio is greater than or equal to the preset load abnormality ratio threshold, set the load abnormality flag to yes; if the load abnormality ratio is less than the preset load abnormality ratio threshold, set the load abnormality flag to no.

8. The CAN bus gateway intelligent adaptive control method according to claim 1, characterized in that: The method for obtaining the network intrusion threat level includes: Inputting the infotainment domain feature data into the network intrusion diagnosis scoring model to obtain the network intrusion diagnosis score; The network intrusion diagnosis score is matched with a pre-built network intrusion threat level matching table to obtain a corresponding network intrusion threat level; the network intrusion threat level matching table includes the network intrusion diagnosis score and the corresponding network intrusion threat level.

9. A CAN bus gateway intelligent adaptive control method according to claim 1, characterized in that: The method for acquiring the driving scene includes: Divide the unit time into R time windows; Acquire vehicle operating status data for R time windows in real time, the vehicle operating status data including vehicle speed, acceleration, braking status, steering angle, acceleration duration, braking duration, lane change signal status, lane keeping status, and yaw rate; Based on the vehicle's current location information, the vehicle is associated with a pre-installed or online navigation map system to obtain the type of road the vehicle is on. The vehicle operating status data and road type of R time windows are input into the driving scene recognition model to obtain the driving scene.

10. The CAN bus gateway intelligent adaptive control method according to claim 2, characterized in that: The training method of the instruction setting model includes: Pre-collecting an instruction setting dataset, the instruction setting dataset including ZL groups of instruction setting data and a reasonable instruction set and an unreasonable instruction set corresponding to the ZL groups of instruction setting data, where ZL is a positive integer greater than 0, and the instruction setting data including driving scenarios and network intrusion threat levels; dividing the instruction setting dataset into a training set and a validation set, wherein the training set is used to train an instruction setting model, and the validation set is used to evaluate the generalization performance of the instruction setting model; During the instruction setting model training process, minimizing the cross-entropy loss function is used as the optimization goal. An early stopping strategy is used to monitor the performance of the validation set, and the model performance is optimized by continuously adjusting the network parameters. Training is stopped when the prediction accuracy on the validation set reaches the expected accuracy. The instruction setting model is trained using a deep neural network based on a multilayer perceptron. The instruction setting data is converted into feature vectors; the input layer of the instruction setting model receives the feature vectors, and the nonlinear relationship in the data is extracted through the hidden layer. The output layer of the instruction setting model calculates the probability distribution of reasonable instruction sets and unreasonable instruction sets through the softmax activation function, and outputs the reasonable instruction sets and unreasonable instruction sets corresponding to the maximum probability as the final prediction results.

Images