Abnormal behavior detection method based on multi-source security information data fusion

Abstract

The application provides an abnormal behavior detection method based on multi-source safety information data fusion, comprising: analyzing objects involved in data interaction in a vehicle-road-cloud cooperative system to construct a business knowledge graph; fusing acquired vehicle sensor data, road infrastructure data and cloud data to obtain fused data, extracting features, obtaining a plurality of to-be-fused features, fusing the plurality of to-be-fused features based on the business knowledge graph to obtain multi-source fused features, inputting the multi-source fused features into a plurality of preset behavior detection models to perform abnormal behavior detection, and outputting abnormal behaviors detected by each behavior detection model; and performing decision fusion on the abnormal behaviors detected by each behavior detection model to obtain final abnormal behaviors in the whole life cycle of data. In this way, the accuracy of the detection result of abnormal behaviors is improved, and the safety of data flow in the vehicle-road-cloud cooperative system is improved.

Description

Anomaly detection method based on multi-source security information data fusion Technical Field

[0001] This invention relates to the field of vehicle-road-cloud collaborative technology, and in particular to an abnormal behavior detection method based on multi-source security information data fusion. Background Technology

[0002] Vehicle-road-cloud collaborative technology, crucial for intelligent transportation and autonomous driving, is transitioning from theoretical research and pilot projects to commercial deployment. It aims to establish a real-time, reliable network connecting vehicles with entities that may influence their decisions, such as other vehicles, infrastructure, pedestrians, and cloud platforms. This will significantly improve road safety, efficiency, and the driving experience, and enhance the perception, decision-making, and collaborative capabilities of autonomous driving systems.

[0003] The environment of a vehicle-road-cloud collaborative system involves the interaction of various data streams, including structured messages, low-level signals, sensor data, perception results, traffic statistics, and global views. During these interactions, data leaks can occur due to network attacks, software vulnerabilities, hardware failures, and insufficient or ineffective data access control. Once a data leak occurs, the data subject may suffer economic losses or reputational damage. Examples include leaks of users' biometric data (facial, voiceprint, fingerprint), leaks of manufacturers' trade secrets, damage to corporate credit due to unsaved user data, leaks of charging network distribution data, and leaks of vehicle geolocation information.

[0004] However, the data in the vehicle-road-cloud cooperative system are diverse in format, time scale, spatial reference system, reliability and semantic level, which makes traditional anomaly detection algorithms and basic machine learning models unsuitable for processing such multimodal and high-dimensional complex data. Simply merging features or directly applying these methods often fails to effectively utilize the correlation between data, resulting in the inability to accurately detect abnormal behavior in the data interaction process of the vehicle-road-cloud cooperative system, thus reducing the security of data flow in the vehicle-road-cloud cooperative system. Summary of the Invention

[0005] This invention provides an abnormal behavior detection method based on multi-source security information data fusion, which solves the problem that the existing vehicle-road-cloud cooperative system cannot accurately detect abnormal behavior during data interaction, thus reducing the security of data flow in the vehicle-road-cloud cooperative system.

[0006] On the one hand, the present invention provides an abnormal behavior detection method based on multi-source security information data fusion, comprising:

[0007] Analyze the objects involved in data interaction in the vehicle-road-cloud collaborative system, and construct a business knowledge graph that includes physical layer correlation information, data flow correlation information, and security event correlation information;

[0008] After deduplication, normalization, and labeling preprocessing of the acquired vehicle sensor data, road infrastructure data, and cloud data, fused data is obtained.

[0009] Feature extraction is performed on the fused data to obtain multiple features to be fused;

[0010] Based on the business knowledge graph, semantic understanding is performed on the multiple features to be fused, and feature-level fusion is performed to obtain multi-source fused features;

[0011] The multi-source fusion features are input into multiple preset behavior detection models to detect abnormal behavior, and the abnormal behavior detected by each behavior detection model is output.

[0012] The abnormal behaviors detected by each behavior detection model are fused to obtain the final abnormal behavior.

[0013] According to the present invention, an abnormal behavior detection method based on multi-source security information data fusion is provided. Based on the business knowledge graph, semantic understanding is performed on the multiple features to be fused, and feature-level fusion is performed to obtain multi-source fused features, including:

[0014] Based on the business knowledge graph, determine the correlation between each feature to be fused and each abnormal behavior, and remove features to be fused with a correlation less than a preset correlation, while retaining features with a correlation greater than or equal to the preset correlation.

[0015] Based on the business knowledge graph, the importance of the retained features to be fused to the detection of abnormal behavior is determined, and weights are assigned to the retained features to be fused to obtain weighted features;

[0016] The weighted features are fused to obtain the multi-source fused features.

[0017] According to the present invention, an abnormal behavior detection method based on multi-source security information data fusion determines the correlation between each feature to be fused and each abnormal behavior based on the business knowledge graph, including:

[0018] Based on the business knowledge graph, determine the length of the shortest path from any node with any feature to be fused to any node with abnormal behavior and the total edge weight of the shortest path.

[0019] The ratio of the total edge weight to the length is used as the structural correlation between any feature to be fused and any abnormal behavior.

[0020] Convert any of the features to be fused into feature text, and convert any of the abnormal behaviors into behavior text;

[0021] The semantic similarity between the feature text and the behavior text is determined as the semantic correlation between any feature to be fused and any abnormal behavior;

[0022] The structural correlation degree and the semantic correlation degree are weighted and summed to obtain the correlation degree between any feature to be fused and any abnormal behavior;

[0023] Iterate through all features to be fused and the anomalous behaviors to obtain the correlation degree between each feature to be fused and each anomalous behavior.

[0024] According to the present invention, an abnormal behavior detection method based on multi-source security information data fusion determines the importance of retained features to be fused for abnormal behavior detection based on the business knowledge graph, including:

[0025] Determine the breadth of abnormal coverage, information hub value, and business importance of the retained features to be merged;

[0026] The importance of the retained features to be integrated is obtained by weighted summation of the anomaly coverage breadth, the information hub value, and the business importance.

[0027] According to the present invention, an abnormal behavior detection method based on multi-source security information data fusion is provided, wherein the process of determining the breadth of abnormal coverage includes:

[0028] Determine the number of nodes that exhibit anomalous behavior that are directly connected to the retained features to be fused;

[0029] The ratio of the number of nodes to the total number of nodes exhibiting all abnormal behavior is used as the anomaly coverage breadth.

[0030] According to the present invention, an abnormal behavior detection method based on multi-source security information data fusion is provided, wherein the process of determining the value of the information hub includes:

[0031] All nodes exhibiting abnormal behavior are paired up to obtain multiple pairs of nodes exhibiting abnormal behavior.

[0032] Determine the shortest path between the two nodes exhibiting abnormal behavior in each abnormal behavior node pair, and count the number of paths that pass through the preserved features to be fused in all shortest paths.

[0033] The ratio of the number of paths to the number of all shortest paths is used as the value of the information hub.

[0034] According to the present invention, an abnormal behavior detection method based on multi-source security information data fusion is provided, wherein the process of determining the importance of the business includes:

[0035] The scores of the retained features to be fused are used as the importance of the business.

[0036] An abnormal behavior detection method based on multi-source security information data fusion provided by the present invention further includes:

[0037] The final abnormal behavior type and the abnormality level assessment result under the severity of constraint violation are determined by looking up a table.

[0038] Warning information is generated based on the anomaly level assessment results and the warning confidence threshold, and the warning is issued through the vehicle-road-cloud collaborative network.

[0039] On the other hand, the present invention also provides an abnormal behavior detection system based on multi-source security information data fusion, which includes:

[0040] The module is used to analyze objects involved in data interaction in the vehicle-road-cloud collaborative system and construct a business knowledge graph that includes physical layer association information, data flow association information, and security event association information.

[0041] The data-level fusion module is used to perform deduplication, normalization, and annotation preprocessing on the acquired vehicle sensor data, road infrastructure data, and cloud data to obtain fused data.

[0042] The feature-level fusion module is used to extract features from the fused data to obtain multiple features to be fused; based on the business knowledge graph, semantic understanding is performed on the multiple features to be fused, and feature-level fusion is performed to obtain multi-source fused features;

[0043] The detection module is used to input the multi-source fusion features into multiple preset behavior detection models to detect abnormal behavior, and output the abnormal behavior detected by each behavior detection model.

[0044] The decision-level fusion module is used to perform decision fusion on the abnormal behaviors detected by each behavior detection model to obtain the final abnormal behavior.

[0045] On the other hand, the present invention also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the abnormal behavior detection method based on multi-source security information data fusion as described above.

[0046] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the abnormal behavior detection method based on multi-source security information data fusion as described above.

[0047] On the other hand, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the abnormal behavior detection method based on multi-source security information data fusion as described above.

[0048] This invention provides an abnormal behavior detection method based on multi-source security information data fusion. It analyzes objects involved in data interaction within a vehicle-road-cloud collaborative system and constructs a business knowledge graph. After preprocessing the acquired vehicle sensor data, road infrastructure data, and cloud data through deduplication, normalization, and annotation, fused data is obtained. Feature extraction is then performed to obtain multiple features to be fused. Based on the business knowledge graph, semantic understanding is applied to these features, and feature-level fusion is performed to obtain multi-source fused features. These features are then input into multiple preset behavior detection models for abnormal behavior detection. The method outputs the abnormal behaviors detected by each model and performs decision fusion on the abnormal behaviors detected by each model to obtain the final abnormal behavior throughout the data lifecycle. This method allows for the fusion of multi-source data and decision fusion of abnormal behaviors detected by different behavior detection models to obtain the final abnormal behavior, improving the accuracy of abnormal behavior detection results and thus enhancing the security of data flow in the vehicle-road-cloud collaborative system. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0050] Figure 1 is a flowchart illustrating the abnormal behavior detection method based on multi-source security information data fusion provided in an embodiment of the present invention;

[0051] Figure 2 is a schematic diagram of the process of fusing multiple features to be fused;

[0052] Figure 3 is a schematic diagram of the abnormal behavior detection system based on multi-source security information data fusion provided in an embodiment of the present invention;

[0053] Figure 4 is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0055] Figure 1 is a flowchart illustrating the abnormal behavior detection method based on multi-source security information data fusion provided in an embodiment of the present invention.

[0056] As shown in Figure 1, the execution subject of the abnormal behavior detection method based on multi-source security information data fusion provided in this embodiment of the invention can be an electronic device, and the method mainly includes the following steps:

[0057] 101. Analyze the objects involved in data interaction in the vehicle-road-cloud collaborative system and construct a business knowledge graph that includes physical layer association information, data flow association information, and security event association information;

[0058] In a specific implementation process, business knowledge encompasses various aspects of the vehicle-road-cloud collaborative system, serving as the core of abnormal behavior detection and early warning. This knowledge is crucial for improving the accuracy of abnormal behavior detection, system security, efficiency, and reliability during data interaction within the vehicle-road-cloud collaborative system. It determines the system's effectiveness in practice and impacts the stability and sustainable development of the entire ecosystem. Therefore, in this embodiment, the objects involved in data interaction within the vehicle-road-cloud collaborative system can be analyzed. For example, for the vehicle side, these objects may include various data acquisition equipment, data processing equipment, data transmission devices, and in-vehicle networks. For road testing, these may include all roadside computing units involved in data processing, intelligent transportation equipment, and communication links. For cloud testing, these may include cloud platform access points such as traffic management systems, high-precision maps, and intrusion detection systems, as well as CA certificate centers.

[0059] The aforementioned objects can be abstracted into nodes representing vehicles, roads, and the cloud. Edges can then be formed by analyzing the relationships between these nodes, thereby constructing a business knowledge graph that includes physical layer correlations, data flow correlations, and security event correlations. This allows for the rapid integration of business knowledge within the vehicle-road-cloud collaborative system. By building a rich knowledge network, the system's ability to understand and respond to complex and dynamic scenarios can be enhanced.

[0060] For example, physical layer association information can include the connections between various in-vehicle electronic control units (ECUs). Data flow association information can include the transmission of perception data collected by LiDAR to the intelligent driving domain via the in-vehicle network. Security event association information can include OTA upgrade vulnerabilities in the infotainment system leading to loss of ECU control, network attacks, software vulnerabilities, hardware failures, and insufficient or ineffective data access permission management.

[0061] Among them, network attacks can include: (1) Man-in-the-middle attacks refer to attackers hijacking the communication link between the vehicle and the cloud (such as 4G / 5G / Wi-Fi), disguising themselves as legitimate terminals to intercept or tamper with data, resulting in the theft of real-time data such as vehicle location, user identity, and battery status. For example, using fake base stations to intercept vehicle diagnostic reports transmitted by the operator network. (2) Protocol layer attacks: After attacking vulnerabilities in communication protocols (such as TLS / DTLS, MQTT, HTTP / 2), cloud API keys, vehicle control commands, and user privacy data will be leaked. For example, forcing vehicles to use low-version protocols (such as TLS 1.0), decrypting data using known vulnerabilities; forging control commands (such as unlocking car doors) or replaying historical data packets to bypass authentication. (3) API interface abuse refers to attackers using defects in cloud APIs to illegally access data interfaces, resulting in the batch downloading of sensitive information such as vehicle driving trajectory, charging records, and user profiles. (4) Denial-of-service attacks (DoS) to cover up data theft refers to launching large-scale DoS attacks to paralyze the security monitoring system, while simultaneously carrying out covert data leakage. For example, attackers take advantage of system chaos to steal high-value data.

[0062] Software vulnerabilities may include: (1) Backdoor penetration of supply chain vulnerabilities: third-party components (such as open-source MQTT libraries) have unpatched vulnerabilities, and attackers inject malicious code into OTA update packages. The vehicle-side backdoor continuously uploads ECU control commands to illegal cloud nodes, stealing autonomous driving algorithm parameters or user biometric data. (2) Vehicle-side software vulnerabilities: attackers use vehicle system vulnerabilities (such as buffer overflows) to implant malicious programs, intercept sensitive data to be uploaded to the cloud (such as GPS trajectory, in-vehicle recording), and send it back to the attacker's server through a covert channel. Third-party navigation applications of in-vehicle infotainment systems (IVI) have SQL injection vulnerabilities, resulting in the theft of users' trip history records.

[0063] Hardware failures may include: (1) Encryption chip failure: damage due to physical aging (such as electromagnetic interference, overheating), interrupting encryption operation, and the vehicle end is forced to upload sensitive data (such as battery temperature, user identity) in plaintext, which does not comply with regulations and is easily intercepted by attackers during communication. (2) Sensor failure leading to abnormal data collection: causing the artificial intelligence model to mistakenly believe that there is no sensitive information in the data, and upload sensitive information that should be filtered to the cloud.

[0064] Insufficient or ineffective data access permission management may include: failure to follow the principle of least privilege, allowing third-party applications on the vehicle to easily pass the car manufacturer's review and arbitrarily obtain data collected on the vehicle, resulting in abnormal data leakage to third-party cloud platforms.

[0065] It should be noted that the above-mentioned security event association information is only an illustrative example and can be configured according to actual needs. The security event association information reflects abnormal behavior of the vehicle-road-cloud collaborative system during data interaction.

[0066] 102. After deduplication, normalization, and labeling preprocessing of the acquired vehicle sensor data, road infrastructure data, and cloud data, fused data is obtained.

[0067] In a specific implementation, vehicle motion data, including vehicle speed, acceleration, angular velocity, steering wheel angle, and brake pedal pressure, can be collected in real time using onboard sensors (such as accelerometers, gyroscopes, vehicle speed sensors, steering wheel angle sensors, and brake pedal sensors). This data is output in different frequencies and formats (such as CAN bus data and analog signal data), and needs to be uniformly collected and converted by the onboard data acquisition module before being transmitted to the data processing center as digital signals.

[0068] Information collected from various infrastructure sensors on the road (such as traffic light status sensors, road cameras, road surface condition sensors, speed limit sign sensors, etc.) includes traffic light phase and timing, real-time road images, road surface moisture, icing conditions, and the current speed limit for the road segment. This data is transmitted to a data processing center via wireless communication technologies (such as 4G, 5G, and Wi-Fi) and integrated with vehicle sensor data and cloud data.

[0069] In a specific implementation process, the cloud can acquire vehicle sensor data and road infrastructure data. In addition to vehicle sensor data and road infrastructure data, cloud data also includes third-party data and traffic system-level data. These can be roughly divided into the following three categories, which can be further investigated and supplemented.

[0070] 1. Basic static third-party data: high-precision map data transmitted by map service providers, vehicle profile data provided by third-party sellers, intersection data provided by third parties, and signal timing scheme data.

[0071] 2. Dynamic operational data: Real-time traffic volume, traffic density, convoy speed, vehicle trajectory, and other data.

[0072] 3. Data maintained by the cloud platform's own system, including device status logs, security audit data, and OTA upgrade data.

[0073] After obtaining vehicle sensor data, road infrastructure data, and cloud data, the data is preprocessed by deduplication, normalization, and labeling to obtain fused data.

[0074] 103. Extract features from the fused data to obtain multiple features to be fused;

[0075] In a specific implementation process, after obtaining the fused data, feature extraction can be performed on the fused data to obtain multiple features to be fused.

[0076] 104. Based on the business knowledge graph, perform semantic understanding on the multiple features to be fused, and perform feature-level fusion to obtain multi-source fused features;

[0077] In a specific implementation process, business knowledge graphs, as a structured knowledge representation method, can effectively integrate and organize entity and relationship information from multi-source data. Therefore, based on the business knowledge graph, semantic understanding can be performed on the multiple features to be fused, and feature-level fusion can be carried out to obtain multi-source fused features.

[0078] Specifically, this step can be implemented according to the method shown in Figure 2, where Figure 2 is a flowchart illustrating the fusion of multiple features to be fused. As shown in Figure 2, the method may include the following steps:

[0079] 201. Based on the business knowledge graph, determine the correlation between each feature to be fused and each abnormal behavior, and remove the features to be fused with a correlation less than the preset correlation, and retain the features to be fused with a correlation greater than or equal to the preset correlation.

[0080] In a specific implementation process, this step can be implemented in the following way:

[0081] (11) Based on the business knowledge graph, determine the length of the shortest path from any node of any feature to be fused to any node of any abnormal behavior and the total edge weight of the shortest path;

[0082] In a specific implementation, the edge between any node of a feature to be fused and any node exhibiting abnormal behavior reflects the direct correlation between the two nodes. Therefore, based on the business knowledge graph, the length of the shortest path between any node of a feature to be fused and any node exhibiting abnormal behavior can be obtained. Each edge in the business knowledge graph has a corresponding business attribute (such as relationship confidence), which can be used as the weight of each edge. Thus, the weights of all edges in the shortest path can be summed to obtain the total edge weight of the shortest path.

[0083] (12) The ratio of the total edge weight to the length is used as the structural correlation between any feature to be fused and any abnormal behavior;

[0084] In a specific implementation, the ratio of the total edge weight to the length can be used as the structural correlation degree between any feature to be fused and any anomalous behavior. Specifically, the larger the total edge weight and the smaller the length, the greater the structural correlation degree.

[0085] (13) Convert any of the features to be fused into feature text, and convert any of the abnormal behaviors into behavior text;

[0086] In a specific implementation process, semantic recognition can be performed on any feature to be fused and any abnormal behavior, converting any feature to be fused into feature text, and converting any abnormal behavior into behavior text.

[0087] (14) Determine the semantic similarity between the feature text and the behavior text as the semantic correlation between any feature to be fused and any abnormal behavior;

[0088] In a specific implementation, similarity algorithms such as cosine similarity can be used to obtain the semantic similarity between the feature text and the behavior text, and the obtained semantic similarity can be used as the semantic correlation between any feature to be fused and any abnormal behavior.

[0089] (15) The structural correlation degree and the semantic correlation degree are weighted and summed to obtain the correlation degree between any feature to be fused and any abnormal behavior;

[0090] In a specific implementation, structural relevance and semantic relevance can be assigned corresponding weights according to actual needs, and the structural relevance and semantic relevance can be weighted and summed to obtain the relevance between any feature to be fused and any abnormal behavior. In this way, using the two dimensions of structural relevance and semantic similarity to calculate the relevance can avoid the bias of a single dimension.

[0091] (16) Traverse all features to be fused and the abnormal behaviors to obtain the correlation degree between each feature to be fused and each abnormal behavior.

[0092] In a specific implementation process, after traversing all features to be fused and the abnormal behaviors, the correlation degree between each feature to be fused and each abnormal behavior can be obtained. Then, the correlation degree between each feature to be fused and each abnormal behavior can be compared with a preset correlation degree in order to remove features with a correlation degree less than the preset correlation degree and retain features to be fused with a correlation degree greater than or equal to the preset correlation degree.

[0093] 202. Based on the business knowledge graph, determine the importance of the retained features to be fused for abnormal behavior detection, assign weights to the retained features to be fused, and obtain weighted features;

[0094] In a specific implementation process, in order to highlight the importance of each retained feature to be fused, so that subsequent fusion can focus more on information that plays a key role in abnormal behavior detection and suppress the interference of irrelevant or secondary features, the importance of the retained features to be fused to abnormal behavior detection can be determined based on the business knowledge graph, and weights can be assigned to the retained features to be fused to obtain weighted features.

[0095] Specifically, this step can be achieved in the following way:

[0096] (11) Determine the anomalous coverage breadth, information hub value, and business importance of the retained features to be merged;

[0097] In a specific implementation process, the "position" of a feature node in the business knowledge graph determines its inherent importance in anomaly detection, and its specific importance can be measured by the breadth of anomaly coverage and its value as an information hub.

[0098] Specifically, the number of nodes directly connecting to the anomalous behaviors of the retained features to be fused can be determined; the ratio of this number of nodes to the total number of nodes representing all anomalous behaviors is used as the anomalous coverage breadth. In other words, the more nodes directly connecting to the anomalous behaviors of the retained features to be fused, the more anomalous behaviors correspond to that retained feature, and the greater its anomalous coverage breadth.

[0099] All nodes exhibiting anomalous behavior can be paired to obtain multiple pairs of anomalous behavior nodes. The shortest path between the two anomalous behavior nodes in each pair is determined, and the number of paths passing through the retained fusion feature is counted. The ratio of this number to the total number of shortest paths is used as the information hub value. In other words, when the shortest path of any anomalous behavior node pair passes through a node with the retained fusion feature, that node is a "critical bridge" between the two anomalous behaviors. A larger number of paths passing through the retained fusion feature indicates that the transmission and evolution of many anomalous behaviors require it, making it a deep correlation indicator for anomaly detection. The ratio of the number of paths passing through the retained fusion feature to the total number of shortest paths is used as the information hub value.

[0100] When constructing a business knowledge graph, the business importance of the features to be integrated can be recorded through methods such as expert scoring.

[0101] (12) The weighted sum of the anomaly coverage, the information hub value, and the business importance is used to obtain the importance of the retained features to be integrated.

[0102] In a specific implementation process, the weights of anomaly coverage breadth, information hub value, and business importance can be set according to actual needs. Then, the weighted sum of the anomaly coverage breadth, information hub value, and business importance is obtained to determine the importance of the retained features to be integrated. Weights are then assigned to the retained features to be integrated, resulting in weighted features. Specifically, the higher the importance of a retained feature to be integrated, the greater its assigned weight; conversely, the lower the importance of a retained feature to be integrated, the smaller its assigned weight.

[0103] 203. The weighted features are fused to obtain the multi-source fused features.

[0104] In a specific implementation process, the obtained weighted features can be fused to obtain the multi-source fused features. Specifically, if the difference between two weighted features is greater than a preset difference value, both can be retained; if the difference between two weighted features is less than or equal to the preset difference value, one can be retained. Alternatively, the two weighted features can be semantically understood, and secondary information can be selectively retained while retaining core information.

[0105] 105. Input the multi-source fusion features into multiple preset behavior detection models to detect abnormal behavior, and output the abnormal behavior detected by each behavior detection model;

[0106] In a specific implementation process, a behavior detection model can be built based on rule matching methods, or based on machine learning techniques. Then, multiple behavior detection models are used to analyze the multi-source fusion features to detect abnormal behavior and output the abnormal behavior detected by each behavior detection model.

[0107] For example, each behavior detection module infers from the input multi-source fusion features and outputs the detected abnormal behavior. This abnormal behavior can specifically include information such as the type of abnormal behavior, the time of occurrence, and the location of occurrence. For instance, if an intelligent vehicle is being spoofed by GNSS, and the knowledge graph nodes range from the sensing sensors to the cloud trajectory database, the anomaly detection result is that the deviation between the vehicle's reported location and the roadside radar-detected location is greater than 10 meters, which is marked as suspected location hijacking.

[0108] 106. Perform decision fusion on the abnormal behaviors detected by each behavior detection model to obtain the final abnormal behavior.

[0109] In a specific implementation process, since different behavior detection models may have different advantages and limitations, the detection results for the same abnormal behavior may differ. Therefore, it is necessary to perform decision fusion on the abnormal behaviors detected by each model to obtain the final abnormal behavior in order to improve the accuracy and reliability of detection.

[0110] In a specific implementation, if there is no conflict between the i-th abnormal behavior obtained by the i-th behavior detection model and the j-th abnormal behavior obtained by the j-th behavior detection model, and the difference between the two is large, then during decision fusion, both the i-th abnormal behavior and the j-th abnormal behavior can be retained.

[0111] In a specific implementation, if there is no conflict between the i-th abnormal behavior obtained by the i-th behavior detection model and the j-th abnormal behavior obtained by the j-th behavior detection model, and the difference between the two is small, then during decision fusion, either the i-th abnormal behavior or the j-th abnormal behavior can be retained.

[0112] In a specific implementation, if there is a conflict between the i-th abnormal behavior detected by the i-th behavior detection model and the j-th abnormal behavior detected by the j-th behavior detection model—for example, the abnormal behavior that the vehicle itself might detect is that the communication link between the vehicle and the cloud has been hijacked, while the abnormal behavior that the cloud can detect is that the communication link between the vehicle and the cloud has not been hijacked—then it indicates a conflict between the two. In this case, they can be fused in the following way:

[0113] (21) Obtain the historical accuracy of each behavior detection model within a preset time period;

[0114] For example, the ratio of the number of correct detections by each behavior detection model to the total number of detections in the past hour is used as the historical accuracy of each behavior detection model.

[0115] (22) Obtain the scene recall rate of each behavior detection model in the current scene;

[0116] For example, under the current road type (such as curves or straight roads), the ratio of the number of times each behavior detection model correctly detects an abnormal behavior to the number of times the abnormal behavior actually occurs is used as the scene recall rate of each behavior detection model.

[0117] (23) Determine the real-time adaptability of each behavior detection model based on the difference between the response time and the average response time of each behavior detection model;

[0118] Specifically, the real-time fit of each behavior detection model can be obtained according to the following formula:

[0119]

[0120] in, This represents the real-time adaptability of the k-th behavior detection model, reflecting the performance fluctuation of the k-th behavior detection model. This represents the difference between the response time of the k-th behavior detection model and the average response time.

[0121] (24) The scene recall rate of each behavior detection model, the scene recall rate of each behavior detection model, and the scene recall rate of each behavior detection model are weighted and summed to obtain the confidence of the abnormal behavior obtained by each behavior detection model.

[0122] (25) Retain the abnormal behavior with the highest confidence.

[0123] In a specific implementation process, after obtaining the final abnormal behavior, the type of the final abnormal behavior and the abnormality level assessment result under the severity of the constraint violation can be determined by looking up a table; based on the abnormality level assessment result and the warning confidence threshold, a warning message is generated and issued through the vehicle-road-cloud collaborative network.

[0124] Specifically, the correlation between the types of abnormal behavior, the severity of constraint violations, and the anomaly level assessment results can be pre-built. When different behavior detection models detect abnormal behavior, they can determine the type of abnormal behavior and the severity of constraint violations. At this point, the anomaly level assessment result can be obtained by looking up a table. For example, if the severity of a constraint violation by an abnormal behavior is low, but the abnormal behavior type is a traffic violation, its anomaly level assessment result is low; if the abnormal behavior type is a cybersecurity intrusion, its anomaly level assessment result is medium. Examples will not be provided here.

[0125] After obtaining the anomaly level assessment results, early warning information can be generated based on the anomaly level assessment results and the early warning confidence threshold, and the early warning can be issued through the vehicle-road-cloud collaborative network. Emergency warning: Vehicle speed data has been injected with data; Severe warning: Vehicle control has been gained by hackers; General warning: Non-sensitive data of roadside facilities has been leaked.

[0126] This embodiment of the abnormal behavior detection method based on multi-source security information data fusion analyzes the objects involved in data interaction in the vehicle-road-cloud cooperative system and constructs a business knowledge graph. After preprocessing the acquired vehicle sensor data, road infrastructure data, and cloud data through deduplication, normalization, and annotation, fused data is obtained. Feature extraction is then performed to obtain multiple features to be fused. Based on the business knowledge graph, semantic understanding is performed on these multiple features to be fused, and feature-level fusion is conducted to obtain multi-source fused features. These features are then input into multiple preset behavior detection models for abnormal behavior detection. After outputting the abnormal behaviors detected by each behavior detection model, decision fusion is performed on the abnormal behaviors detected by each model to obtain the final abnormal behavior throughout the data lifecycle. This method can fuse multi-source data and perform decision fusion on the abnormal behaviors detected by different behavior detection models to obtain the final abnormal behavior, improving the accuracy of abnormal behavior detection results and thus enhancing the security of data flow in the vehicle-road-cloud cooperative system.

[0127] Based on the same general inventive concept, this invention also protects an abnormal behavior detection system based on multi-source security information data fusion. The abnormal behavior detection system based on multi-source security information data fusion provided by this invention will be described below. The abnormal behavior detection system based on multi-source security information data fusion described below can be referred to in correspondence with the abnormal behavior detection method based on multi-source security information data fusion described above.

[0128] Figure 3 is a schematic diagram of the structure of the abnormal behavior detection system based on multi-source security information data fusion provided in this embodiment of the invention. As shown in Figure 3, the abnormal behavior detection system based on multi-source security information data fusion in this embodiment includes a construction module 31, a data-level fusion module 32, a feature-level fusion module 33, a detection module 34, and a decision-level fusion module 35.

[0129] Among them, the construction module 31 is used to analyze the objects involved in data interaction in the vehicle-road-cloud collaborative system and construct a business knowledge graph that includes physical layer association information, data flow association information and security event association information.

[0130] The data-level fusion module 32 is used to perform deduplication, normalization, and annotation preprocessing on the acquired vehicle sensor data, road infrastructure data, and cloud data to obtain fused data.

[0131] The feature-level fusion module 33 is used to extract features from the fused data to obtain multiple features to be fused; based on the business knowledge graph, semantic understanding is performed on the multiple features to be fused, and feature-level fusion is performed to obtain multi-source fused features;

[0132] The detection module 34 is used to input the multi-source fusion features into multiple preset behavior detection models to detect abnormal behavior, and output the abnormal behavior detected by each behavior detection model.

[0133] The decision-level fusion module 35 is used to perform decision fusion on the abnormal behaviors detected by each behavior detection model to obtain the final abnormal behavior.

[0134] Figure 4 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. This abnormal behavior detection system based on multi-source security information data fusion may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440. The processor 410, communication interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute the abnormal behavior detection method based on multi-source security information data fusion.

[0135] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0136] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the abnormal behavior detection method based on multi-source security information data fusion provided by the above methods.

[0137] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the abnormal behavior detection method based on multi-source security information data fusion provided by the above methods.

[0138] It should be noted that all relevant information that may be involved in the various embodiments of this application is processed in strict accordance with the requirements of laws and regulations, following the principles of legality, legitimacy, and necessity, based on the reasonable purpose of the business scenario, and is information that users actively provide or that is generated as a result of using the product / service, as well as information that is obtained with the user's authorization.

[0139] The information processed in this application may vary depending on the specific product / service scenario and should be based on the specific scenario in which the user uses the product / service. It may involve the user's account information, device information, or other related information. This application will treat the relevant information and its processing with the utmost diligence.

[0140] This application attaches great importance to the security of relevant information and has taken reasonable and feasible security protection measures that comply with industry standards to protect the relevant information and prevent it from being accessed, disclosed, used, modified, damaged or lost without authorization.

[0141] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0142] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0143] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An abnormal behavior detection method based on multi-source security information data fusion, characterized in that, include: The system analyzes the objects involved in data interaction in the vehicle-road-cloud cooperative system and constructs a business knowledge graph that includes physical layer association information, data flow association information, and security event association information. After deduplication, normalization, and annotation preprocessing of the acquired vehicle sensor data, road infrastructure data, and cloud data, fused data is obtained. Feature extraction is performed on the fused data to obtain multiple features to be fused. Based on the business knowledge graph, determine the length of the shortest path from any node of a feature to be fused to any node of an abnormal behavior and the total edge weight of the shortest path; use the ratio of the total edge weight to the length as the structural correlation between the feature to be fused and the abnormal behavior; convert the feature to be fused into feature text, and convert the abnormal behavior into behavior text. The semantic similarity between the feature text and the behavior text is determined as the semantic correlation between any feature to be fused and any abnormal behavior; the structural correlation and the semantic correlation are weighted and summed to obtain the correlation between any feature to be fused and any abnormal behavior. Iterate through all features to be fused and the anomalous behaviors to obtain the correlation degree between each feature to be fused and each anomalous behavior; Remove features to be fused with a correlation degree less than a preset correlation degree, and retain features to be fused with a correlation degree greater than or equal to the preset correlation degree; determine the importance of the retained features to be fused for abnormal behavior detection based on the business knowledge graph, assign weights to the retained features to be fused to obtain weighted features; fuse the weighted features to obtain multi-source fused features; The multi-source fusion features are input into multiple preset behavior detection models to detect abnormal behavior, and the abnormal behavior detected by each behavior detection model is output. The abnormal behaviors detected by each behavior detection model are fused to obtain the final abnormal behavior.

2. The abnormal behavior detection method based on multi-source security information data fusion according to claim 1, characterized in that, Based on the business knowledge graph, the importance of the retained features to be fused for abnormal behavior detection is determined, including: determining the anomaly coverage breadth, information hub value, and business importance of the retained features to be fused; and weighting and summing the anomaly coverage breadth, the information hub value, and the business importance to obtain the importance of the retained features to be fused.

3. The abnormal behavior detection method based on multi-source security information data fusion according to claim 2, characterized in that, The process of determining the breadth of anomaly coverage includes: determining the number of nodes that directly connect to the retained features to be fused; and using the ratio of the number of nodes to the total number of nodes for all anomalies as the breadth of anomaly coverage.

4. The abnormal behavior detection method based on multi-source security information data fusion according to claim 2, characterized in that, The process of determining the value of the information hub includes: dividing all nodes with abnormal behavior into pairs to obtain multiple pairs of nodes with abnormal behavior; determining the shortest path between the two nodes with abnormal behavior in each pair of nodes with abnormal behavior, and counting the number of paths that pass through the retained features to be fused in all shortest paths; and taking the ratio of the number of paths to the number of all shortest paths as the value of the information hub.

5. The abnormal behavior detection method based on multi-source security information data fusion according to claim 2, characterized in that, The process of determining the importance of the business includes: obtaining the score of the retained features to be fused as the importance of the business.

6. The abnormal behavior detection method based on multi-source security information data fusion according to any one of claims 1-5, characterized in that, Also includes: The final abnormal behavior type and the abnormality level assessment result under the severity of constraint violation are determined by looking up a table. Warning information is generated based on the anomaly level assessment results and the warning confidence threshold, and the warning is issued through the vehicle-road-cloud collaborative network.

7. An abnormal behavior detection system based on multi-source security information data fusion, characterized in that, include: The construction module is used to analyze the objects involved in data interaction in the vehicle-road-cloud cooperative system and build a business knowledge graph that includes physical layer association information, data flow association information, and security event association information; the data-level fusion module is used to perform deduplication, normalization, and annotation preprocessing on the acquired vehicle sensor data, road infrastructure data, and cloud data to obtain fused data. The feature-level fusion module is used to determine the length of the shortest path from any node of a feature to be fused to any node of an abnormal behavior and the total edge weight of the shortest path based on the business knowledge graph; to use the ratio of the total edge weight to the length as the structural correlation between the feature to be fused and the abnormal behavior; to convert the feature to be fused into feature text, and to convert the abnormal behavior into behavior text. The semantic similarity between the feature text and the behavior text is determined as the semantic correlation between any feature to be fused and any abnormal behavior; the structural correlation and the semantic correlation are weighted and summed to obtain the correlation between any feature to be fused and any abnormal behavior. Iterate through all features to be fused and the anomalous behaviors to obtain the correlation degree between each feature to be fused and each anomalous behavior; Remove features to be fused with a correlation degree less than a preset correlation degree, and retain features to be fused with a correlation degree greater than or equal to the preset correlation degree; determine the importance of the retained features to be fused for abnormal behavior detection based on the business knowledge graph, assign weights to the retained features to be fused to obtain weighted features; fuse the weighted features to obtain multi-source fused features; The detection module is used to input the multi-source fusion features into multiple preset behavior detection models to detect abnormal behavior, and output the abnormal behavior detected by each behavior detection model. The decision-level fusion module is used to perform decision fusion on the abnormal behaviors detected by each behavior detection model to obtain the final abnormal behavior.

8. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the abnormal behavior detection method based on multi-source security information data fusion as described in any one of claims 1-6.

Images