Vehicle-mounted gateway message real-time anomaly detection method, system and device and vehicle

Abstract

The invention provides a vehicle-mounted gateway message real-time anomaly detection method, system and device and a vehicle, and relates to the technical field of intelligent driving, and the method comprises the steps: firstly, collecting and preprocessing the message data of a vehicle-mounted gateway, and guaranteeing the data structuring for subsequent analysis; next, stream processing and timestamp alignment are carried out by adopting an adaptive window adjustment strategy to effectively cope with network flow fluctuation, and an ordered real-time data stream is generated; a plurality of key message features including delay, packet loss rate, content consistency and the like are extracted from the data, intelligent anomaly detection is performed by using a deep learning model in combination with a dynamic threshold value, and an abnormal message is accurately identified; and finally, based on a detection result, alarm information is sent through a message queue, and a data mining technology is used for automatically analyzing an abnormal reason, so that root cause positioning and report generation are realized, the safety and the stability of a vehicle-mounted network are effectively improved, and powerful technical support is provided for reliable operation of the vehicle.

Description

Technical Field

[0001] This invention relates to the field of intelligent driving technology, and in particular to a method, system, device, and vehicle for real-time anomaly detection of in-vehicle gateway messages. Background Technology

[0002] Anomaly detection in vehicle gateway messages is crucial for ensuring the security and reliability of vehicle network communication. It not only helps prevent security risks caused by communication failures but also improves the overall performance of the vehicle network, providing a solid guarantee for the stable operation of intelligent driving and other critical vehicle systems. Current technologies for anomaly detection in vehicle gateway message forwarding mainly rely on simple statistical analysis and fixed threshold judgments. This method suffers from low detection accuracy and poor real-time performance when facing the complex communication requirements of modern automotive electronic systems, making it difficult to meet the increasing security and reliability demands. Therefore, an improved technology is urgently needed to enhance the accuracy and real-time response capabilities of anomaly detection. Summary of the Invention

[0003] The purpose of this invention is to provide a method, system, device, and vehicle for real-time anomaly detection of vehicle gateway messages, in order to solve one or more technical problems existing in the prior art, or at least provide a beneficial option or create conditions.

[0004] The solution to the technical problem of this invention is as follows: On the one hand, this invention provides a method for real-time anomaly detection of vehicle gateway messages, comprising the following steps: Collect and preprocess the message data sent and received by the vehicle gateway to obtain structured message data; An adaptive window adjustment strategy is adopted to perform stream processing and timestamp alignment on the structured message data to obtain a real-time data stream; Message features are extracted from the real-time data stream; the message features include message delay, packet loss rate, message content consistency, message sequence features, network traffic features, historical anomaly features, and cross-module message timing correlation features. By using a deep learning model and combining it with a dynamic anomaly threshold, anomaly detection is performed on the message features to obtain abnormal message data. Based on the abnormal message data and its characteristics, real-time alarm information is sent through a message queue, and data mining technology is used to automatically analyze the abnormal message data and trace the cause of the abnormality, outputting the root cause location result and generating an abnormal report.

[0005] Furthermore, the step of employing an adaptive window adjustment strategy to perform stream processing on the structured message data to obtain a real-time data stream includes the following steps: Real-time monitoring of the current load status of the vehicle gateway and the data inflow rate of the structured message data; obtaining network traffic fluctuation values, message arrival time interval variance, and historical window processing delay indicators. When the network traffic fluctuation value exceeds the preset traffic threshold, or the variance of the packet arrival time interval is greater than the preset interval benchmark value, dynamic window adjustment is triggered; Based on the network load status, the data inflow rate, and the historical window processing latency index, a machine learning model is used to calculate the optimal window duration and optimal window capacity for the current window. A sliding window mechanism is used to segment the structured message data: if the number of structured message data in the current window does not reach the lower limit of the optimal window capacity and its time length does not reach the upper limit of the optimal window time length, then the current window remains open to continue receiving the structured message data; otherwise, the current window is closed and the next window is started. The structured message data within the closed window is subjected to integrity verification, discontinuous messages across windows are removed, and the window data that passes the verification is converted into an ordered data stream sorted by timestamp, which is then output as the real-time data stream.

[0006] Further, the cross-module message timing correlation features are extracted from the real-time data stream, including the following steps: Based on message metadata identifiers, the boundaries of functional modules are identified, and the interaction messages of different modules are distinguished; the functional modules include the power module, the body module, and the intelligent driving module; Based on the global timestamp, extract the interaction message pairs between different modules within the same sliding time window to construct a cross-module interaction time sequence; Based on the cross-module interaction timing sequence, the fixed delay association rules, sequence dependency association rules, and frequency synchronization association rules of the cross-module are analyzed, and the timing association feature values ​​are quantified to generate the cross-module message timing association features, including delay deviation, sequence violation rate, and frequency mismatch.

[0007] Furthermore, the step of using a deep learning model, combined with a dynamic anomaly threshold, to perform anomaly detection on the message features and obtain abnormal message data includes the following steps: The message features are preprocessed by normalization to generate a standardized feature tensor; According to the preset time window, the standardized feature tensor is input into the deep learning model to calculate the three-dimensional anomaly score at each time step, and the three-dimensional dynamic anomaly threshold for the current time window is generated based on the statistics of normal message features within the current time window; the three-dimensional anomaly score includes delay anomaly confidence, packet loss anomaly confidence, and content anomaly confidence. The three-dimensional anomaly score is compared with the three-dimensional dynamic anomaly threshold in real time. If the anomaly score of any dimension exceeds the corresponding dynamic anomaly threshold, the time step is marked as an anomaly. The time step marked as abnormal is time-aligned with the original message in the real-time data stream to extract the complete context of the abnormal message and generate abnormal message data, including abnormal type, abnormal time, abnormal message content and associated context.

[0008] Furthermore, the deep learning model includes an LSTM model and a Siamese Network model; the step of inputting the standardized feature tensor into the deep learning model according to a preset time window and calculating the three-dimensional anomaly score at each time step includes the following steps: According to the preset time window, the standardized feature tensor is input into the LSTM model to calculate the delay anomaly confidence and packet loss anomaly confidence at each time step; According to the preset time window, the standardized feature tensor is input into the Siamese Network model to calculate the content anomaly confidence at each time step.

[0009] Furthermore, the step of sending real-time alarm information through a message queue based on the abnormal message data and its characteristics, and using data mining technology to automatically analyze the abnormal message data and trace the cause of the anomaly, outputting the root cause location result and generating an anomaly report, includes the following steps: Based on the abnormal message data and its characteristics, a structured alarm template is automatically filled in, and real-time alarm information is sent through a low-latency message queue. The abnormal message data and its message characteristics are cleaned and context parameters are added to generate an enhanced abnormal dataset; Based on the enhanced anomaly dataset, time-series pattern mining, association rule analysis, and cluster analysis are performed to identify the time distribution pattern, module association diagram, and key patterns of the anomaly message data, and anomaly analysis results are generated. By combining the vehicle network topology, protocol specifications, and historical knowledge base, a causal reasoning model is constructed. The root cause is inferred through the causal forest algorithm, and the root cause location result is generated. The causal reasoning model includes a causal graph that associates module states, network parameters, and abnormal phenomena. The anomaly report is generated by integrating the anomaly analysis results and the root cause localization results.

[0010] Furthermore, based on the enhanced anomaly dataset, the process of performing time-series pattern mining, association rule analysis, and cluster analysis to identify the time distribution patterns, module association graphs, and key patterns of the anomaly message data, and generating anomaly analysis results, includes the following steps: The enhanced anomaly dataset is subjected to time normalization, module encoding, feature extraction, and anomaly label cleaning to generate a structured analysis dataset. Temporal pattern mining is performed on the structured analysis dataset. By dividing the time window, periodic detection, trend detection, and abrupt change point detection, the temporal distribution pattern of the abnormal message data is identified. Based on the structured analysis dataset, construct an abnormal event transaction set, mine frequent itemsets and generate strong association rules, locate the abnormal propagation path, and output a module association graph associated with the abnormal type. Cluster analysis is performed on the structured analysis dataset. The abnormal message data is grouped based on high discriminative features. The statistical characteristics of each group are summarized, and the key patterns of the abnormal message data are identified. By integrating the time distribution patterns, module association diagrams, and key patterns of the abnormal message data, and through cross-validation of matching, anomaly analysis results are generated.

[0011] On the other hand, this application provides a real-time anomaly detection system for vehicle gateway messages, used to execute the aforementioned real-time anomaly detection method for vehicle gateway messages.

[0012] On the other hand, this application provides a real-time anomaly detection device for vehicle gateway messages, including a processor and a memory; the memory stores a computer program, and the processor executes the computer program to implement the aforementioned real-time anomaly detection method for vehicle gateway messages.

[0013] On the other hand, this application provides a vehicle that integrates the aforementioned vehicle gateway message real-time anomaly detection device.

[0014] The beneficial effects of this invention are as follows: This application provides a real-time anomaly detection method for vehicle gateway messages. The method includes: first, collecting and preprocessing message data from the vehicle gateway to ensure data structuring for subsequent analysis; then, employing an adaptive window adjustment strategy for stream processing and timestamp alignment to effectively address network traffic fluctuations and generate an ordered real-time data stream; extracting various key message features, including latency, packet loss rate, and content consistency, from this data, and using a deep learning model combined with dynamic thresholds for intelligent anomaly detection to accurately identify abnormal messages; finally, based on the detection results, sending alarm information through a message queue, and using data mining technology to automatically analyze the causes of anomalies, achieving root cause localization and report generation, effectively improving the security and stability of the vehicle network and providing strong technical support for the reliable operation of vehicles. This application also provides corresponding systems, devices, and vehicles. The beneficial effects of the systems, devices, and vehicles are similar to those of the method and will not be elaborated here.

[0015] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0016] The accompanying drawings are provided to further understand the technical solutions of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the technical solutions of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

[0017] Figure 1 This is a flowchart of the real-time anomaly detection method for vehicle gateway messages provided in this application; Figure 2 This is a structural diagram of the vehicle gateway message real-time anomaly detection system provided in this application; Figure 3 This is a structural diagram of the vehicle gateway message real-time anomaly detection device provided in this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0019] The present application will be further described below with reference to the accompanying drawings and specific embodiments. The described embodiments should not be considered as limitations on the present application, and all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present application.

[0020] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0022] With the increasing complexity and intelligence of automotive electronic systems, the security and reliability of information exchange in in-vehicle networks have become paramount. As the core hub for data exchange between different in-vehicle networks, the stable operation of the in-vehicle gateway directly affects the overall performance and safety of the vehicle. Existing methods for detecting anomalies in automotive gateway packet forwarding mainly rely on simple statistical analysis and preset fixed thresholds for judgment. These methods typically include the following aspects.

[0023] Specifically, rule-based methods detect message anomalies, such as message loss or delay, by setting a series of fixed rules. Threshold-based methods monitor various message attributes (e.g., latency, packet loss rate) by setting certain thresholds; anomalies are considered to occur once these thresholds are exceeded. Predictive methods based on simple models use basic mathematical models or statistical methods to model message behavior and identify anomalous behavior accordingly.

[0024] However, the aforementioned existing technologies have some limitations in practical applications. Traditional rule-based and threshold-based methods are difficult to adapt to the complex changes in the vehicular network environment, and are prone to false alarms or missed alarms. Due to the large amount of data and high dynamism of vehicular networks, simple statistical analysis cannot meet the needs of rapid response, resulting in insufficient timeliness of anomaly detection. Existing methods are mostly statically configured, lacking the ability to self-learn and self-optimize, and cannot adjust detection strategies according to actual conditions. Most methods only focus on basic packet attributes (such as latency and packet loss rate), while ignoring more complex features such as packet sequence characteristics and cross-module temporal correlations, which limits the comprehensiveness and accuracy of anomaly detection.

[0025] To overcome these problems, this application proposes an improved real-time anomaly detection method for vehicle gateway messages. This method incorporates machine learning and big data analytics. After collecting and preprocessing the message data sent and received by the vehicle gateway, it generates a real-time data stream using stream processing techniques and an adaptive window adjustment strategy, extracting various message features from it. Subsequently, a deep learning model combined with a dynamic anomaly threshold is used for intelligent anomaly detection. Finally, alarm information is sent via a message queue, and data mining techniques are used to automatically analyze the causes of anomalies, achieving root cause localization and report generation. This method not only improves the accuracy and real-time performance of anomaly detection but also enhances the system's intelligence and automation level.

[0026] First, the method for real-time anomaly detection of vehicle gateway messages provided in this application will be described in detail below with reference to the accompanying drawings.

[0027] Reference Figure 1 The implementation process of the vehicle gateway message real-time anomaly detection method provided in this application embodiment includes, but is not limited to, the following steps.

[0028] Step S110: Collect and preprocess the message data sent and received by the vehicle gateway to obtain structured message data.

[0029] In step S110, it is ensured that the acquired data can be effectively utilized in subsequent analysis processes. First, all message data transmitted in the vehicle gateway is collected, including but not limited to message ID, content, and sending and receiving timestamps, providing basic data support for anomaly detection. Then, preprocessing operations are performed on this raw data, such as removing duplicate messages to ensure data uniqueness, synchronizing sending and receiving timestamps to ensure time consistency, and cleaning incomplete or corrupted message data, thereby obtaining a high-quality, structured message dataset. This process is crucial for improving the data reliability and accuracy of subsequent steps.

[0030] Step S120: An adaptive window adjustment strategy is adopted to perform stream processing and timestamp alignment on the structured message data to obtain a real-time data stream.

[0031] In step S120, an adaptive window adjustment strategy is applied to achieve efficient processing of structured message data. This method dynamically adjusts the window size based on the current network load and data inflow rate, thereby optimizing resource utilization and improving processing speed. Specifically, it can automatically adjust the window length and capacity based on factors such as network traffic fluctuations and message arrival time variance, ensuring the continuity and accuracy of data processing even under changing network conditions. Furthermore, by performing timestamp alignment on the messages, the consistency and orderliness of the data stream are further guaranteed, making the generated real-time data stream more suitable for subsequent feature extraction and anomaly detection.

[0032] Step S130: Extract message features from the real-time data stream.

[0033] Among them, message characteristics include message delay, packet loss rate, message content consistency, message sequence characteristics, network traffic characteristics, historical anomaly characteristics, and cross-module message timing correlation characteristics.

[0034] In step S130, key features that may affect the normal operation of the vehicular network are identified and quantified. Based on the real-time data stream generated in previous steps, this step will delve deeper into the information contained therein, extracting a series of representative message features, such as message latency, packet loss rate, message content consistency, message sequence features (e.g., sequence intervals), network traffic features (e.g., bandwidth utilization), historical anomaly features, and cross-module message timing correlation features. These features not only cover the basic attributes of the messages but also involve the interaction patterns between different functional modules, which helps to comprehensively assess the status of the vehicular network and provides rich input data for subsequent anomaly detection.

[0035] Step S140: Using a deep learning model and a dynamic anomaly threshold, anomaly detection is performed on the message features to obtain abnormal message data.

[0036] In step S140, a deep learning model is used to perform in-depth analysis of the message features extracted in the previous step to identify potential anomalies. By combining a dynamic anomaly threshold mechanism, this model can flexibly adjust the judgment criteria according to changes in the actual operating environment, thereby improving the accuracy and adaptability of anomaly detection. For example, the LSTM model can be used to predict message latency, while the Siamese Network can check the consistency of message content. This multi-dimensional and intelligent anomaly detection method not only considers the characteristics of individual messages but also captures the complex interrelationships between messages, greatly enhancing the system's ability to identify abnormal behavior.

[0037] Step S150: Based on the abnormal message data and its characteristics, send real-time alarm information through a message queue, and use data mining technology to automatically analyze the abnormal message data and trace the cause of the abnormality, output the root cause location results and generate an abnormal report.

[0038] In step S150, action is taken to address the identified anomalies. First, alarm information is instantly sent to relevant personnel using low-latency message queuing technology to ensure the anomaly is detected and responded to immediately. Simultaneously, data mining techniques are used to comprehensively analyze the anomaly message data to attempt to identify the root cause. This includes building a causal reasoning model to explain the logical relationships behind the anomaly and generating a detailed anomaly report. This approach not only quickly resolves the problem but also accumulates lessons learned, providing a reference for preventing similar issues in the future, ultimately achieving continuous optimization and improvement of the vehicle network system.

[0039] In some embodiments of this application, in step S120, an adaptive window adjustment strategy is adopted to perform stream processing on structured message data to obtain a real-time data stream. The implementation process includes, but is not limited to, the following steps.

[0040] Step S210: Monitor the current load status of the vehicle gateway and the data inflow rate of structured message data in real time, and obtain network traffic fluctuation value, message arrival time interval variance and historical window processing delay index.

[0041] In step S210, by continuously monitoring the operating status of the vehicle gateway, including load information such as the current system's CPU utilization and memory usage, as well as the inflow rate of message data from different ECU modules, a comprehensive understanding of the current communication status of the vehicle network can be obtained. Simultaneously, key performance indicators such as network traffic fluctuation values ​​(reflecting the drastic change in data volume per unit time), message arrival time interval variance (measuring the regularity of message arrivals), and historical window processing latency (evaluating the historical performance of system processing efficiency) are extracted to provide data support for subsequent dynamic adjustment of the window size. This process ensures that the basis for window parameter adjustment is real-time and objective, avoiding blind decision-making.

[0042] Step S220: When the network traffic fluctuation value exceeds the preset traffic threshold, or the variance of the packet arrival time interval is greater than the preset interval baseline value, dynamic window adjustment is triggered.

[0043] Step S220 implements the intelligent response capability of the window mechanism. Traditional fixed-window methods cannot handle sudden communication peaks or irregular packet arrivals, easily leading to data backlog or information loss. This step, by setting reasonable trigger conditions, automatically initiates the window adjustment process when abnormal fluctuations in network traffic or irregular packet arrivals are detected, effectively improving the system's adaptability to complex network environments. This event-driven mechanism ensures that the system adjusts resources only when necessary, guaranteeing flexibility while avoiding unnecessary computational overhead and improving overall processing efficiency.

[0044] Step S230: Based on the network load status, data inflow rate, and historical window processing latency indicators, a machine learning model is used to calculate the optimal window duration and optimal window capacity for the current window.

[0045] In step S230, a machine learning model (such as a regression model or reinforcement learning) is introduced, using the multidimensional indicators collected in the previous step as input features. The model outputs the optimal window time and capacity parameters. This not only considers the current network load and data inflow but also incorporates historical processing experience, making the window setting closer to actual operational needs. For example, in high-load or high-fluctuation scenarios, the model may suggest a smaller window to reduce latency; while in low-load and stable data scenarios, the window can be appropriately expanded to improve throughput. This model-based optimization method is more scientific and robust than traditional heuristic algorithms, and can significantly improve the system's stability and response speed under various operating conditions.

[0046] Step S240: Using a sliding window mechanism, the structured message data is segmented: if the number of structured message data in the current window does not reach the lower limit of the optimal window capacity and its time length does not reach the upper limit of the optimal window time length, the current window remains open to continue receiving structured message data; otherwise, the current window is closed and the next window is started.

[0047] In step S240, a sliding window mechanism is used to efficiently organize and manage the data stream. The sliding window is a classic streaming processing technique suitable for handling continuously arriving data streams. Based on this, and combined with the optimal window parameters obtained in the previous step, the system can flexibly decide when to close the current window and open a new one. Specifically, data is only sealed and moved to the next stage of processing when the amount of data or the duration of the data in the window reaches the set minimum standard. This avoids misjudgments due to insufficient data and prevents data backlog caused by windows remaining open for extended periods. This mechanism effectively balances real-time performance with data integrity, providing a stable and orderly data foundation for subsequent feature extraction.

[0048] Step S250: Perform integrity verification on the structured message data within the closed window, remove discontinuous messages across windows, and convert the verified window data into an ordered data stream sorted by timestamp, which is then output as a real-time data stream.

[0049] In step S240, due to potential issues such as packet loss, out-of-order delivery, or cross-window transmission in the vehicular network, directly using the raw data may lead to biased analysis results. Therefore, by performing integrity checks on the data within the closed window and removing packets that cross the boundaries of two windows (i.e., discontinuous packets), interference from boundary effects can be effectively avoided. Then, the remaining packets are sorted according to a unified timestamp to form an ordered data stream, thus providing high-quality input for subsequent feature extraction and anomaly detection. This process not only improves the reliability of the data but also lays a solid data foundation for the entire anomaly detection system.

[0050] In some embodiments of this application, the process of extracting cross-module message timing correlation features from the real-time data stream in step S130 includes, but is not limited to, the following steps.

[0051] Step S310: Based on the message metadata identifier, identify the boundaries of functional modules and distinguish the interaction messages of different modules.

[0052] The functional modules include a powertrain module, a body module, and an intelligent driving module.

[0053] In step S310, the in-vehicle network contains multiple functional modules, such as the powertrain system (responsible for controlling the engine, transmission, etc.), the body system (responsible for controlling doors, lights, air conditioning, etc.), and the intelligent driving system (responsible for perception, decision-making, and execution). These modules interact with each other through complex data exchange via gateways. In actual communication, the messages sent by these modules are often mixed together, making it difficult to directly determine their module affiliation and interaction relationships. Therefore, by parsing the metadata identifiers of the messages (such as CAN ID, source address, destination address, protocol type, etc.), the boundaries of each functional module can be accurately delineated, and the interaction messages belonging to different modules can be classified, providing a clear data foundation for the subsequent construction of cross-module timing sequences. This step ensures the accuracy and logic of the subsequent analysis objects and avoids incorrect timing modeling due to module confusion.

[0054] Step S320: Using the global timestamp as the order, extract the interaction message pairs between different modules within the same sliding time window to construct a cross-module interaction time sequence.

[0055] In step S320, after completing the module division, the focus shifts to the dynamic interaction behavior between modules. By introducing a unified global timestamp, messages from different modules are arranged in chronological order, thus reconstructing the true communication sequence. Within the same sliding time window, the system extracts message interaction pairs between two or more modules (e.g., the powertrain module sends status information to the intelligent driving module, and the intelligent driving module returns a response), and uses this to construct a cross-module interaction sequence. This sequence not only reflects the information transmission path between modules but also reveals key behavioral characteristics such as communication frequency and response latency, providing an important basis for understanding the collaborative working mode of the entire vehicle system. Furthermore, the sliding window mechanism can balance real-time and historical information, ensuring that the analysis results are both timely and have a certain degree of contextual continuity.

[0056] Step S330: Based on the cross-module interaction timing sequence, analyze the fixed delay association rules, sequence dependency association rules and frequency synchronization association rules of the cross-module, quantify the timing association feature values, and generate cross-module message timing association features, including delay deviation, sequence violation rate and frequency mismatch degree.

[0057] In step S330, potential abnormal patterns are discovered by modeling the communication patterns between modules. Specifically, a fixed delay association rule is used to describe the stable delay characteristics that communication between two modules should have. For example, under normal circumstances, after the power module sends a certain type of message to the intelligent driving module, the intelligent driving module should reply within a fixed time. If the delay deviates significantly from the expectation, it may indicate that there is an anomaly in the system.

[0058] Sequence dependency association rules are used to model the order of communication between modules. For example, certain operations must occur in a specific order, and if the order is disordered (such as a response before a request), it may indicate a software logic error or communication interference.

[0059] Frequency synchronization association rules are used to measure whether the communication frequencies between modules are consistent. For example, if one module suddenly sends messages frequently while another module does not respond, it may be a sign of communication interruption or module failure.

[0060] By modeling and quantifying the aforementioned rules into computable metrics (such as delay bias, sequence violation rate, and frequency mismatch), the system can transform the originally complex communication behaviors into numerical features that can be used as input for machine learning models. These features not only enrich the dimensions of anomaly detection but also provide a basis for in-depth causal tracing, greatly improving the system's ability to identify cross-module communication anomalies.

[0061] In some embodiments of this application, in step S140, the process of using a deep learning model and combining a dynamic anomaly threshold to perform anomaly detection on message features and obtain abnormal message data includes, but is not limited to, the following steps.

[0062] Step S410: Normalize the message features to generate a standardized feature tensor.

[0063] In step S410, by performing a normalization operation on the collected message features (such as latency, packet loss rate, etc.), data at different scales can be converted into a uniform standard range, typically between 0 and 1 or between -1 and 1. This not only helps improve model training efficiency but also prevents certain features from dominating the model's learning process due to excessively large values, thus ensuring that each feature participates fairly in the final decision. Furthermore, generating a standardized feature tensor format facilitates direct input into the deep learning model, providing a consistent and easily processed data format for the model.

[0064] Step S420: According to the preset time window, the standardized feature tensor is input into the deep learning model to calculate the three-dimensional anomaly score at each time step.

[0065] The three-dimensional anomaly score includes confidence in delay anomalies, confidence in packet loss anomalies, and confidence in content anomalies.

[0066] In step S420, by setting an appropriate time window length, the trends and patterns of message features changing over time can be captured, which is crucial for understanding dynamic behavior in vehicular networks. The normalized feature tensor within the selected time window is fed into a pre-trained deep learning model (e.g., LSTM or Siamese Network). The model evaluates whether the message at the current time step is normal based on knowledge learned from historical data. Specifically, the model output includes anomaly scores in three dimensions: latency anomaly confidence, packet loss anomaly confidence, and content anomaly confidence. These scores reflect the degree of deviation of the message in different aspects, helping to accurately identify different types of problems.

[0067] Step S430: Based on the statistics of normal message characteristics within the current time window, generate a three-dimensional dynamic anomaly threshold for the current time window.

[0068] In step S430, to accurately determine whether an anomaly exists at a given time step, a reasonable threshold must be set as the judgment criterion. This step dynamically adjusts the anomaly threshold for each dimension based on the statistical information (such as mean, variance, etc.) of the characteristics of all normal packets within the current time window. Unlike the fixed threshold method, this method can adapt to changes in the network environment. For example, when the network load increases, the corresponding latency may increase. If a fixed low threshold is still used, it may lead to a large number of false alarms. Therefore, the dynamic adjustment mechanism can flexibly set the threshold according to the actual situation, improving the accuracy and adaptability of anomaly detection.

[0069] Step S440: Compare the three-dimensional anomaly score with the three-dimensional dynamic anomaly threshold in real time. If the anomaly score of any dimension exceeds the corresponding dynamic anomaly threshold, then mark the time step as an anomaly.

[0070] In step S440, once the three-dimensional anomaly score and its corresponding dynamic anomaly threshold for each time step are obtained, the next task is to perform actual anomaly detection. During this process, the system compares the score for each dimension with the threshold one by one. If the anomaly score for any dimension exceeds its corresponding threshold, indicating a potential problem at that specific time point, the system marks that time step as an anomaly. This approach allows the system to monitor different aspects of the message in a fine-grained manner, ensuring that even minor but significant anomalies are detected promptly, thus achieving efficient and accurate anomaly detection.

[0071] Step S450: Align the time step marked with the anomaly with the original message in the real-time data stream, extract the complete context of the anomaly message, and generate anomaly message data, including anomaly type, anomaly time, anomaly message content, and associated context.

[0072] In step S450, a detailed anomaly report is provided to facilitate further analysis and action. Here, the system locates the time step marked as an anomaly and matches it with messages in the original real-time data stream to recover complete contextual information. In addition to recording the exact time and type of the anomaly, it also includes the specific message content that caused the anomaly and its surrounding contextual information. This detailed information is extremely useful for diagnosing the root cause of problems; it not only helps technicians quickly locate the source of the fault but also provides valuable feedback for improving system design. The resulting dataset of anomaly messages forms the basis for subsequent automated alarms, root cause analysis, and even long-term performance optimization.

[0073] In some embodiments of this application, the deep learning model includes an LSTM model and a Siamese Network model. In step S420, the process of inputting a standardized feature tensor into the deep learning model according to a preset time window and calculating the 3D anomaly score at each time step includes, but is not limited to, the following steps.

[0074] Step S510: According to the preset time window, the standardized feature tensor is input into the LSTM model to calculate the confidence of delay anomaly and packet loss anomaly at each time step.

[0075] In step S510, the advantages of Long Short-Term Memory (LSTM) networks in processing time-series data are utilized to identify time-related anomalies in message communication. Messages transmitted in the vehicle gateway exhibit obvious time-series characteristics; for example, some messages are repeatedly sent within fixed periods, and their delays, frequencies, and sequences all show certain regularities. By inputting standardized feature tensors into a trained LSTM model according to time windows, the message behavior at the current time step can be modeled, and its expected normal state can be predicted. If there is a significant deviation between the actual observations and the model predictions, it indicates a possible anomaly. Specifically, the model outputs two-dimensional anomaly scores: delay anomaly confidence and packet loss anomaly confidence, reflecting whether there are problems such as excessively long delays or abnormal packet loss rates in messages at the current time step. This time-series modeling method can effectively capture dynamically changing abnormal trends, and is particularly suitable for detecting sudden communication failures or system performance degradation.

[0076] Step S520: According to the preset time window, the standardized feature tensor is input into the Siamese Network model to calculate the content anomaly confidence at each time step.

[0077] In step S520, a Siamese Network is used to detect inconsistencies in the message content. The Siamese Network is a deep learning architecture commonly used for similarity comparison, particularly suitable for determining whether two samples belong to the same category or conform to a certain expected pattern. In the communication scenario of an in-vehicle gateway, the content format, field values, and numerical ranges of certain key messages are usually highly consistent. For example, engine speed will not suddenly jump from 2000 to 0, nor will it contain illegal values. By constructing a comparison mechanism that uses historical normal messages as reference samples and the current message as the test sample, the Siamese Network can automatically determine whether the current message deviates from the normal pattern in its content. The output of this step is the content anomaly confidence score, used to measure whether the message content at the current time step is suspicious. This method overcomes the limitations of traditional rule-based matching methods, enabling intelligent identification of content anomalies without explicitly defining rules for each message content, thus improving the system's generalization and adaptability.

[0078] In summary, step S420 achieves multi-dimensional and fine-grained detection of message communication anomalies by combining a dual deep learning mechanism of LSTM and Siamese Network models. The LSTM model focuses on detecting anomalies in the time dimension, such as latency fluctuations and packet loss rate anomalies; while the Siamese Network model focuses on detecting anomalies in the content dimension, such as field inconsistencies and numerical out-of-bounds values. The two working together not only improve the comprehensiveness and accuracy of anomaly detection, but also enhance the system's adaptability and robustness to complex vehicular communication environments, providing key technical support for achieving high-precision and intelligent anomaly detection.

[0079] In some embodiments of this application, the implementation process of step S150, which involves sending real-time alarm information through a message queue based on abnormal message data and its characteristics, and using data mining technology to automatically analyze the abnormal message data and trace the cause of the abnormality, outputting the root cause location result and generating an abnormal report, includes but is not limited to the following steps.

[0080] Step S610: Based on the abnormal message data and its characteristics, automatically fill in the structured alarm template and send real-time alarm information through a low-latency message queue.

[0081] In step S610, once abnormal message data is detected, the system immediately extracts its key features (such as anomaly type, occurrence time, involved modules, content deviation, etc.) and fills them into a predefined structured alarm template to form standardized alarm information. This structured design not only facilitates rapid parsing by downstream systems but also provides a unified format for subsequent data storage, analysis, and visualization. Subsequently, the alarm information is instantly pushed to the monitoring platform or operations center via a low-latency message queue (such as Kafka, RabbitMQ, etc.) to ensure that relevant personnel can be informed of the anomaly as soon as possible. This approach significantly improves the timeliness of handling anomalies in the vehicle network, helps to quickly respond to potential faults, and prevents problems from escalating.

[0082] Step S620: Clean the abnormal message data and its message characteristics, and supplement the context parameters to generate an enhanced abnormal dataset.

[0083] In step S620, although the original abnormal message data already contains basic abnormal information, it may contain noise, missing values, or lack sufficient contextual information. Therefore, the system cleans this data, removing invalid or redundant data and supplementing necessary contextual parameters, such as the functional module to which the message belongs, the communication path, the protocol version, the vehicle's operating status (e.g., vehicle speed, engine speed), and even environmental sensor data. Through this process, a more dimensional and semantically complete "enhanced abnormal dataset" is constructed, providing strong support for subsequent advanced analysis tasks such as pattern mining and causal inference.

[0084] Step S630: Based on the enhanced anomaly dataset, perform time-series pattern mining, association rule analysis, and cluster analysis to identify the time distribution patterns, module association diagrams, and key patterns of the anomaly message data, and generate anomaly analysis results.

[0085] In step S630, valuable information and patterns are extracted from a large amount of abnormal data. Specifically, time-series pattern mining is used to discover the periodicity, suddenness, or trend changes of abnormal events over time, such as whether certain anomalies occur concentrated within a specific time period; association rule analysis is used to reveal the propagation paths of anomalies between different modules, helping to understand whether the fault is transmissible; and cluster analysis is used to classify similar abnormal samples, identify recurring typical anomaly patterns, and thus summarize common fault types. These analytical results collectively constitute the system's anomaly analysis results, which not only assist in manual diagnosis but also provide data support for subsequent root cause localization and prevention strategy development.

[0086] Step S640: Combining the vehicle network topology, protocol specifications, and historical knowledge base, a causal reasoning model is constructed, and the root cause is inferred through the causal forest algorithm to generate the root cause location result.

[0087] Among them, the vehicle network topology is used to characterize the connection relationship between the modules; the protocol specification is used to clarify the rules that communication behavior should follow; the historical knowledge base is used to accumulate past failure cases and handling experience; and the causal reasoning model includes a causal graph that associates module status, network parameters and abnormal phenomena.

[0088] In step S640, a causal reasoning model integrating module status, network parameters, and anomalies is constructed. An advanced causal forest algorithm is used for reasoning, effectively distinguishing between correlation and causality, and accurately identifying the root cause of the anomaly. For example, it determines whether a packet loss anomaly is caused by an ECU crash or by excessive CAN bus load. The final output "root cause localization result" is one of the core achievements of the system's intelligent decision-making capability.

[0089] Step S650: Integrate the anomaly analysis results and root cause localization results to generate an anomaly report.

[0090] In step S650, all analysis results are integrated and presented to generate a complete and clearly structured anomaly report. This report typically includes basic anomaly information (time, type, severity), alarm triggering conditions and contextual information, anomaly analysis results (time distribution, module correlation, clustering pattern), root cause localization conclusions (possible causes and confidence levels), recommended measures (such as restarting the module, checking the circuit, upgrading the firmware, etc.), and related original messages and feature data attachments.

[0091] This report can be used not only for troubleshooting by technicians, but also as an important basis for subsequent system optimization, quality improvement, and knowledge accumulation. Furthermore, it can be integrated into the vehicle's remote diagnostic system or OTA platform to achieve an automated closed-loop processing mechanism, improving overall operational efficiency and intelligence.

[0092] In some embodiments of this application, in step S630, based on the enhanced anomaly dataset, time-series pattern mining, association rule analysis, and cluster analysis are performed to identify the time distribution pattern, module association graph, and key patterns of the anomaly message data, and the process of generating anomaly analysis results includes, but is not limited to, the following steps.

[0093] Step S710 involves performing time normalization, module encoding, feature extraction, and anomaly label cleaning on the enhanced anomaly dataset to generate a structured analysis dataset.

[0094] In step S710, after obtaining the enhanced anomaly dataset, the original data often suffers from issues such as inconsistent time formats, non-standard functional module representations, redundant feature dimensions, and anomaly label noise. Therefore, the system first performs time standardization, unifying timestamps from different sources to a global standard time to ensure consistency in time series analysis. Next, it performs module encoding, converting textual functional module names (such as "power module" and "body module") into computable numerical codes for easier model recognition. Then, it performs feature extraction, filtering out highly discriminative features that are highly correlated with anomalies to improve analysis efficiency. Finally, it performs anomaly label cleaning, removing mislabeled or duplicated data to improve data quality. Through this series of processes, a high-quality, structured analysis dataset is generated, providing solid data support for subsequent time series analysis, association mining, and cluster analysis.

[0095] Step S720: Perform time-series pattern mining on the structured analysis dataset. Identify the time distribution patterns of abnormal message data through time window division, periodic detection, trend detection, and abrupt change point detection.

[0096] In step S720, the inherent patterns of abnormal events are revealed from a temporal perspective. By dividing the structured analysis dataset into time windows, continuous abnormal events can be segmented into multiple time periods for easier local analysis. Subsequently, periodic detection algorithms (such as Fourier transform and autocorrelation analysis) are used to identify whether periodic anomalies exist, such as whether certain modules frequently experience packet loss within fixed time intervals. Trend detection is used to determine whether abnormal events show an upward or downward trend, helping to predict potential future failures. Abrupt change detection is used to discover abnormal events that change drastically within a short period, such as a sudden communication interruption that lasts for a period of time. These analyses collectively constitute a comprehensive characterization of the temporal distribution patterns of abnormal message data, providing an important basis for subsequent root cause localization and early warning mechanisms.

[0097] Step S730: Based on the structured analysis dataset, construct an abnormal event transaction set, mine frequent itemsets and generate strong association rules, locate the abnormal propagation path, and output the module association graph associated with the abnormal type.

[0098] In step S730, the system reveals the relationships between anomalies from the perspective of module interaction and identifies the propagation paths of anomalies in the vehicle network. First, the system treats each anomaly event as a transaction, constructing an anomaly event transaction set, where each transaction contains information such as the involved modules, communication links, and anomaly types. Then, frequent itemset mining algorithms (such as Apriori and FP-Growth) are applied to identify frequently occurring anomaly combinations, thereby discovering potential common fault patterns. Furthermore, strong association rule mining technology is used to extract anomaly propagation rules with high confidence, such as "when the power module loses packets, the intelligent driving module usually also experiences delays." Based on this, the system constructs a module association graph to graphically display the anomaly association strength and propagation paths between various modules, helping to quickly pinpoint the source of the problem and providing visual support for cross-module collaborative diagnosis.

[0099] Step S740: Perform cluster analysis on the structured analysis dataset, group the abnormal message data based on high discriminative features, summarize the statistical characteristics of each group, and identify the key patterns of the abnormal message data.

[0100] In step S740, starting from the data itself, the system automatically discovers the similarity structure between abnormal samples, forming representative key anomaly patterns. Through cluster analysis (such as K-Means, DBSCAN, hierarchical clustering, etc.) on the structured analysis dataset, the system can divide a large number of abnormal samples into several clusters based on high-discrimination features (such as latency, content bias, packet loss rate, module combination, etc.), with each cluster representing a type of anomaly with similar behavioral characteristics. Subsequently, the system summarizes the statistical characteristics of each cluster, including mean, variance, frequency distribution, etc., extracting the core features of each type of anomaly. This grouping strategy not only helps to summarize common fault types (such as "latency anomaly caused by CAN bus overload" and "packet loss anomaly caused by ECU crash"), but also provides a classification basis for subsequent automated repair strategies, making it an important means to achieve intelligent management of vehicle network anomalies.

[0101] Step S750: Integrate the time distribution pattern, module association diagram and key patterns of abnormal message data, and generate abnormal analysis results by cross-validating the matching.

[0102] In step S750, the three core results obtained in the previous steps—time distribution patterns, module association diagrams, and key anomaly patterns—are comprehensively compared and fused for analysis. Through cross-validation of matching, the system can verify the consistency of analytical conclusions across different dimensions. For example, whether anomalies identified in a certain cluster also appear within a specific time window or correspond to a specific module association path. If the three are highly consistent, the analysis results have high credibility; if contradictions exist, it may indicate new unknown failure modes or issues requiring further investigation. Finally, the system organizes this integrated information into structured anomaly analysis results, serving as the foundational input for subsequent causal reasoning and report generation, ensuring the accuracy and completeness of subsequent root cause localization.

[0103] Therefore, step S630 and its five sub-steps constitute a complete multi-dimensional analysis system for abnormal data. This system reveals the dynamic evolution of anomalies from a temporal perspective, uncovers anomaly propagation paths from a module perspective, and identifies typical fault modes from a data perspective. Furthermore, through multi-source information fusion and verification, it ensures the accuracy and consistency of the analysis results. This mechanism not only enhances the intelligence level of the vehicle gateway anomaly detection system but also provides strong technical support for vehicle-level communication security monitoring and fault prediction.

[0104] In summary, the real-time anomaly detection method for vehicle gateway messages provided in this application has the following technical effects.

[0105] This method achieves efficient and accurate identification of anomalies in vehicular network communication by constructing an end-to-end intelligent analysis process. Starting with underlying data acquisition and preprocessing, and combining adaptive window adjustment and streaming processing techniques, it ensures good adaptability to the complex and ever-changing vehicular communication environment. Furthermore, through the collaborative work of a deep learning model and a dynamic anomaly threshold mechanism, it can perform fine-grained anomaly detection across multiple dimensions, including message latency, packet loss rate, and content consistency, significantly improving the accuracy and robustness of detection. The entire process not only meets the stringent real-time requirements of vehicular systems but also provides a high-quality data foundation for subsequent automated response and fault diagnosis.

[0106] Furthermore, this method introduces a message queue mechanism to achieve real-time push of abnormal information, and combines data mining and causal reasoning techniques to realize a complete closed-loop management of abnormal alarms, pattern analysis, root cause localization, and report generation. Through in-depth analysis of the temporal distribution patterns, module correlation paths, and key patterns of abnormal events, the system can automatically identify common fault types and propagation paths. By combining the vehicle network topology and historical knowledge base to construct a causal reasoning model, the intelligence and interpretability of abnormal diagnosis are effectively improved. This series of innovative methods together constitutes an integrated vehicle communication anomaly detection and processing system encompassing "perception—analysis—decision—feedback," providing strong technical support for improving the safety, stability, and maintainability of the entire vehicle system.

[0107] Secondly, refer to Figure 2 This application provides a real-time anomaly detection system for vehicle gateway messages, used to execute the aforementioned real-time anomaly detection method for vehicle gateway messages. The system includes a data acquisition and preprocessing module 810, a feature extraction module 820, an anomaly detection module 830, and an anomaly tracing module 840.

[0108] The data acquisition and preprocessing module 810 is used to acquire and preprocess the message data sent and received by the vehicle gateway to obtain structured message data.

[0109] The feature extraction module 820 employs an adaptive window adjustment strategy to perform stream processing and timestamp alignment on structured message data to obtain a real-time data stream; from the real-time data stream, message features are extracted. These message features include message latency, packet loss rate, message content consistency, message sequence features, network traffic features, historical anomaly features, and cross-module message temporal correlation features.

[0110] The anomaly detection module 830 is used to perform anomaly detection on message features by using a deep learning model and combining dynamic anomaly thresholds to obtain abnormal message data.

[0111] The anomaly tracing module 840 is used to send real-time alarm information through a message queue based on the abnormal message data and its message characteristics, and to use data mining technology to automatically analyze the abnormal message data and trace the cause of the anomaly, output the root cause location results and generate an anomaly report.

[0112] Furthermore, refer to Figure 3 This application provides a real-time anomaly detection device for vehicle gateway messages, including a processor and a memory. The memory stores a computer program, and when the processor executes the computer program, it implements the aforementioned real-time anomaly detection method for vehicle gateway messages.

[0113] In addition, this application provides a vehicle that integrates the aforementioned vehicle gateway message real-time anomaly detection device.

[0114] Similarly, the systems, devices, and vehicles provided in the embodiments of this application have the same technical effects as the method embodiments described above.

[0115] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards of the relevant countries and regions. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data for the proper functioning of the embodiments of this application obtained.

[0116] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this application are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0117] Furthermore, although this application is described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding this application. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of ordinary skill of an engineer. Therefore, those skilled in the art can implement the application set forth in the claims using ordinary skill. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of this application, which is determined by the full scope of the appended claims and their equivalents.

[0118] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several programs to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0119] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequential list of executable programs for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, a program execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can retrieve and execute a program from or in conjunction with such a program execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can mean any means that can contain, store, communicate, propagate, or transmit a program for use by or in conjunction with a program execution system, apparatus, or device.

[0120] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or, if necessary, processing in a suitable manner, and then stored in computer memory.

[0121] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable program execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0122] In the foregoing description of this specification, the reference to terms such as "one embodiment / implementation," "another embodiment / implementation," or "certain embodiments / implementations," etc., indicates that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in an embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0123] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0124] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A method for real-time anomaly detection of vehicle gateway messages, characterized in that, The following steps are involved: Collect and preprocess the message data sent and received by the vehicle gateway to obtain structured message data; An adaptive window adjustment strategy is adopted to perform stream processing and timestamp alignment on the structured message data to obtain a real-time data stream; Message features are extracted from the real-time data stream; the message features include message delay, packet loss rate, message content consistency, message sequence features, network traffic features, historical anomaly features, and cross-module message timing correlation features. By using a deep learning model and combining it with a dynamic anomaly threshold, anomaly detection is performed on the message features to obtain abnormal message data. Based on the abnormal message data and its characteristics, real-time alarm information is sent through a message queue, and data mining technology is used to automatically analyze the abnormal message data and trace the cause of the abnormality, outputting the root cause location result and generating an abnormal report.

2. The method for real-time anomaly detection of vehicle gateway messages according to claim 1, characterized in that, The method of employing an adaptive window adjustment strategy to perform stream processing on the structured message data to obtain a real-time data stream includes the following steps: Real-time monitoring of the current load status of the vehicle gateway and the data inflow rate of the structured message data; obtaining network traffic fluctuation values, message arrival time interval variance, and historical window processing delay indicators. When the network traffic fluctuation value exceeds the preset traffic threshold, or the variance of the packet arrival time interval is greater than the preset interval benchmark value, dynamic window adjustment is triggered; Based on the network load status, the data inflow rate, and the historical window processing latency index, a machine learning model is used to calculate the optimal window duration and optimal window capacity for the current window. A sliding window mechanism is used to segment the structured message data: if the number of structured message data in the current window does not reach the lower limit of the optimal window capacity and its time length does not reach the upper limit of the optimal window time length, then the current window remains open to continue receiving the structured message data; otherwise, the current window is closed and the next window is started. The structured message data within the closed window is subjected to integrity verification, discontinuous messages across windows are removed, and the window data that passes the verification is converted into an ordered data stream sorted by timestamp, which is then output as the real-time data stream.

3. The method for real-time anomaly detection of vehicle gateway messages according to claim 1, characterized in that, Extracting the cross-module message timing correlation features from the real-time data stream includes the following steps: Based on message metadata identifiers, the boundaries of functional modules are identified, and the interaction messages of different modules are distinguished; the functional modules include the power module, the body module, and the intelligent driving module; Based on the global timestamp, extract the interaction message pairs between different modules within the same sliding time window to construct a cross-module interaction time sequence; Based on the cross-module interaction timing sequence, the fixed delay association rules, sequence dependency association rules, and frequency synchronization association rules of the cross-module are analyzed, and the timing association feature values ​​are quantified to generate the cross-module message timing association features, including delay deviation, sequence violation rate, and frequency mismatch.

4. The method for real-time anomaly detection of vehicle gateway messages according to claim 1, characterized in that, The method of using a deep learning model, combined with a dynamic anomaly threshold, to perform anomaly detection on the message features and obtain abnormal message data includes the following steps: The message features are preprocessed by normalization to generate a standardized feature tensor; According to the preset time window, the standardized feature tensor is input into the deep learning model to calculate the three-dimensional anomaly score at each time step, and the three-dimensional dynamic anomaly threshold for the current time window is generated based on the statistics of normal message features within the current time window; the three-dimensional anomaly score includes delay anomaly confidence, packet loss anomaly confidence, and content anomaly confidence. The three-dimensional anomaly score is compared with the three-dimensional dynamic anomaly threshold in real time. If the anomaly score of any dimension exceeds the corresponding dynamic anomaly threshold, the time step is marked as an anomaly. The time step marked as abnormal is time-aligned with the original message in the real-time data stream to extract the complete context of the abnormal message and generate abnormal message data, including abnormal type, abnormal time, abnormal message content and associated context.

5. The method for real-time anomaly detection of vehicle gateway messages according to claim 4, characterized in that, The deep learning model includes an LSTM model and a Siamese Network model; the step of inputting the standardized feature tensor into the deep learning model according to a preset time window and calculating the three-dimensional anomaly score at each time step includes the following steps: According to the preset time window, the standardized feature tensor is input into the LSTM model to calculate the delay anomaly confidence and packet loss anomaly confidence at each time step; According to the preset time window, the standardized feature tensor is input into the Siamese Network model to calculate the content anomaly confidence at each time step.

6. The method for real-time anomaly detection of vehicle gateway messages according to claim 1, characterized in that, The process of sending real-time alarm information through a message queue based on the abnormal message data and its characteristics, and using data mining technology to automatically analyze the abnormal message data and trace the cause of the anomaly, outputting the root cause location result and generating an anomaly report, includes the following steps: Based on the abnormal message data and its characteristics, a structured alarm template is automatically filled in, and real-time alarm information is sent through a low-latency message queue. The abnormal message data and its message characteristics are cleaned and context parameters are added to generate an enhanced abnormal dataset; Based on the enhanced anomaly dataset, time-series pattern mining, association rule analysis, and cluster analysis are performed to identify the time distribution pattern, module association diagram, and key patterns of the anomaly message data, and anomaly analysis results are generated. By combining the vehicle network topology, protocol specifications, and historical knowledge base, a causal reasoning model is constructed. The root cause is inferred through the causal forest algorithm, and the root cause location result is generated. The causal reasoning model includes a causal graph that associates module states, network parameters, and abnormal phenomena. The anomaly report is generated by integrating the anomaly analysis results and the root cause localization results.

7. The method for real-time anomaly detection of vehicle gateway messages according to claim 6, characterized in that, The process of performing time-series pattern mining, association rule analysis, and cluster analysis based on the enhanced anomaly dataset to identify the time distribution patterns, module association graphs, and key patterns of the anomaly message data, and generating anomaly analysis results, includes the following steps: The enhanced anomaly dataset is subjected to time normalization, module encoding, feature extraction, and anomaly label cleaning to generate a structured analysis dataset. Temporal pattern mining is performed on the structured analysis dataset. By dividing the time window, periodic detection, trend detection, and abrupt change point detection, the temporal distribution pattern of the abnormal message data is identified. Based on the structured analysis dataset, construct an abnormal event transaction set, mine frequent itemsets and generate strong association rules, locate the abnormal propagation path, and output a module association graph associated with the abnormal type. Cluster analysis is performed on the structured analysis dataset. The abnormal message data is grouped based on high discriminative features. The statistical characteristics of each group are summarized, and the key patterns of the abnormal message data are identified. By integrating the time distribution patterns, module association diagrams, and key patterns of the abnormal message data, and through cross-validation of matching, anomaly analysis results are generated.

8. A real-time anomaly detection system for vehicle-mounted gateway messages, characterized in that, Used to perform the real-time anomaly detection method for vehicle gateway messages as described in any one of claims 1 to 7.

9. A real-time anomaly detection device for vehicle-mounted gateway messages, characterized in that, It includes a processor and a memory; the memory stores a computer program, and when the processor executes the computer program, it implements the vehicle gateway message real-time anomaly detection method as described in any one of claims 1 to 7.

10. A vehicle, characterized in that, The vehicle is equipped with the on-board gateway message real-time anomaly detection device as described in claim 9.

Images