Data anomaly detection method and device for electric vehicle charging pile and electronic equipment

Abstract

The invention discloses a data anomaly detection method and device for an electric vehicle charging pile and electronic equipment. The method comprises the steps that multi-frame CAN bus message data of a charging pile are acquired, and the multi-frame CAN bus message data comprise current-frame CAN bus message data and previous preset-frame CAN bus message data; recombining the multi-frame CAN bus message data according to the plurality of fields to obtain a plurality of initial feature sequences; processing the plurality of initial feature sequences by adopting a plurality of attention encoders in a data anomaly detection model to obtain a plurality of weighted feature sequences; and based on the plurality of weighted feature sequences, adopting a long-short-term memory network in the data anomaly detection model to obtain an anomaly detection result of the CAN bus message data of the current frame. According to the invention, the technical problem of low detection accuracy caused by incomplete consideration factors during data anomaly detection in CAN bus communication of the electric vehicle charging pile in the prior art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of electric vehicles, in particular to a data anomaly detection method and device for electric vehicle charging piles and an electronic device. BACKGROUND

[0002] With the popularity of electric vehicles and the rapid growth of charging infrastructure, charging pile communication security has become an increasingly prominent problem. In the communication between the charging pile and the electric vehicle, the controller area network (CAN) bus, as an efficient communication method, carries key information exchange including charging instructions, status information, safety monitoring data, etc. However, due to the openness of CAN bus communication, it is also an easy target for attackers, including but not limited to instruction tampering, abnormal broadcasting and illegal control commands, etc. These attack behaviors seriously threaten the safety and reliability of the charging process.

[0003] Currently, the charging pile CAN communication anomaly detection technology mainly adopts a monitoring method based on rules or simple thresholds. Although this kind of method is relatively simple in implementation and can respond in real time, its detection range and precision are limited and it cannot comprehensively cover complex and variable attack patterns, especially when attackers adopt gradual or disguised attacks, the traditional method often appears to be inadequate. For example, for slow attacks that gradually tamper with parameters, rule detection is often difficult to detect; for abnormal instructions disguised in normal messages, threshold strategies are also difficult to distinguish. In addition, the characteristics of normal CAN communication vary significantly for different vehicle models or in different charging environments, and fixed rules are difficult to adapt to this diversity, resulting in high false positive and false negative rates. Another major shortcoming of existing anomaly detection technology is the lack of in-depth analysis of the time sequence dependence of CAN messages. Most solutions focus only on the current frame data, ignoring the potential value of historical message sequences, which makes it difficult for the detection model to capture complex attack patterns across messages. In summary, the related art does not comprehensively consider factors when detecting data anomalies in the CAN bus communication of electric vehicle charging piles, resulting in low detection accuracy.

[0004] To address the above problems, no effective solutions have been proposed so far. SUMMARY

[0005] The embodiments of the present application provide a data anomaly detection method and device for electric vehicle charging piles and an electronic device, at least to solve the technical problem that related art does not comprehensively consider factors when detecting data anomalies in the CAN bus communication of electric vehicle charging piles, resulting in low detection accuracy.

[0006] According to an aspect of the embodiments of the present application, a data anomaly detection method for an electric vehicle charging pile is provided, comprising: obtaining a plurality of frames of CAN bus message data of the charging pile, wherein the plurality of frames of CAN bus message data comprises a current frame of CAN bus message data and a predetermined frame of CAN bus message data before the current frame of CAN bus message data; the CAN bus message data comprises data information corresponding to a plurality of fields respectively; reorganizing the plurality of frames of CAN bus message data according to the plurality of fields to obtain a plurality of initial feature sequences, wherein each feature sequence comprises data information of a same field extracted from the plurality of frames of CAN bus message data; processing the plurality of initial feature sequences by using a plurality of attention encoders in a data anomaly detection model to obtain a plurality of weighted feature sequences, wherein the plurality of attention encoders correspond to the plurality of initial feature sequences one by one, and the weighted feature sequences are obtained by weighting processing based on attention weights of the corresponding attention encoders; obtaining an anomaly detection result of the current frame of CAN bus message data based on the plurality of weighted feature sequences by using a long short-term memory network in the data anomaly detection model, wherein the anomaly detection result comprises an anomaly state and an attack type, and the anomaly state is used to indicate whether the current frame of CAN bus message data is subjected to an abnormal attack.

[0007] According to another aspect of the embodiments of the present application, a data anomaly detection device for an electric vehicle charging pile is also provided, comprising: a data acquisition module configured to obtain a plurality of frames of CAN bus message data of the charging pile, wherein the plurality of frames of CAN bus message data comprises a current frame of CAN bus message data and a predetermined frame of CAN bus message data before the current frame of CAN bus message data; the CAN bus message data comprises data information corresponding to a plurality of fields respectively; a data reorganization module configured to reorganize the plurality of frames of CAN bus message data according to the plurality of fields to obtain a plurality of initial feature sequences, wherein each feature sequence comprises data information of a same field extracted from the plurality of frames of CAN bus message data; a data processing module configured to process the plurality of initial feature sequences by using a plurality of attention encoders in a data anomaly detection model to obtain a plurality of weighted feature sequences, wherein the plurality of attention encoders correspond to the plurality of initial feature sequences one by one, and the weighted feature sequences are obtained by weighting processing based on attention weights of the corresponding attention encoders; and an anomaly detection module configured to obtain an anomaly detection result of the current frame of CAN bus message data based on the plurality of weighted feature sequences by using a long short-term memory network in the data anomaly detection model, wherein the anomaly detection result comprises an anomaly state and an attack type, and the anomaly state is used to indicate whether the current frame of CAN bus message data is subjected to an abnormal attack.

[0008] According to another aspect of the embodiments of the present application, there is also provided a non-transitory storage medium storing a plurality of instructions adapted to be loaded and executed by a processor to implement any of the data anomaly detection method for electric vehicle charging piles.

[0009] According to another aspect of the embodiments of the present application, there is also provided an electronic device comprising one or more processors and a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement any of the data anomaly detection method for electric vehicle charging piles.

[0010] According to another aspect of the embodiments of the present application, there is also provided a computer program product comprising a computer program which, when executed by a processor, implements the steps of any of the data anomaly detection method for electric vehicle charging piles.

[0011] In the embodiments of the present application, a plurality of frames of CAN bus message data of the charging pile are acquired, wherein the plurality of frames of CAN bus message data include a current frame of CAN bus message data and a predetermined frame of CAN bus message data before the current frame of CAN bus message data; the CAN bus message data includes data information of a plurality of fields respectively; the plurality of frames of CAN bus message data are reorganized according to the plurality of fields to obtain a plurality of initial feature sequences, wherein each feature sequence includes data information of a same field extracted from the plurality of frames of CAN bus message data; the plurality of initial feature sequences are processed by a plurality of attention encoders in a data anomaly detection model to obtain a plurality of weighted feature sequences, wherein the plurality of attention encoders correspond to the plurality of initial feature sequences one by one, and the weighted feature sequences are obtained by weighted processing based on attention weights of the corresponding attention encoders; based on the plurality of weighted feature sequences, a long short-term memory network in the data anomaly detection model is used to obtain an anomaly detection result of the current frame of CAN bus message data, wherein the anomaly detection result includes an anomaly state and an attack type, and the anomaly state is used to indicate whether the current frame of CAN bus message data is subjected to an abnormal attack. Thus, the purpose of real-time, efficient and accurate anomaly state identification and attack type classification of the current frame of message is achieved by acquiring and reorganizing the plurality of frames of CAN bus message data of the charging pile, processing the feature sequences of the same field by the plurality of attention encoders, and comprehensively analyzing the weighted feature sequences by a target attention encoder. Therefore, the technical effect of effectively improving the accuracy of data anomaly detection in the CAN bus communication of the electric vehicle charging pile is achieved, and the communication safety of the charging pile is ensured. Thus, the technical problem of low detection accuracy caused by incomplete consideration in the data anomaly detection in the CAN bus communication of the electric vehicle charging pile in the related art is solved. BRIEF DESCRIPTION OF DRAWINGS

[0012] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0013] Figure 1 is a flow chart of a data anomaly detection method of an electric vehicle charging pile according to an embodiment of the application;

[0014] Figure 2 is an optional recombination diagram according to an embodiment of the application;

[0015] Figure 3 is an optional model architecture diagram according to an embodiment of the application;

[0016] Figure 4 is an optional LSTM network structure diagram according to an embodiment of the application;

[0017] Figure 5 is a schematic diagram of a data anomaly detection device of an electric vehicle charging pile according to an embodiment of the application. DETAILED DESCRIPTION

[0018] In order to make the technical personnel of the present application better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor should be within the scope of protection of the present application.

[0019] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily mean a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0020] When charging the vehicle battery, the electric vehicle charging pile needs to communicate with the battery management system of the electric vehicle in real time. Among them, the controller area network (CAN) bus is a common vehicle-pile communication method, which transmits charging instructions, state information and safety monitoring data through the CAN bus. This communication is related to the safety and reliability of the charging process. If the communication is tampered with or attacked, it may cause charging failure or even safety accidents. For example, if an attacker sends a fake CAN instruction through the vehicle on-board diagnostics (OBD) interface or intrudes into the charging pile internal network, it may cause abnormal charging voltage and current, or even force the termination of charging. With the rapid development of electric vehicles and charging infrastructure, related communication security problems are becoming increasingly prominent, but early system development focuses more on function implementation and less on security protection. At present, the charging pile CAN communication has not yet universally configured perfect intrusion detection measures, so there is a certain security risk.

[0021] In the above background, it is necessary to monitor the CAN bus communication of the charging pile. The charging pile system belongs to the typical industrial control system (ICS), and in recent years, ICS communication security has faced major challenges, and abnormal attack methods have evolved. On the other hand, although there are related standards for the interaction protocol between electric vehicles and charging piles, there is a lack of supporting security reinforcement measures. Attackers may inject abnormal messages into the CAN bus using protocol vulnerabilities or physical interfaces, such as instruction tampering (modifying the data field of normal control instructions), abnormal broadcasting (unauthorized nodes pretending to be vehicles or piles sending broadcast messages), and illegal control commands (forging key control frames to interfere with the charging process). Once the above attacks occur, it will directly threaten the safety of charging and may cause overcharging, undercharging or even equipment damage. Therefore, there is an urgent need for a technology that can detect CAN communication abnormalities in real time to ensure the safety and reliability of the interaction between the charging pile and the electric vehicle.

[0022] The CAN bus monitoring and anomaly detection method in the related art is mainly based on preset rules or simple threshold strategy. The typical method is to define the parameter range and timing rules of normal communication in advance, for example, to limit the sending period of a specific CAN message ID, the data field value range, etc. When the actual monitored message frequency or data deviates from the rules, it is determined as an anomaly. This kind of rule detection method is simple to implement and has high real-time performance, and is easy to deploy in a resource-limited vehicle embedded environment. For example, a rule can be set: if the same ID message appears continuously within 5 milliseconds, it is considered abnormal (the normal period of an ECU message is greater than or equal to 10 ms), or an alarm is triggered when a specific bit (such as a brake signal) in a frame of data is set to 1. The rule method has a certain effect on known simple attacks, and it is reported that about 80% of simple message injection attacks can be intercepted. Some early schemes (such as the vehicle intrusion detection system (IDS) of Tesla vehicle) even use decision tree methods to monitor message frequency in order to detect anomalies. It can be seen that some abnormal behaviors can be detected by manually setting rules.

[0023] However, the rule-based CAN anomaly detection has obvious deficiencies. First, the rules have limited adaptability and coverage: they can only detect previously considered abnormal patterns, and are often helpless against unknown attacks (zero-day attacks) slightly modified by attackers. Attackers can bypass detection by disguising malicious messages within the rule threshold to avoid triggering conditions. Second, it is difficult to set the rule threshold strictly: too loose will miss the risk of reporting, and too strict will cause normal messages to be misjudged, resulting in an increased false positive rate. This makes it difficult to achieve ideal detection results simply by relying on fixed rules in complex and variable actual scenarios. Finally, the normal CAN communication characteristics of different vehicle models or different charging environments differ, and the rules need to be calibrated for specific systems, which has poor portability and high maintenance cost.

[0024] The charging pile CAN communication anomaly detection method in the related art mainly has the following problems and defects:

[0025] 1) Limited detection range, unable to cover complex attacks comprehensively: traditional rules rely on preset patterns and can only detect obvious deviations from the specification. Some slightly disguised or gradual attacks do not violate the rule threshold and may escape detection. In addition, different attack types differ greatly, and a single algorithm often focuses on a certain feature, lacking a global perspective, making it difficult to detect combined and hidden attacks. There is currently no perfect solution that can effectively monitor command tampering, abnormal broadcasting, and illegal commands in charging pile CAN communication.

[0026] 2) Significant issues with false positives and false negatives: Methods based on fixed rules or simple models struggle to balance sensitivity, often resulting in conflicting false positive and false negative rates. Overly strict rules may misclassify normal messages as abnormal, disrupting the charging process; overly lenient rules may miss real attacks. Some machine learning models experience performance degradation when training data is imbalanced or when scenarios change, leading to missed detections of new abnormal patterns. Current methods have limited detection accuracy, failing to meet the requirements for precise security identification.

[0027] To address the aforementioned problems, this invention provides a method embodiment for detecting data anomalies in electric vehicle charging piles. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0028] Figure 1 This is a flowchart of a data anomaly detection method for electric vehicle charging piles according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0029] Step S102: Obtain multi-frame CAN bus message data of the charging pile. The multi-frame CAN bus message data includes the current frame CAN bus message data and the CAN bus message data of the predetermined frames preceding the current frame CAN bus message data. The CAN bus message data includes data information corresponding to multiple fields.

[0030] Optionally, this step first acquires the CAN bus communication data of the charging pile in real time, not only the data of the current frame, but also a series of historical frame data before it, that is, a predetermined number of CAN messages. By using CAN bus message data based on a certain time window or sequence data (i.e., multiple frames), patterns or trends of abnormal behavior can be captured.

[0031] In one optional embodiment, the plurality of fields include at least: timestamp, message identifier, data length code, and feature data field; the feature data field includes a charging status monitoring field, and at least one of the following: charging environment monitoring field and communication quality field, wherein the charging environment monitoring field includes at least: ambient temperature and power fluctuation status.

[0032] Optionally, multiple fields can be set, including not only timestamp, message identifier, data length code, and feature data fields, but also charging status monitoring fields, charging environment monitoring fields, and communication quality fields, to reflect specific information regarding charging status monitoring, charging environment monitoring, and communication quality. The charging status monitoring field covers key data on the interaction between the charging pile and the electric vehicle during the charging process, such as real-time information like charging power, voltage, and current, as well as long-term trend data like battery state of charge (SOC) and charging rate. The charging environment monitoring field focuses on the potential impact of the charging pile's environment on the charging process, mainly including ambient temperature and battery power fluctuations. Changes in ambient temperature can affect battery charging efficiency and safety; extreme temperatures can cause charging interruptions or battery performance degradation. Battery power fluctuation monitoring helps identify the stability of the power supply network; frequent voltage or current fluctuations not only affect charging efficiency but may also be caused by attacks, such as attempts to interfere with the normal operation of the charging pile through power instability. The communication quality field focuses on the health of the CAN bus communication itself, including but not limited to communication latency, packet loss rate, and communication errors (such as CRC check failures). Abnormal communication quality may be caused by physical interference or malicious attacks, such as attempts to mask communication anomalies or mislead the communication behavior of charging piles by reducing communication quality.

[0033] In the above methods, by monitoring multi-dimensional information during the charging process, the model can identify complex anomaly patterns from a more comprehensive perspective. For example, a sudden change in ambient temperature combined with a deterioration in battery power fluctuations may indicate an adverse change in the charging pile's environment, requiring the charging pile to respond immediately, adjust its charging strategy, or conduct a safety check. Similarly, a decline in communication quality accompanied by abnormal fluctuations in charging status monitoring fields may indicate an attack targeting the charging pile, requiring the model to quickly identify and take appropriate measures. By incorporating these specific fields into the model's analysis framework, not only can the model's accuracy in detecting anomalies on the charging pile's CAN bus be improved, but its diagnostic capabilities can also be enhanced, i.e., identifying whether the root cause of the anomaly is a change in the charging environment, a problem with the charging process itself, or a communication anomaly. This meticulous selection and analysis of feature fields ensures that even in complex and changing charging scenarios, anomalies can be detected and responded to in a timely and accurate manner, effectively preventing safety risks.

[0034] Step S104: Reassemble the multi-frame CAN bus message data according to multiple fields to obtain multiple initial feature sequences, wherein each feature sequence includes data information of the same field extracted from the multi-frame CAN bus message data;

[0035] Optionally, this step involves reassembling and subdividing the acquired multi-frame CAN bus message data. The aim is to separate the data from different fields and form feature sequences accordingly. For example, for each frame of CAN bus message data, basic field information such as message identifier (ID), data length (DLC), and each byte of the data field is extracted and combined with contextual information such as timestamp and sending node to form an original feature vector. The timestamp field forms one sequence, the message identifier (ID) forms another sequence, and so on. Figure 2 This is an optional text reconstruction diagram according to an embodiment of the present invention. The message ID features are extracted from the original CAN data stream and reconstructed to obtain the corresponding sequence features. In this way, each sequence contains only field information of the same type, facilitating in-depth analysis of specific field features by the attention encoder in subsequent steps, ensuring that the model can capture potential anomalies from various dimensions.

[0036] Step S106: Multiple attention encoders in the data anomaly detection model are used to process multiple initial feature sequences to obtain multiple weighted feature sequences. The multiple attention encoders correspond one-to-one with the multiple initial feature sequences, and the weighted feature sequences are obtained by weighting the attention weights of the corresponding attention encoders.

[0037] Optionally, in this step, multiple attention encoders from the data anomaly detection model are used to process the previously constructed feature sequences. Each attention encoder specializes in processing a specific type of feature sequence, such as a timestamp sequence or a message ID sequence. The role of the attention encoder is to assign weights to each element in the sequence, identifying those elements that are more critical for anomaly detection. For example, during charging, if there are abnormal jumps in the timestamp or message ID, it may indicate that the communication has been tampered with. Through the attention mechanism, the model can learn to give more attention to these critical moments, thereby improving the sensitivity and accuracy of anomaly detection. After processing their respective feature sequences, the attention encoders generate a weighted feature sequence. Here, weighting means that the importance of each feature in the sequence is quantified, and those features judged as key points for anomaly detection will have higher weights. The generation of the weighted feature sequence is a manifestation of model intelligence; it allows the model to have more "focus" when processing data, rather than treating every feature equally, thus making anomaly detection more accurate.

[0038] In an optional embodiment, before executing step S106, it is necessary to construct a data anomaly detection model, specifically including: acquiring CAN bus message data and anomaly detection results collected at N historical time points, where N is an integer greater than 2; dividing the CAN bus message data and anomaly detection results collected at the N historical time points into multiple groups according to a predetermined time sliding window, obtaining multiple CAN bus message sets corresponding to each historical time point, wherein each CAN bus message set includes CAN bus message data and anomaly detection results at the corresponding historical time point, as well as CAN bus message data of a predetermined frame before the corresponding historical time point; training the initial network model with the CAN bus message data in the corresponding CAN bus message set as input and the corresponding anomaly detection results as output, to obtain a data anomaly detection model, wherein the training is used to optimize the attention weights of multiple attention encoders in the initial network model and to optimize the parameters of the long short-term memory network in the initial network model.

[0039] Optionally, before applying the model to detect anomalies in the CAN bus message data of the charging pile, it is necessary to train the model using historical data to optimize the model parameters, especially the attention weights of the attention encoder and the internal parameters of the LSTM network. This process involves collecting and preprocessing CAN bus message data and their corresponding anomaly detection results from N historical time points, where N is an integer greater than 2, meaning that model training needs to be based on a sufficiently long historical data window. Data preprocessing includes dividing the CAN bus message data and anomaly detection results from these N historical time points according to a predetermined time sliding window principle, forming multiple CAN bus message sets corresponding to different historical time points. Each set not only contains the current frame data at a specific historical time point but also includes predetermined frame data before that time point, thereby constructing a time series context so that the model can learn and identify anomaly patterns across time. For example, if an anomaly is detected at a certain historical time point, the model will simultaneously consider the changes in message data within milliseconds or seconds before and after that time point, which is crucial for capturing timing vulnerabilities that attackers may exploit. Subsequently, the model uses message data from the CAN bus message set at each historical moment as input and the anomaly detection result at the corresponding moment as output for supervised learning. This training method allows the model to learn from historical anomaly detections, gradually adjusting the attention weights of the attention encoder and the parameters of the LSTM network by comparing the input data with the actual results, aiming for greater accuracy in future detections. Anomaly detection results can be binary (abnormal / normal) or more granular multi-class (different attack types), requiring the model to not only learn to identify abnormal states during training but also to distinguish different types of attacks.

[0040] It's important to note that the core of training anomaly detection models lies in parameter optimization, specifically including attention weight optimization and LSTM parameter optimization. The attention weights of the attention encoder determine which features should receive more attention during detection. Through training, the model can automatically adjust these weights, ensuring that detection focuses on the most relevant features, thereby improving efficiency and accuracy. LSTM network parameter optimization helps the model better remember and utilize long-term dependencies in time series data. This is particularly crucial for identifying complex, cross-time-series attack patterns, as attackers may not leave obvious traces in individual messages, but their behavioral patterns can become apparent over time.

[0041] Optionally, training a data anomaly detection model is an iterative and supervised process. A loss function can be defined to measure the difference between the model's predictions and the actual anomaly detection results, such as cross-entropy loss (for classification tasks) or mean squared error (for regression tasks). The training objective is to minimize this loss function by adjusting the parameters. Backpropagation can be used, where the model updates its parameters based on the gradient of the loss function. During training, the attention weights of the attention encoder and the internal parameters of the LSTM network are optimized to reduce prediction errors. To prevent the model from performing too well on training data and poorly on new data, regularization techniques (such as L1 and L2 regularization) or early stopping strategies (ending training early to prevent overlearning of training data details) can be applied.

[0042] In one optional embodiment, the initial network model is trained using CAN bus message data from their respective CAN bus message sets as input and the corresponding anomaly detection results as output to obtain a data anomaly detection model. This includes: adding random noise to a portion of the CAN bus message sets in their respective CAN bus message sets to obtain an extended CAN bus message set; dividing the CAN bus message sets corresponding to multiple historical moments and the extended CAN bus message set into multiple groups to obtain multiple subsets; using the multiple subsets sequentially as validation sets and the other subsets besides the validation set as training sets; using CAN bus message data as input and the corresponding anomaly detection results as output, training the initial network model using the training set; validating the trained network model using the validation set; repeating the above operations until the last subset in the multiple subsets is used as the validation set to validate the trained network model, thus obtaining the data anomaly detection model.

[0043] Optionally, an extended CAN bus message set can be generated by adding random noise to a portion of the historical CAN bus message set. This data augmentation strategy helps the model learn various disturbances that message data may encounter in actual communication, thus making it more stable and accurate in handling real-world anomalies. For example, noise may simulate electromagnetic interference, transmission errors, or other uncertainties in communication, enabling the model to make correct anomaly detections when encountering similar situations. To ensure the quality and effectiveness of model training, cross-validation is employed. First, all collected historical CAN bus message sets, including the original message data and the extended data with added random noise, are divided into multiple subsets. Then, using the concept of K-fold cross-validation, each subset is used as the validation set in turn, and the remaining subsets are used as the training set, thus cyclically training and validating the model. This approach allows for effective evaluation of model performance without using additional data, reduces the risk of overfitting, and ensures that the data anomaly detection model can demonstrate excellent detection capabilities on different data subsets, improving the model's reliability and generalization. In this embodiment, the training and validation of the data anomaly detection model are performed alternately. During training, CAN bus message data from the training set is used as input, and the corresponding anomaly detection results are used as output labels. The model parameters are continuously adjusted so that the model can learn the difference between normal and abnormal data. After each training iteration, the model is tested on the current validation set. The purpose of validation is to check whether the model can accurately identify anomalies on unseen subsets, which helps to evaluate the model's performance in real-world environments. This process is repeated until the model passes the validation criteria when using the last subset as the validation set. In other words, the model exhibits satisfactory performance metrics on all subsets, such as high accuracy and low false positive rate. This signifies that the model training is complete, it has achieved the expected anomaly detection capability, and it becomes the final data anomaly detection model.

[0044] Through the above methods and training and verification processes, particularly the combination of data augmentation and cross-validation, this embodiment can generate a powerful, accurate, and robust data anomaly detection model to cope with various complex anomalies and attacks that electric vehicle charging piles may encounter in CAN bus communication. This approach not only improves the data anomaly detection model's tolerance to noise but also ensures stable performance under various data distributions, thus providing a solid guarantee for the safe operation of charging piles.

[0045] In an optional embodiment, when the feature data field includes a charging environment monitoring field, multiple attention encoders in the data anomaly detection model are used to process multiple initial feature sequences to obtain multiple weighted feature sequences. This includes: acquiring charging environment monitoring data of the charging pile collected by the sensor device; optimizing the attention weights corresponding to each of the multiple attention encoders based on the charging environment monitoring data to obtain optimized attention weights corresponding to each of the multiple attention encoders; and processing the multiple initial feature sequences based on the optimized attention weights corresponding to each of the multiple attention encoders to obtain multiple weighted feature sequences.

[0046] Optionally, the attention weights of multiple attention encoders in the model can be optimized using environmental monitoring data. This means the model dynamically adjusts its attention to different feature fields based on the specific environment of the charging station. For example, in extreme high or low temperature environments, the weight of the ambient temperature field may be increased so that the model can more sensitively monitor the potential impact of temperature changes on the charging process. Similarly, if the power fluctuation is abnormal, the model will increase its attention to this field to promptly detect potential safety issues caused by unstable power supply. In practice, the model will customize and optimize the attention weights of the attention encoders based on charging environment monitoring data. This optimization process can utilize environmental data as additional input or constraints, and adjust model parameters to achieve the optimal weight allocation through techniques such as gradient descent or genetic algorithms. These optimized attention weights will directly affect the processing of the initial feature sequence. Each feature sequence will be assigned a new weight, dynamically adjusted based on environmental monitoring data, when it passes through its corresponding attention encoder. This process ensures that in changing environments, the model can more accurately identify which features are most critical for anomaly detection. Finally, the model re-weights each initial feature sequence based on the optimized attention weights, generating weighted feature sequences. These weighted sequences not only contain information from the original features but also incorporate the influence of environmental monitoring data, enabling the model to analyze data more intelligently and adjust the sensitivity and accuracy of anomaly detection according to real-time changes in environmental conditions. For example, in high-temperature environments, the model may pay more attention to temperature-sensitive messages, such as battery temperature monitoring messages, to reduce the risk of battery overheating; while under unstable power supply conditions, the model will focus on detecting anomalies related to power supply, such as voltage and current fluctuations.

[0047] In the above methods, the data anomaly detection model can make intelligent adjustments based on real-time changes in the charging environment when processing CAN bus messages of charging piles, thereby improving its anomaly detection capability in complex and ever-changing environments and providing more effective protection for the safety and stability of electric vehicle charging process.

[0048] In one optional embodiment, based on charging environment monitoring data, the attention weights corresponding to each of the multiple attention encoders are optimized to obtain the optimized attention weights corresponding to each of the multiple attention encoders. This includes: determining whether there is an anomaly in the charging environment of the charging pile based on the charging environment monitoring data; and optimizing the attention weights corresponding to each of the multiple attention encoders when there is an anomaly in the charging environment to obtain the optimized attention weights corresponding to each of the multiple attention encoders.

[0049] Optionally, when an anomaly is detected in the charging environment, the attention weights of multiple attention encoders are optimized to obtain optimized attention weights. This optimization process is dynamic, and its goal is to enable the data anomaly detection model to focus more on feature data fields that are directly or indirectly related to the environmental anomaly, such as ambient temperature, battery fluctuation status, and charging status monitoring data that these environmental anomalies may affect, such as changes in charging voltage and current. Through this optimization, the model can more efficiently identify CAN message anomalies caused by environmental anomalies, improving the accuracy and efficiency of detection. The above method tightly integrates charging environment monitoring with CAN message anomaly detection, forming an environment-sensitive anomaly detection closed loop. When charging environment monitoring data indicates an environmental anomaly, the model automatically adjusts its focus on feature data, thereby making anomaly detection more accurate. For example, in a high-temperature environment, the model may increase its attention to battery temperature monitoring messages, because high temperatures may cause an abnormal rise in battery temperature, which in turn leads to anomalies in CAN messages during charging.

[0050] In the above methods, the charging pile's data anomaly detection system can respond quickly to environmental anomalies, specifically adjusting its attention mechanism to improve its ability to detect CAN message anomalies caused by environmental abnormalities. This further ensures the safety of the charging pile and the electric vehicle charging process, avoiding safety hazards caused by environmental factors. This environmentally sensitive anomaly detection method enables the system to maintain high alertness and adaptability in unpredictable external environments, ensuring the continuity and stability of the charging process.

[0051] As an optional embodiment, based on charging environment monitoring data, the attention weights corresponding to each of the multiple attention encoders are optimized to obtain the optimized attention weights for each of the multiple attention encoders. This includes: determining the correlation scores between multiple fields and the charging environment monitoring data, wherein the correlation scores are used to quantify the degree of correlation between the corresponding fields and the charging environment monitoring data; based on the correlation scores between the multiple fields and the charging environment monitoring data, the optimized attention weight corresponding to the i-th attention encoder is obtained from the optimized attention weights of the multiple attention encoders in the following manner:

[0052]

[0053] Where, α i ' represents the optimized attention weights corresponding to the i-th attention encoder; α i s represents the attention weights corresponding to the i-th attention encoder; i (E t ) represents the correlation score between field i and the charging environment monitoring data among multiple fields; α j s represents the attention weights corresponding to the j-th attention encoder; j (E t The ) represents the correlation score between field j and the charging environment monitoring data among multiple fields; N represents the total number of attention encoders;

[0054] Among them, s i (E t It is obtained in the following way:

[0055]

[0056] Among them, E t This indicates charging environment monitoring data; This represents the mean of field i collected at multiple historical sampling times; This represents the variance of field i collected at multiple historical sampling times. The optimized attention weights for each of the multiple attention encoders are obtained by using the method of obtaining the optimized attention weights corresponding to the i-th attention encoder. Through the above method, the original weight α... i Reflects the fundamental importance of the encoder (can be uniformly initialized, e.g., αi = 1 / N); correlation score s i (E t The weights are dynamically adjusted so that encoders that are more relevant to the environment receive higher weights. This allows the weights to be updated in real time with environmental data, adapting to dynamic scenarios.

[0057] As an optional embodiment, multiple initial feature sequences are processed based on the optimized attention weights corresponding to each of the multiple attention encoders to obtain multiple weighted feature sequences, including:

[0058] The smoothed attention weights corresponding to the i-th attention encoder are obtained by smoothing the optimized attention weights corresponding to the i-th attention encoder in the following way:

[0059] α i "(t)=βα i ′(t)+(1-β)α i ′(t-1)

[0060] Where, αi "(t) represents the smoothed attention weights corresponding to the i-th attention encoder; β represents the smoothing coefficient; α i '(t) represents the optimized attention weight of the i-th attention encoder at the current time, where the current time is the moment when the CAN bus message data of the current frame is acquired; α i ′(t-1) represents the optimized attention weight corresponding to the i-th attention encoder in the previous time step; by using the smooth attention weight corresponding to the i-th attention encoder, we obtain the smooth attention weight corresponding to each of the multiple attention encoders; based on the smooth attention weight corresponding to each of the multiple attention encoders, we process the multiple initial feature sequences to obtain multiple weighted feature sequences.

[0061] Optionally, this embodiment introduces a smoothing coefficient to smooth the optimized attention weights over time. Then, the smoothed attention weights are used to weight the initial feature sequence, ultimately generating a weighted feature sequence for anomaly detection analysis. By smoothing the attention weights, the model can more robustly respond to environmental changes, avoiding sudden adjustments to model weights due to rapid changes in the external environment, thereby reducing false positive and false negative rates.

[0062] Step S108: Based on multiple weighted feature sequences, the Long Short-Term Memory (LSTM) network in the data anomaly detection model is used to obtain the anomaly detection result of the current frame CAN bus message data. The anomaly detection result includes the anomaly status and the attack type. The anomaly status is used to indicate whether the current frame CAN bus message data has been subjected to an anomaly attack.

[0063] Optionally, in this step, all weighted feature sequences are input into the Long Short-Term Memory (LSTM) network in the data anomaly detection model for integrated analysis. LSTM is a special type of recurrent neural network well-suited for processing sequential data because it can remember long-term dependencies and filter out irrelevant information. At this stage, LSTM not only considers the features of the current frame but also reviews the weighted feature sequences of historical frames to capture potential temporal anomaly patterns. In this way, the data anomaly detection model can perform more comprehensive anomaly detection, including identifying abnormal states and specific attack types, such as command tampering and abnormal broadcasting, ensuring that charging stations maintain a high level of vigilance and responsiveness even in the face of complex attacks.

[0064] In an optional embodiment, when the feature data field includes a communication quality field and the anomaly detection result carries a communication quality anomaly detection result, based on multiple weighted feature sequences, the long short-term memory network in the data anomaly detection model is used to obtain the anomaly detection result of the current frame CAN bus message data. This includes: obtaining the actual communication quality of the current frame CAN bus message data transmission; obtaining the communication quality anomaly detection result of the current frame CAN bus message data; comparing the actual communication quality and the communication quality anomaly detection result to obtain a comparison result; if the comparison result indicates that the actual communication quality and the communication quality anomaly detection result do not match, optimizing the parameters of the data anomaly detection model to obtain an optimized data anomaly detection model; and using the optimized data anomaly detection model based on multiple frames of CAN bus message data to obtain the optimized anomaly detection result of the current frame CAN bus message data.

[0065] Optionally, when the feature data fields include a communication quality field, and the anomaly detection results carry communication quality anomaly detection results, a real-time comparison of the actual communication quality and the detection results is performed. Real-time monitoring data of communication quality (such as packet loss rate, bit error rate, communication latency, etc.) is compared with the communication quality anomaly detection results output by the data anomaly detection model. This aims to verify the model's detection accuracy and ensure that the model can reflect changes in the real communication state in real time. The comparison results analyze whether the actual communication quality matches the communication quality anomaly detection results predicted by the model. Ideally, the detection results of the data anomaly detection model should be consistent with the actual communication situation. For example, if packet loss occurs in actual communication, the model should also detect an anomaly of increased communication errors; conversely, if the model reports communication anomalies while the actual communication quality is normal, this may indicate that the model has false alarms. When a mismatch is found between the actual communication quality and the anomaly detection results predicted by the model, i.e., the data anomaly detection model has false alarms or missed alarms, the parameters of the data anomaly detection model need to be optimized to improve the model's detection accuracy for communication quality anomalies. This parameter adjustment may be real-time or performed in batches after a mismatch is detected. The optimization aims to make the model more accurately reflect the real state of CAN bus communication, preventing false alarms and missed detections, and improving the overall security and reliability of the system. The optimized data anomaly detection model can more accurately identify anomalies in the current frame based on multiple CAN bus message data, especially in detecting communication quality anomalies. This optimized model will provide more accurate anomaly identification in subsequent charging communication monitoring, reducing false alarm rates, improving anomaly identification capabilities, and ensuring timely and accurate identification and response to anomalies when communication quality deteriorates.

[0066] The above methods enable continuous improvement of data anomaly detection, enhancing the ability to detect communication anomalies and ensuring communication security between charging piles and electric vehicles. Even under deteriorating communication conditions, the system can maintain stable operation and effectively prevent charging safety accidents caused by communication quality anomalies. This dynamic optimization and self-correction mechanism is key to improving system safety and intelligence.

[0067] In one optional embodiment, when the comparison results indicate a mismatch between the actual communication quality and the communication quality anomaly detection results, the parameters of the data anomaly detection model are optimized to obtain an optimized data anomaly detection model. This includes optimizing the attention weights corresponding to each of the multiple attention encoders to obtain the optimized data anomaly detection model.

[0068] Optionally, when the communication quality anomaly detection results of the data anomaly detection model do not match the actual communication quality, i.e., the data anomaly detection model may incorrectly report anomalies or ignore actual anomalies, a model parameter optimization process will be initiated. This process focuses specifically on optimizing the attention weights corresponding to the multiple attention encoders. Attention weights determine the degree of importance the model places on different feature fields when analyzing CAN message data. By adjusting these weights, the model can place greater emphasis on feature fields directly related to communication quality, such as communication latency and packet loss rate, in future anomaly detection, thereby improving its sensitivity and identification ability for communication anomalies. The optimized data anomaly detection model, especially after the attention weights are adjusted, will exhibit stronger environmental adaptability and higher detection accuracy. The data anomaly detection model can better understand the manifestation of communication quality anomalies under different conditions, reduce false alarms, and detect potential anomalies earlier, which is crucial for ensuring safe communication between charging piles and electric vehicles. The parameter adjustments during the optimization process enable the data anomaly detection model to learn a more reasonable ranking of feature importance. As a result, in actual deployment, the model can allocate computing resources more intelligently, focus on detecting truly important anomalies, and reduce interference with normal communication activities.

[0069] In the above approach, the data anomaly detection model of this embodiment can continuously improve itself when facing complex and ever-changing communication quality scenarios, enhance its ability to identify communication anomalies, and ensure that the communication security between charging piles and electric vehicles is not affected by changes in communication quality.

[0070] Through the above steps S102 to S108, the goal of acquiring and reconstructing multi-frame CAN message data of the charging pile, processing the feature sequence of the same field with multiple attention encoders, and then comprehensively analyzing the weighted feature sequence with a target attention encoder can be achieved. This enables real-time, efficient, and accurate identification of abnormal states and classification of attack types for the current frame message, thereby effectively improving the accuracy of data anomaly detection in the CAN bus communication of electric vehicle charging piles and ensuring the communication security of charging piles. This also solves the technical problem in related technologies where the factors considered in the data anomaly detection in the CAN bus communication of electric vehicle charging piles are not comprehensive, resulting in low detection accuracy.

[0071] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation method for detecting data anomalies in electric vehicle charging piles. The method in this embodiment adopts an improved Long Short-Term Memory Neural Network (LSTM) model and introduces a "two-layer attention mechanism" to extract and fuse the features of CAN message data in a hierarchical manner. Figure 3 This is a schematic diagram of an optional model architecture according to an embodiment of the present invention, such as... Figure 3 As shown, the dual-layer attention-LSTM in this embodiment consists of two levels: local feature attention and global temporal attention. The former focuses on important field features within a single CAN message frame, while the latter emphasizes the pattern relationships of the message sequence over time. By deeply mining the local and global feature information of the CAN data stream through a dual-layer attention encoder, the method in this embodiment can efficiently search for and learn the temporal patterns between message features. Compared with methods in related technologies, this model significantly reduces redundant information interference while extracting key features of charging communication, thus improving the efficiency and accuracy of anomaly detection. Specifically, it includes:

[0072] First, the messages collected in real time from the charging pile's CAN bus are preprocessed and feature-encoded. For each frame of CAN bus message data, basic field information such as message identifier ID, data length (DLC), and each byte of the data field is extracted, and combined with context information such as timestamp and sending node to form an original feature vector, such as... Figure 2As shown, the original CAN bus message data is segmented into fixed-length sequences by a segment generator, providing input for subsequent local attention. The local feature attention mechanism analyzes the importance of each dimension of the feature vector through an embedded encoder. It acts as an "adaptive filter," assigning a weight coefficient to each message field to highlight the local features that contribute most to anomaly detection (e.g., abnormal changes in certain key bytes or flag bits). Next, the weighted encoded message representation is input into the LSTM sequence model (i.e., the Long Short-Term Memory network in the model). As a recurrent neural network, LSTM can memorize message sequence patterns within a certain time window. This embodiment introduces a global temporal attention mechanism above the LSTM output layer to comprehensively consider the influence of messages at different times in the sequence on the current state determination. In other words, the model automatically learns which historical messages (e.g., a frame from a few milliseconds or tens of milliseconds ago) are most relevant to determining whether the current state is abnormal and assigns them higher attention weights. Through the above two-layer attention structure, the model can achieve fusion analysis of local details and global temporal sequence of CAN data, thereby identifying subtle and complex anomaly patterns. For example, in the case of a slow attack that gradually tampers with parameters, local attention can detect deviations in key parameters, and global attention combined with multi-frame temporal changes can determine the anomaly; another example is the intermittent pseudo-messages inserted by abnormal nodes, in which the model can capture the abnormal rhythm and content features that appear in the global sequence.

[0073] This invention proposes an optional implementation of a data anomaly detection system for electric vehicle charging piles. The system's overall architecture comprises both hardware and software components, designed to be embedded within the charging pile or connected to the CAN network as a standalone terminal. The hardware mainly consists of a microprocessor / embedded computing unit, a CAN bus interface circuit, and a network communication module. The software includes functional units such as a data acquisition module, a data preprocessing module, a deep learning analysis module, and an anomaly reporting module. The functions and data flows of each module are as follows. The CAN data anomaly monitoring system of this embodiment mainly consists of the following modules:

[0074] CAN Acquisition Module: This module monitors the CAN bus communication between the charging station and the vehicle in real time via the CAN transceiver circuit inside the charging station. It non-intrusively acquires the twisted-pair CAN signal and converts the analog signal into digital message data. The raw CAN messages acquired by the module include timestamps, message IDs, DLCs, and data fields. It continuously receives messages using a FIFO buffer and transmits them to subsequent preprocessing modules.

[0075] Data preprocessing module: Standardizes and encodes the raw CAN bus message data transmitted from the acquisition module to meet the input requirements of the deep learning model.

[0076] h i,n =L (1)(x i,n )

[0077] Where, x i,n For input feature values; L (1) (·) represents the first LSTM unit in the LSTM network; h i,n This is for outputting feature values.

[0078] First, the messages are reassembled into a time-series data structure according to chronological order, and then divided into time windows or message sequence segments as needed. Next, message features are extracted, including numerical features (such as ID, byte values ​​of data fields) and categorical features (such as message type, sending node). Numerical features can be normalized or binarized, while categorical features are represented using one-hot encoding. Furthermore, this module can perform coarse anomaly screening (such as checksum detection and frame format verification) to filter out obviously corrupted messages and prepare tensor-formatted data batches for model input.

[0079] Model Analysis Module: This is the core functional module of the system in this embodiment. It internally runs a pre-trained two-layer attention LSTM deep learning model to perform real-time analysis of the pre-processed CAN message sequence data. The attention encoder in the model is a composite module containing LSTM and an attention mechanism, used to encode the input sequence and highlight key elements. The LSTM network, as a substructure, is responsible for extracting features from the sequence data in the time or sequence dimension, while the attention mechanism allocates weights and integrates information based on the LSTM output. The model inputs a feature sequence tensor containing several consecutive messages, which, after calculation by the LSTM layer and the attention mechanism, outputs the corresponding anomaly score or classification result. In implementation, the model analysis module updates the hidden state of the LSTM for each new message at each time step and uses the attention mechanism to determine whether an abnormal pattern has occurred at that moment. If an anomaly is detected and its confidence score exceeds a set threshold, subsequent processing is triggered. Since the model has learned the normal charging communication pattern, it can identify any deviations in message order or content (such as illegal command insertion, parameter mutations, etc.).

[0080]

[0081] C(H i ) = tanh(H i W i +b i )

[0082] H i =(h i,1 ,h i,2 ,...,h i,N ) T

[0083] Where C(·) represents a fully connected layer, whose function is to perform a non-linear mapping on the hidden state in order to calculate the attention score; W i With b i Representing the i-th feature segment X respectively i The weight matrix and bias vector are given; q is a randomly initialized segment vector. Thus, the module completes the transformation from feature segment X... i To the hidden state sequence H i The transformation, S i This represents the weighted representation vector of the i-th feature segment.

[0084] S i =E (1) (X i )

[0085] X i =(x i,1 ,...,x i,n )

[0086] Among them, E (1) (·) represents the first-layer attention encoder, where the LSTM network structure is bidirectional. Figure 4 This is a schematic diagram of an optional LSTM network structure according to an embodiment of the present invention. Figure 4 Each module in the above represents a specific component of the first stage of the model (local segment feature processing), and the corresponding variables or operations for each module can be found in the aforementioned formula:

[0087] Input module (segment feature sequence X) i ): Figure 4 The left side of the image shows the feature sequence after preprocessing and segment generation, which then enters the attention encoder. Taking the i-th segment as an example, the input X... i =[x i,1 ,x i,2 ,…,x i,N This segment contains N feature values. These feature values ​​originate from various fields of the original CAN message (such as ID, DLC, data bytes, etc.), and have undergone normalization or one-hot encoding processing before being fed into the model as numerical vectors. Figure 4 In the middle, enter X i It is represented as a node or an array, with a size of N×d (d is the dimension of each feature value after encoding).

[0088] LSTM encoding module: The input sequence first flows through the LSTM layer. Figure 4 The LSTM process for processing feature sequences is presented in a sequential structure: from x i,1 To x i,N The data is sequentially fed into the LSTM unit, and the corresponding hidden state h is output. i,1 to h i,NBecause it uses a bidirectional LSTM, Figure 4 The LSTM module can be represented by two parallel arrow directions: one represents forward propagation (from the 1st feature to the Nth feature), and the other represents backward propagation (processing the Nth feature in reverse order to the 1st feature). The forward and backward hidden units of the bidirectional LSTM are concatenated at each time step to form the final hidden output h. i,n . Figure 4 The diagram illustrates that there may be one LSTM unit above / below each time step, representing the forward and backward LSTM processing. The LSTM encoding module corresponds to L in the above formula. (1) The calculation part outputs H. i =[h i,1 ,...,h i,N ] T This can be viewed as a matrix flowing out of the LSTM module in the graph. Regarding variable mapping, Figure 4 LSTM output node h i,n That is, the hidden state vector in the formula; similarly, the entire set of hidden states H i This corresponds to the matrix with the same name in the formula above. Note that for simplicity, H may not be labeled in the diagram. i The transpose operation; however, it has been clearly stated in the analysis that Hi is a matrix of dimension N×f, and (f×N) participates in the subsequent attention calculation.

[0089] Fully connected transform module: immediately following the LSTM output, Figure 4 There is a fully connected layer (FC) module. This module processes each hidden state vector h. i,n The same set of affine transformations (weight matrix + bias) is applied to extract features that are helpful for attention calculation. This corresponds to C(H) in the formula. i ) = tanh(H i W i +b i ), here W i b i Right now Figure 4 The parameters of the fully connected layer are shown in the diagram. Although W may not be labeled individually in the illustration. i and b i However, the role of a fully connected (FC) is usually represented by a weighted arrow or a small neuron symbol. The weight matrix W i Each h i,n The bias vector b maps from f dimensions to f dimensions (or f' dimensions). i After mapping, the elements are added together element by element, and finally passed through the tanh activation function (which can be represented by a non-linear curve in the figure). The output of the FC layer can be represented as a matrix. Each row corresponds to an "intermediate attention representation" of a feature. In this way, the fully connected module is ready for the calculation of attention weights. It should be noted that in this embodiment, W... i and b i Using the subscript 'i' implies that each segment can have independent parameters. However, in implementation, W is usually used instead. i and b i Shared between segments (i.e., W) (1) ,b (1) (As parameters of the first-layer attention encoder), unless there are special requirements for different segment types. These details are not included. Figure 4 This is reflected in the text, but it does not affect the understanding of the module's functions.

[0090] Attention weight calculation module: Based on the FC output, Figure 4 It includes a module for calculating the attention coefficient. Typically, it uses... Alternatively, the nodes connecting the weights represent the process of calculating the inner product with q, and then obtaining the weights through softmax. Specifically, Figure 4 This will introduce an attention query vector q (or denoted as V). k) It can be drawn as a special node, fed into the attention calculation module from the outside, and connected with U. i Element-wise action. According to the formula in the aforementioned embodiment, U... i Performing matrix-vector multiplication with q yields a vector of length N, which is then normalized using softmax. This computational module directly corresponds to the softmax(C(H)) function in the aforementioned formula. i In other words, Figure 4 This module receives U i Inputs are (from the FC layer) and q, output attention weights α. i,n (For n = 1...N). The shape of q in the graph is the same as the hidden vector (dimension f), and it can be represented by a fixed vector icon with labels such as "initial segment vector" to indicate its special status. Its value is random in the initial state, but is fixed as a model parameter after training; therefore, q can be considered a known constant input in the graph (e.g., represented by a dashed box). This module calculates and obtains the set of local attention weights α. i,1 ,...,α i,N .

[0091] Weighted summation (attention output) module: This is the final step of the local attention encoder. Figure 4 This is manifested as a process of combining the hidden states of the LSTM with attention weights. For example, there are multiple outputs h from the LSTM. i,n Pointing to the convergence node S i The weighting coefficient added to each line is α. i,nThese connections come together to represent S. i The node means computation This module performs weighted integration of features within a segment, and its output is the segment representation vector S. i S in the diagram i Located at the far right of the attention encoder module, it serves as the output of the entire first stage. Through this module, Figure 4 This realizes the transformation from input feature segments to output vector S. i The mapping closed loop is completely consistent with the formula derivation in the aforementioned embodiments.

[0092] The above modules together constitute Figure 4 The structure of the local attention encoder E(1) is shown. In simple terms, the process in the diagram is equivalent to: input tensor X i The hidden tensor H is obtained by LSTM extraction. i Then, after a fully connected transformation, it becomes U. i Then, the weight α is calculated by combining it with q. (i) Finally, regarding H i Weighted summation output S i Each module plays a specific role in this process, and its corresponding formula variables have been mapped and labeled above. It should be noted that... Figure 4 The structure highlighted is the first-layer attention encoder; the overall temporal attention (second-layer encoder) structure is shown below. Figure 4 It is not shown in detail, but it can be compared to the first layer, including a layer for S. i The sequence is LSTM and the corresponding attention unit.

[0093] Figure 5 In the implementation of the local attention encoder shown, the LSTM network and the attention mechanism work closely together and complement each other for synergistic effect:

[0094] First, LSTM, as a sequence model, excels at capturing the sequential patterns and dependencies between feature values ​​within a segment. This remains relevant in CAN message feature processing—although the fields of the message are not semantically time-series, logical relationships exist between different fields. For example, the ID field determines the meaning of the data segment bytes, and certain byte combinations reflect abnormal situations. By inputting the field sequence into the LSTM, the model can learn these implicit patterns. Bidirectional LSTM further ensures the hidden representation h of each field. i,n It integrates information from all fields of the entire message frame; this is more in-depth than simply assigning weights to each field, because the gating mechanism and recurrent connections of LSTM can extract complex nonlinear relationships between features. For example, a field may appear normal on its own, but combined with changes in another field, it may constitute an anomaly, and this pattern can be encoded by the hidden states of LSTM.

[0095] The attention mechanism filters and emphasizes the rich representations provided by LSTM. Each hidden vector h output by LSTM... i,n It contains comprehensive information about field N and its context. The attention mechanism compares h. i,n The degree of matching with the parameter vector q is assigned different weights α. i,n This is equivalent to identifying "which are the most critical" among numerous features. Functionally, the attention layer acts as a soft information filter: "filtering" feature patterns determined by q, giving high weight to hidden states that match patterns and low weight to those that don't, thereby highlighting important local features. Continuing with the previous example, if a certain anomaly type is typically manifested as an abnormal change in a specific byte, q will be adjusted during training to be more sensitive to the pattern corresponding to that byte position. Then, when an anomaly occurs, the byte corresponding to h... i,n High correlation with q, α i,n As the size increases, the model focuses more attention on that area. This focus on key fields is crucial for achieving highly accurate anomaly detection.

[0096] The synergistic effect of the two is that LSTM provides "memory" and "understanding," while attention is responsible for "focusing" and "decision-making." Without LSTM, simply assigning weights to the original features through attention may overlook the relationships between features and make it difficult to handle complex patterns. Without attention, although LSTM extracts patterns, it lacks a selection mechanism for the current discrimination task and is easily interfered with by redundant information. Combined, LSTM first "writes" information into the hidden state, and attention then "reads" out the most relevant parts. In fact, this LSTM+Attention architecture was initially proven effective in fields such as machine translation, and its principle is equally effective in anomaly detection in this embodiment. This embodiment specifically discusses how the dual-layer attention captures signs of different types of attacks: for slow parameter tampering attacks, local attention detects key parameters gradually deviating from normal, while global attention confirms the anomaly by integrating changes across multiple frames; for intermittent false message insertion, the model identifies it by combining local feature anomalies with global rhythm anomalies. These cases demonstrate the synergy between LSTM and attention at different levels: at the local level, the field associations modeled by LSTM and the field anomalies highlighted by attention work together to quickly detect subtle anomaly patterns; at the global level, Si at different times is filtered by a second layer of LSTM and attention to capture temporal anomaly patterns. Therefore, the two attention layers, local and global, each collaborate through LSTM + attention to ultimately achieve accurate detection of complex anomalies. Figure 5 This collaborative relationship can be seen from the information flow: the LSTM layer and the attention layer are connected in series and neither can be omitted, demonstrating a high degree of modular cooperation.

[0097] Abnormal reporting module: When the model analysis determines an abnormal state, this module is responsible for further processing and reporting the abnormal information. Specifically, it first packs the message data related to the abnormality and the determination result into an abnormal event record, which includes information such as time, message ID, data content, and abnormal type discrimination. Then, through the built-in Ethernet communication module, the abnormal event is sent to the background monitoring center or cloud platform. The reporting uses a standard network protocol (such as TCP / IP) to upload the data so that the background management system can perform alarm display, further analysis, and archiving. In addition, the reporting module can also execute linkage control locally, such as triggering the charging pile to enter the safe mode (pause charging) to avoid potential dangers. The entire reporting process is completed in milliseconds, ensuring timely response when an abnormality occurs and notifying the operation and maintenance personnel or the upper-level security system to take measures.

[0098] The above-mentioned modules work together in the system: CAN acquisition -> preprocessing -> model analysis -> abnormal reporting, forming a closed-loop abnormal monitoring process, and realizing all-weather intelligent monitoring of the charging pile CAN communication. It is worth emphasizing that the double-layer attention LSTM model adopted in the present invention has been trained and optimized a lot, enabling it to run efficiently on the embedded terminal and meet the requirements of real-time monitoring of the charging pile. The model can be deployed on a microprocessor or SoC to run inference, its parameter scale is moderate, and the inference delay is in milliseconds, which will not affect the normal progress of charging control. At the same time, through modular design, the system has good scalability and adaptability, and can update the training data and fine-tune the model according to different vehicle models or protocol versions to continuously improve the detection performance.

[0099] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. For example, there is an interface between this system and relevant users or institutions. Before obtaining relevant information, a request for acquisition needs to be sent to the aforementioned users or institutions through the interface, and after receiving the consent information feedback from the aforementioned users or institutions, the relevant information can be obtained.

[0100] In this embodiment, a data abnormality detection device for an electric vehicle charging pile is also provided. This device is used to implement the above-mentioned embodiment and preferred implementation manners, and those that have been described will not be repeated. As used hereinafter, the terms "module" and "device" can be a combination of software and / or hardware that can achieve a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.

[0101] According to an embodiment of the present invention, an apparatus embodiment for implementing the above-mentioned data abnormality detection method for an electric vehicle charging pile is also provided.​ This is a schematic diagram of the structure of a data anomaly detection device for an electric vehicle charging pile according to an embodiment of the present invention, as shown below. ​ As shown, the above-mentioned data anomaly detection device for electric vehicle charging piles includes: a data acquisition module 500, a data reconstruction module 502, a data processing module 504, and an anomaly detection module 506, wherein:

[0102] The data acquisition module 500 is used to acquire multi-frame CAN bus message data of the charging pile. The multi-frame CAN bus message data includes the current frame CAN bus message data and the CAN bus message data of the predetermined frames preceding the current frame CAN bus message data. The CAN bus message data includes data information corresponding to multiple fields.

[0103] The data reassembly module 502, connected to the data acquisition module 500, is used to reassemble multiple frames of CAN bus message data according to multiple fields to obtain multiple initial feature sequences, wherein each feature sequence includes data information of the same field extracted from multiple frames of CAN bus message data;

[0104] The data processing module 504, connected to the data recombination module 502, is used to process multiple initial feature sequences using multiple attention encoders in the data anomaly detection model to obtain multiple weighted feature sequences. The multiple attention encoders correspond one-to-one with the multiple initial feature sequences, and the weighted feature sequences are obtained by weighting based on the attention weights of the corresponding attention encoders.

[0105] The anomaly detection module 506, connected to the data processing module 504, is used to obtain the anomaly detection result of the current frame CAN bus message data based on multiple weighted feature sequences and using the long short-term memory network in the data anomaly detection model. The anomaly detection result includes the anomaly status and the attack type. The anomaly status is used to indicate whether the current frame CAN bus message data has been subjected to an abnormal attack.

[0106] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0107] It should be noted that the data acquisition module 500, data reconstruction module 502, data processing module 504, and anomaly detection module 506 mentioned above correspond to steps S102 to S108 in the embodiments. The instances and application scenarios implemented by the above modules and their corresponding steps are the same, but they are not limited to the content disclosed in the above embodiments. It should be noted that the above modules, as part of the device, can run on a computer terminal.

[0108] It should be noted that the optional or preferred implementation methods of this embodiment can be found in the relevant descriptions in the embodiments, and will not be repeated here.

[0109] The aforementioned data anomaly detection device for electric vehicle charging piles may also include a processor and a memory. The aforementioned data acquisition module 500, data reconstruction module 502, data processing module 504, anomaly detection module 506, etc., are all stored in the memory as program modules, and the processor executes the aforementioned program modules stored in the memory to realize the corresponding functions.

[0110] The processor contains a core that retrieves the corresponding program modules from memory. One or more cores may be configured. Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory includes at least one memory chip.

[0111] According to an embodiment of this application, an embodiment of a non-volatile storage medium is also provided. Optionally, in this embodiment, the non-volatile storage medium includes a stored program, wherein, when the program runs, it controls the device where the non-volatile storage medium is located to execute any of the above-mentioned data anomaly detection methods for electric vehicle charging piles.

[0112] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals, and the non-volatile storage medium includes stored programs.

[0113] According to an embodiment of this application, an embodiment of a processor is also provided. Optionally, in this embodiment, the processor is used to run a program, wherein the program executes any of the above-described methods for detecting data anomalies in electric vehicle charging piles.

[0114] According to an embodiment of this application, an embodiment of a computer program product is also provided, which, when executed on a data processing device, is adapted to execute a program that initializes the data anomaly detection method steps of an electric vehicle charging pile having any of the above-described steps.

[0115] This invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the data anomaly detection method for electric vehicle charging piles described above.

[0116] The order of the above embodiments of the present invention is merely for description and does not represent the superiority or inferiority of the embodiments.

[0117] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0118] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of modules described above can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between modules, and may be electrical or other forms.

[0119] The modules described above as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0120] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0121] If the aforementioned integrated modules are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable non-volatile storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a non-volatile storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned non-volatile storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0122] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting data anomalies in electric vehicle charging piles, characterized in that, include: The system acquires multi-frame CAN bus message data of the charging pile, wherein the multi-frame CAN bus message data includes the current frame CAN bus message data and the predetermined frame CAN bus message data preceding the current frame CAN bus message data; the CAN bus message data includes data information corresponding to multiple fields. The multi-frame CAN bus message data is reassembled according to the multiple fields to obtain multiple initial feature sequences, wherein each feature sequence includes data information of the same field extracted from the multi-frame CAN bus message data; Multiple attention encoders in the data anomaly detection model are used to process the multiple initial feature sequences to obtain multiple weighted feature sequences. The multiple attention encoders correspond one-to-one with the multiple initial feature sequences, and the weighted feature sequences are obtained by weighting the corresponding attention encoders. Based on the multiple weighted feature sequences, the Long Short-Term Memory (LSTM) network in the data anomaly detection model is used to obtain the anomaly detection result of the current frame CAN bus message data. The anomaly detection result includes anomaly status and attack type. The anomaly status is used to indicate whether the current frame CAN bus message data has been subjected to anomaly attack.

2. The method according to claim 1, characterized in that, Before processing the multiple initial feature sequences using multiple attention encoders in the data anomaly detection model to obtain multiple weighted feature sequences, the method further includes: Acquire CAN bus message data and anomaly detection results collected at N historical moments, where N is an integer greater than 2; According to the predetermined time sliding window, the CAN bus message data and anomaly detection results collected at the N historical moments are divided into multiple groups to obtain multiple CAN bus message sets corresponding to each historical moment. Each CAN bus message set includes the CAN bus message data and anomaly detection results of the corresponding historical moment, as well as the CAN bus message data of the predetermined frame before the corresponding historical moment. Using the CAN bus message data in the respective corresponding CAN bus message sets as input and the corresponding anomaly detection results as output, the initial network model is trained to obtain the data anomaly detection model. The training is used to optimize the attention weights of multiple attention encoders in the initial network model and to optimize the parameters of the long short-term memory network in the initial network model.

3. The method according to claim 2, characterized in that, The process of training an initial network model using CAN bus message data from the respective CAN bus message sets as input and the corresponding anomaly detection results as output, to obtain the data anomaly detection model, includes: Random noise is added to a portion of the CAN bus message set in each of the corresponding CAN bus message sets to obtain an extended CAN bus message set. The CAN bus message sets corresponding to each of the multiple historical moments, as well as the extended CAN bus message set, are divided into multiple groups to obtain multiple subsets; The plurality of subsets are used sequentially as the validation set, and the other subsets besides the validation set are used as the training set; Using CAN bus message data as input and the corresponding anomaly detection result as output, the initial network model is trained using the training set; the trained network model is validated using the validation set; the above operations are repeated until the last subset of the plurality of subsets is used as the validation set to validate the trained network model, thereby obtaining the data anomaly detection model.

4. The method according to claim 1, characterized in that, The plurality of fields include at least: timestamp, message identifier, data length code, and feature data field; the feature data field includes a charging status monitoring field, and at least one of the following: charging environment monitoring field and communication quality field, wherein the charging environment monitoring field includes at least: ambient temperature and power fluctuation status.

5. The method according to claim 4, characterized in that, When the feature data field includes a charging environment monitoring field, the multiple attention encoders in the data anomaly detection model are used to process the multiple initial feature sequences to obtain multiple weighted feature sequences, including: Acquire the charging environment monitoring data of the charging pile collected by the sensor device; Based on the charging environment monitoring data, the attention weights corresponding to each of the multiple attention encoders are optimized to obtain the optimized attention weights corresponding to each of the multiple attention encoders. Based on the optimized attention weights corresponding to each of the multiple attention encoders, the multiple initial feature sequences are processed to obtain the multiple weighted feature sequences.

6. The method according to claim 5, characterized in that, The step of optimizing the attention weights corresponding to each of the plurality of attention encoders based on the charging environment monitoring data to obtain the optimized attention weights corresponding to each of the plurality of attention encoders includes: Based on the charging environment monitoring data, determine whether there are any abnormalities in the charging environment of the charging pile; In the event of an abnormal charging environment, the attention weights corresponding to each of the multiple attention encoders are optimized to obtain the optimized attention weights corresponding to each of the multiple attention encoders.

7. The method according to claim 4, characterized in that, When the feature data field includes a communication quality field, and the anomaly detection result carries a communication quality anomaly detection result, the anomaly detection result of the current frame CAN bus message data is obtained based on the multiple weighted feature sequences and using the long short-term memory network in the data anomaly detection model, including: Obtain the actual communication quality of the current frame CAN bus message data transmission; Obtain the communication quality anomaly detection result of the current frame CAN bus message data; The actual communication quality and the communication quality anomaly detection results are compared to obtain the comparison results. If the comparison results indicate that the actual communication quality and the communication quality anomaly detection results do not match, the parameters of the data anomaly detection model are optimized to obtain an optimized data anomaly detection model. Based on the multi-frame CAN bus message data, the optimized data anomaly detection model is used to obtain the optimized anomaly detection result of the current frame CAN bus message data.

8. The method according to claim 7, characterized in that, When the comparison results indicate a mismatch between the actual communication quality and the communication quality anomaly detection results, the data anomaly detection model is optimized to obtain an optimized data anomaly detection model, including: If the comparison result indicates that the actual communication quality and the communication quality anomaly detection result do not match, the attention weights corresponding to each of the multiple attention encoders are optimized to obtain the optimized data anomaly detection model.

9. A data anomaly detection device for electric vehicle charging piles, characterized in that, include: The data acquisition module is used to acquire multi-frame CAN bus message data of the charging pile, wherein the multi-frame CAN bus message data includes the current frame CAN bus message data and the predetermined frame CAN bus message data preceding the current frame CAN bus message data; the CAN bus message data includes data information corresponding to multiple fields; The data reassembly module is used to reassemble the multi-frame CAN bus message data according to the multiple fields to obtain multiple initial feature sequences, wherein each feature sequence includes data information of the same field extracted from the multi-frame CAN bus message data; The data processing module is used to process the multiple initial feature sequences using multiple attention encoders in the data anomaly detection model to obtain multiple weighted feature sequences. The multiple attention encoders correspond one-to-one with the multiple initial feature sequences, and the weighted feature sequences are obtained by weighting based on the attention weights of the corresponding attention encoders. An anomaly detection module is used to obtain anomaly detection results of the current frame CAN bus message data based on the multiple weighted feature sequences and using the long short-term memory network in the data anomaly detection model. The anomaly detection results include anomaly status and attack type. The anomaly status is used to indicate whether the current frame CAN bus message data has been subjected to anomaly attack.

10. An electronic device, characterized in that, The device includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the data anomaly detection method for electric vehicle charging piles according to any one of claims 1 to 8.

Images