Vehicle-mounted Ethernet anomaly detection method and system based on multi-scale time window

Abstract

The invention provides a vehicle-mounted Ethernet anomaly detection method and system based on a multi-scale time window, and relates to the technical field of vehicle-mounted Ethernet, and the method comprises the steps: introducing a multi-scale time window mechanism into the vehicle-mounted Ethernet, and combining bypass mirror image collection, fine-grained original feature extraction, PCA dimension reduction and a self-encoder model which is trained only based on normal traffic, thereby achieving the anomaly detection of the vehicle-mounted Ethernet. Therefore, high-sensitivity and low-false-alarm detection of communication abnormity is realized. According to the method, behavior laws of traffic under different time granularities in a time-sensitive network environment are fully utilized, short-term burst and long-term slow abnormal modes are modeled through a plurality of sliding windows respectively, a dynamic judgment threshold is independently set for each time window, and the recognition capability for unknown attacks is remarkably improved; meanwhile, the whole process is controllable in calculation overhead, is suitable for a vehicle-mounted embedded platform with limited resources, and effectively gives consideration to real-time performance, accuracy and deployment feasibility.

Description

Technical Field

[0001] This invention relates to the field of automotive Ethernet technology, and in particular to an automotive Ethernet anomaly detection method and system based on multi-scale time windows. Background Technology

[0002] With the rapid development of intelligent connected vehicles, automotive Ethernet has been widely used, especially in high-bandwidth, multi-domain collaborative, and time-sensitive network environments. This significantly increases the complexity of in-vehicle communication and exacerbates security risks. Existing automotive anomaly detection technologies largely rely on signature-based detection methods, which struggle to cope with unknown or novel attacks. Furthermore, traditional solutions generally suffer from high false alarm rates and high computational overhead, failing to achieve real-time, efficient anomaly detection in resource-constrained automotive environments. In addition, most studies neglect the unique temporal behavior characteristics and multi-scale attack patterns of automotive Ethernet, such as bursty DoS attacks and slow, covert scanning, lacking effective modeling of traffic dynamics at different time granularities. Summary of the Invention

[0003] This invention aims to solve the technical problems existing in the above-mentioned related technologies, and proposes a vehicle Ethernet anomaly detection method and system based on multi-scale time windows. It can achieve high-precision, low-false-report, and low-overhead real-time anomaly detection for unknown attacks through multi-scale time window aggregation and autoencoder reconstruction error analysis.

[0004] The solution to the technical problem of this invention is as follows: This invention provides a method for detecting anomalies in vehicular Ethernet based on multi-scale time windows, wherein the vehicular Ethernet supports time-sensitive networking, and includes the following steps: Data frames of the in-vehicle Ethernet are collected in a bypass mirroring manner at the gateway or switch of the intelligent connected vehicle. For each data frame, extract the protocol type, transmission control flags, source IP address, source port, destination port, payload length, and the deviation information of the payload from the preset normal format to form the original feature set; Multiple sliding windows with different time scales are set up, and data frames falling into each sliding window are statistically aggregated according to the original feature set to generate a fixed-dimensional original window feature vector corresponding to each time window. Principal component analysis (PCA) is performed on the original window feature vector to reduce its dimensionality, and the reduced feature vector is then input into an autoencoder model trained using only normal flow to obtain a reconstructed feature vector. Calculate the reconstruction error between the original window feature vector and the reconstructed feature vector, and set an independent judgment threshold for each time window based on the reconstruction error distribution of the normal traffic verification set. If the reconstruction error of any time window exceeds its corresponding judgment threshold, it is determined that there is an anomaly in the current communication and an alarm is triggered.

[0005] Furthermore, the bypass mirror acquisition covers the critical Ethernet links between the ADAS domain and the chassis domain, and between the infotainment domain and the body domain. The original service data frames are not affected by the mirroring operation and continue to be forwarded normally, ensuring functional safety and real-time performance.

[0006] Furthermore, the statistical aggregation is performed on a session-by-session basis. Each session is uniquely identified by a 5-tuple, which includes the source IP, destination IP, source port, destination port, and protocol type, thereby generating a session-level window feature vector for detecting sudden increases in connection frequency, abnormal port scanning, or abnormal session duration.

[0007] Furthermore, the size of the sliding window includes, but is not limited to, 100ms, 200ms, and 300ms, which are used to capture sudden attack behaviors and slow, covert attack patterns, respectively. The sliding window employs an adaptive sliding step size strategy: when the reconstruction error of a certain time window is continuous... Secondary satisfaction At that time, the sliding step size of the window is automatically shortened to increase the detection frequency; among which, This represents the current reconstruction error. This is the threshold value corresponding to the time window. For the preset proportional coefficient and , are positive integers and ; When the average communication load of the vehicle Ethernet within a preset time window is lower than a set load threshold, the sliding step size is extended to reduce computational overhead.

[0008] Furthermore, the autoencoder model is trained unsupervised using only a normal traffic training set without attack labels during the offline training phase. After training, the model is compressed through weight quantization and layer pruning, and then deployed as a fixed-point computation version.

[0009] Furthermore, the step of setting an independent judgment threshold for each time window based on the reconstruction error distribution of the normal traffic validation set specifically includes: for each time window, calculating the mean of the reconstruction error on the validation set containing only normal traffic. with standard deviation And set the threshold as ,in The The value is dynamically adjusted according to the vehicle's operating conditions: It is set when driving at high speed or in ADAS activated state. Take off while parked or cruising at low speed To balance detection sensitivity and false alarm rate.

[0010] Furthermore, a cross-window consistency verification mechanism is introduced when judging anomalies: if the reconstruction errors of two or more sliding windows with different time scales exceed their respective judgment thresholds within the same time interval, it is judged as a high-confidence anomaly and a high-level response is triggered; if the reconstruction error of only a single short time window exceeds its judgment threshold, while the reconstruction errors of other time windows are all below their respective thresholds, it is regarded as a network instantaneous jitter or normal fluctuation, and no alarm is triggered or only a low-priority log is recorded.

[0011] Furthermore, when an anomaly is detected in the vehicle Ethernet, a structured alarm message containing a session identifier, timestamp, trigger window type, and reconstruction error value is generated and reported to the cloud platform via a T-Box. At the same time, local security policies are linked to perform fine-grained packet capture, communication rate limiting, or service degradation operations.

[0012] Furthermore, when an anomaly is detected in the vehicle Ethernet, the alarm status of the CAN bus anomaly detection module within the same time period is queried simultaneously; if both are abnormal, it is determined to be a cross-domain collaborative attack and a vehicle-level security response is triggered, including ECU communication isolation or entering a safe operating mode.

[0013] On the other hand, this application provides an in-vehicle Ethernet anomaly detection system based on multi-scale time windows, used to execute the aforementioned in-vehicle Ethernet anomaly detection method based on multi-scale time windows, including the following modules: The data collection module is used to collect data frames of the vehicle Ethernet in a bypass mirroring manner at the gateway or switch of the intelligent connected vehicle. The feature extraction module is used to extract the protocol type, transmission control flag, source IP address, source port, destination port, payload length, and deviation information of the payload from the preset normal format for each data frame, forming the original feature set; The statistical aggregation module is used to set multiple sliding windows with different time scales, and to perform statistical aggregation on the data frames falling into each sliding window according to the original feature set, so as to generate a fixed-dimensional original window feature vector corresponding to each time window. The feature reconstruction module is used to perform principal component analysis (PCA) dimensionality reduction on the original window feature vector, and input the dimensionality-reduced feature vector into an autoencoder model trained using only normal flow to obtain the reconstructed feature vector. The anomaly detection module is used to calculate the reconstruction error between the original window feature vector and the reconstructed feature vector, and to set an independent judgment threshold for each time window based on the reconstruction error distribution of the normal traffic verification set; if the reconstruction error of any time window exceeds its corresponding judgment threshold, it is determined that there is an anomaly in the current communication and an alarm is triggered.

[0014] The beneficial effects of this invention are as follows: This application provides a method and system for detecting anomalies in automotive Ethernet based on multi-scale time windows. By introducing a multi-scale time window mechanism into automotive Ethernet, combined with bypass mirror acquisition, fine-grained original feature extraction, PCA dimensionality reduction, and an autoencoder model trained solely on normal traffic, it achieves high sensitivity and low false alarm detection of communication anomalies. This method fully utilizes the behavioral patterns of traffic at different time granularities in time-sensitive network environments, models short-term bursts and long-term slow anomaly patterns through multiple sliding windows, and independently sets dynamic judgment thresholds for each time window, significantly improving the ability to identify unknown attacks. Simultaneously, the computational overhead of the entire process is controllable, making it suitable for resource-constrained automotive embedded platforms, effectively balancing real-time performance, accuracy, and deployment feasibility. This application also provides a corresponding system, the beneficial effects of which are the same as those of the above method, and will not be elaborated upon here.

[0015] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0016] The accompanying drawings are provided to further understand the technical solutions of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the technical solutions of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

[0017] Figure 1 This is a flowchart of the in-vehicle Ethernet anomaly detection method based on multi-scale time windows provided in this application; Figure 2 This is a structural diagram of the in-vehicle Ethernet anomaly detection system based on multi-scale time windows provided in this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0019] The present application will be further described below with reference to the accompanying drawings and specific embodiments. The described embodiments should not be considered as limitations on the present application, and all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present application.

[0020] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0022] With the rapid development of Intelligent Connected Vehicles (ICVs), the in-vehicle network architecture is evolving from traditional low-speed buses (such as CAN and LIN) to high-bandwidth, low-latency automotive Ethernet that supports time-sensitive communication. Especially with the deep integration of Advanced Driver Assistance Systems (ADAS), infotainment, body control, and chassis domains, the amount of data exchange within vehicles is growing exponentially, placing higher demands on network bandwidth, real-time performance, and determinism. Time-Sensitive Networking (TSN), as a key supporting technology for automotive Ethernet, has been gradually deployed in high-end models.

[0023] However, enhanced network connectivity has also significantly expanded the attack surface. Attackers can launch network or transport layer attacks such as denial-of-service (DoS), port scanning, replay attacks, and abnormal load injection through entry points such as T-Boxes, OBD interfaces, and wireless communication modules, thereby affecting the functions of critical ECUs (Electronic Control Units) and threatening driving safety. Therefore, deploying an efficient, lightweight, and real-time Intrusion Detection System (IDS) on the vehicle Ethernet has become a core requirement for ensuring the security of ICV networks.

[0024] Against this backdrop, there is an urgent need for an anomaly detection method suitable for resource-constrained in-vehicle environments, capable of effectively identifying unknown attacks, and balancing high detection rates with low false positive rates. Traditional rule-based or signature-based detection mechanisms are struggling to cope with increasingly complex zero-day attacks and variant attacks, while purely supervised learning methods are not feasible due to a lack of a large number of labeled attack samples. Therefore, semi-supervised or unsupervised anomaly detection paradigms have become a research hotspot. However, how to achieve efficient modeling in the high-throughput, low-latency, and multi-domain collaborative scenarios unique to in-vehicle Ethernet remains a technical challenge.

[0025] Current technologies in the field of intrusion detection for vehicular networks mainly fall into the following categories: First, signature- or rule-based detection methods rely on predefined attack signature databases to match and identify known attacks; second, anomaly detection methods based on statistical models establish statistical baselines for normal communication behavior (such as message cycle, ID frequency, load distribution, etc.) and judge anomalies based on the degree of deviation; third, supervised or semi-supervised methods based on machine learning, such as using support vector machines, random forests, or deep neural networks to classify traffic, while some studies introduce unsupervised models such as autoencoders to achieve anomaly detection through reconstruction errors; and fourth, layered or hybrid detection architectures deploy detection modules at different network layers such as CAN bus and Ethernet, and attempt to achieve information fusion and coordinated response through gateways. These methods have certain effectiveness in specific scenarios, but most are not specifically optimized for vehicular Ethernet, especially for Time-Sensitive Networking (TSN) environments.

[0026] Existing technologies have significant shortcomings when facing the high-bandwidth, multi-domain collaboration, and resource-constrained automotive Ethernet scenarios of intelligent connected vehicles: First, signature-based methods cannot cope with unknown or variant attacks and have weak generalization capabilities; second, statistical models are easily affected by changes in vehicle operating conditions, resulting in a high false alarm rate and a lack of modeling capabilities for traffic timing characteristics and multi-scale attack patterns; third, many machine learning methods have high computational overhead and high latency, making them difficult to deploy on automotive embedded platforms with limited computing power; furthermore, most solutions use a single time window and fixed thresholds, failing to meet the detection requirements of both sudden and slow-moving covert attacks, and lacking dynamic adaptability to different operating states (such as high-speed driving and parking); finally, existing systems generally operate in isolation, failing to effectively achieve cross-domain collaboration with traditional bus IDS such as CAN, making it difficult to identify complex cross-protocol stack collaborative attacks, and overall failing to meet the comprehensive security requirements of automotive Ethernet for real-time performance, accuracy, low overhead, and high robustness.

[0027] To address the shortcomings of existing vehicle intrusion detection technologies, such as weak generalization ability, high false alarm rate, large computational overhead, insufficient temporal modeling, and lack of cross-domain collaboration, this application proposes a multi-scale time window-based method for vehicle Ethernet anomaly detection. Its main technical features are: non-intrusive acquisition of Ethernet data frames using a bypass mirroring method to extract semantically rich original features including protocol type, transmission control flags, port information, and payload deviation; and the introduction of multiple sliding windows with different time scales (e.g., 100ms, 200ms, 300ms) to statistically aggregate traffic and generate fixed-dimensional window-level feature vectors to simultaneously capture sudden attacks. It targets slow and stealthy behaviors; combines principal component analysis (PCA) for feature dimensionality reduction and inputs a lightweight autoencoder model trained using only normal traffic to measure the degree of anomaly through error reconstruction; independently sets dynamic judgment thresholds based on the error distribution of the normal validation set for each time window, and introduces a cross-window consistency verification mechanism to suppress false alarms caused by instantaneous jitter; the entire process requires no attack tags, has low computational overhead, can be deployed on resource-constrained platforms such as T-Box or domain controllers, and supports cross-domain collaborative defense in conjunction with CAN bus IDS, thereby achieving high-precision, low-false-alarm vehicle Ethernet intrusion detection while ensuring real-time performance.

[0028] First, the following will describe in detail the vehicle Ethernet anomaly detection method based on multi-scale time windows provided in the embodiments of this application with reference to the accompanying drawings. The vehicle Ethernet supports Time Sensitive Networking (TSN) and can provide deterministic low latency, high reliability and accurate time synchronization communication capabilities to meet the needs of multi-domain collaborative control and real-time data transmission in intelligent connected vehicles.

[0029] Reference Figure 1 The implementation process of the vehicle Ethernet anomaly detection method based on multi-scale time windows provided in this application embodiment includes, but is not limited to, the following steps.

[0030] Step S110: Collect in-vehicle Ethernet data frames in bypass mirroring mode at the gateway or switch of the intelligent connected vehicle.

[0031] In step S110, non-intrusive monitoring of in-vehicle Ethernet communication traffic is achieved. By configuring a mirror port on the gateway or switch, a copy of the normally forwarded data frame is sent to the intrusion detection system for analysis, while the original service traffic continues to be transmitted along its original path without any interference. This method ensures both vehicle functional safety and real-time communication, and provides a source of original data for subsequent anomaly detection, serving as a fundamental prerequisite for building an online, real-time, non-blocking in-vehicle intrusion detection system.

[0032] Step S120: For each data frame, extract the protocol type, transmission control flag, source IP address, source port, destination port, payload length, and deviation information between the payload and the preset normal format to form the original feature set.

[0033] In step S120, key fields reflecting network connection status and potential attack behaviors are extracted from the original Ethernet data frames to form a structured set of original features. The selected features cover the protocol layer (such as TCP / UDP / ICMP), transmission control behavior (such as SYN / ACK / FIN / RST flags), communication endpoints (source / destination IP and port), and data content (payload length and its deviation from the expected format). This information is directly related to the observable representations of typical network attacks (such as port scanning, SYN Flood, and abnormal load injection), providing a semantically clear and discriminative input basis for subsequent modeling.

[0034] Step S130: Set multiple sliding windows with different time scales, statistically aggregate the data frames falling into each sliding window according to the original feature set, and generate a fixed-dimensional original window feature vector corresponding to each time window.

[0035] In step S130, a multi-scale sliding time window mechanism is introduced to organize discrete data frames into context-aware window samples according to time granularity. Within each window, the original features are statistically aggregated (e.g., counts, mean, variance, etc.) to form a window-level feature vector with fixed dimensions. The design of different time scales (e.g., 100ms, 200ms, 300ms) enables the system to simultaneously capture short-term burst anomalies (e.g., flooding attacks) and long-term slowly changing behavioral patterns (e.g., low-rate detection), thereby enhancing the coverage of diverse attack temporal characteristics and providing structurally unified information units rich in temporal context for subsequent model inputs.

[0036] Step S140: Perform principal component analysis (PCA) dimensionality reduction on the original window feature vector, and input the dimensionality-reduced feature vector into the autoencoder model trained using only normal flow to obtain the reconstructed feature vector.

[0037] In step S140, Principal Component Analysis (PCA) is first used to reduce the dimensionality of the high-dimensional window feature vector, removing redundancy and noise while retaining the main variation directions, thus reducing the computational complexity of subsequent models. Then, the dimensionality-reduced features are input into an autoencoder model trained only on normal traffic. This autoencoder learns the inherent structure and distribution patterns of normal communication, compresses and reconstructs the input features, and outputs a reconstructed feature vector with the same dimension as its input. The core of this process is that the model is only familiar with "normal" patterns, therefore its ability to reconstruct abnormal inputs is poor, providing a basis for subsequent anomaly scoring.

[0038] Step S150: Calculate the reconstruction error between the original window feature vector and the reconstructed feature vector, and set an independent judgment threshold for each time window based on the reconstruction error distribution of the normal traffic validation set.

[0039] In step S150, the degree to which the current window traffic deviates from the normal pattern is quantified by calculating the difference (i.e., reconstruction error) between the original window feature vector and its reconstructed vector by the autoencoder. Since the traffic characteristics and error distribution differ across time scales, this step emphasizes separately calculating the mean and standard deviation of the reconstruction error for each time window on a validation set containing only normal traffic, and setting an independent judgment threshold accordingly. This windowed threshold calibration strategy ensures the adaptability and robustness of the anomaly criteria, avoiding sensitivity imbalances or increased false alarms caused by a uniform threshold.

[0040] Step S160: If the reconstruction error of any time window exceeds its corresponding judgment threshold, it is determined that there is an anomaly in the current communication and an alarm is triggered.

[0041] In step S160, when the reconstruction error calculated for any time scale window exceeds its specifically set threshold, the system determines that there is abnormal behavior in the current vehicle Ethernet communication. This determination is based on the semi-supervised assumption that "normal traffic can be well reconstructed, while abnormal traffic cannot," and can identify potential threats without attack tags. Once the alarm conditions are met, the system will generate an alarm event, providing a trigger signal for subsequent security responses (such as logging, cloud reporting, or local handling), thus achieving a closed loop from anomaly identification to security alarm.

[0042] In some embodiments of this application, in step S110, the bypass mirror acquisition covers the critical Ethernet links between the ADAS domain and the chassis domain, and between the infotainment domain and the body domain. The original service data frames are not affected by the mirroring operation and continue to be forwarded normally, ensuring functional safety and real-time performance.

[0043] First, communication between the ADAS (Advanced Driver Assistance Systems) domain and the chassis domain directly relates to the vehicle's perception, decision-making, and execution functions, such as critical safety functions like automatic emergency braking and lane keeping. This data interaction demands extremely high real-time performance, reliability, and integrity. Meanwhile, communication between the infotainment domain and the body domain involves a large amount of high-frequency and diverse service traffic related to door control, lighting, air conditioning, and user interaction, which is also a potential entry point for attackers. Deploying mirror acquisition points on the backbone Ethernet links between these core domains can comprehensively capture high-risk traffic in cross-domain communication, ensuring that the intrusion detection system has observability over the vehicle's critical business paths.

[0044] Secondly, this design emphasizes that "original business data frames continue to be forwarded normally without being affected by mirroring operations," reflecting a strict respect for the functional safety and time-sensitive networking (TSN) characteristics of the in-vehicle system. Bypass mirroring is a non-intrusive technology in network monitoring that only copies traffic for analysis without interfering with the main communication path. Therefore, it does not introduce additional latency, packet loss, or processing bottlenecks, ensuring the original deterministic transmission capabilities of the in-vehicle Ethernet. In intelligent connected vehicles, any interference with the transmission of critical control commands can lead to serious safety consequences; therefore, this "read-only, non-interference" acquisition mechanism is a crucial prerequisite for achieving parallel security monitoring and functional safety. In summary, this design ensures both the breadth and depth of intrusion detection coverage while strictly maintaining the real-time performance, reliability, and functional safety requirements of the in-vehicle network.

[0045] In some embodiments of this application, in step S130, statistical aggregation is performed on a session-by-session basis. Each session is uniquely identified by a 5-tuple, which includes the source IP, destination IP, source port, destination port, and protocol type, thereby generating a session-level window feature vector for detecting sudden increases in connection frequency, abnormal port scanning, or abnormal session duration.

[0046] Specifically, by aggregating data frames belonging to the same session within a sliding time window, the system generates a "session-level window feature vector" with clear network semantics, rather than isolated packet statistics. This session-centric modeling approach makes the features more reflective of the structure and patterns of real communication behavior, providing a higher-level and more discriminative input basis for subsequent anomaly detection.

[0047] This design enhances the detection capability for specific types of network attacks. For example, when faced with a sudden surge in connection frequency (such as SYN Flood), the system can capture abnormal patterns of a large number of newly established short-lived sessions within a short period of time; when identifying abnormal port scanning behavior, it can effectively discover discrete quintuple features of a single source IP initiating probing connections to a large number of different ports of the same target IP; for abnormal session durations (such as abnormal long connections or momentary disconnections), it can also accurately identify behaviors deviating from normal service patterns through indicators such as session lifespan. Therefore, this session-level aggregation mechanism not only improves the semantic expressive power of features but also makes the detection logic closer to actual attack behavior, effectively improving the sensitivity and accuracy against transport layer and application layer attacks.

[0048] In some embodiments of this application, the size of the sliding window includes, but is not limited to, 100ms, 200ms and 300ms, which are used to capture sudden attack behavior and slow covert attack patterns, respectively.

[0049] Specifically, shorter time windows (such as 100ms) are primarily used for rapid response and identification of sudden attacks in the network. These attacks typically occur at extremely high rates, such as Distributed Denial-of-Service (DDoS) attacks or SYN Flood attacks. They can send a large number of requests or packets in a short period of time, causing network overload or resource exhaustion. By using a short time window like 100ms, the system can quickly detect such surges in abnormal traffic, issue timely alerts, and take countermeasures, thereby effectively preventing or mitigating the impact of such attacks on the vehicle network.

[0050] Relatively long time windows (such as 200ms and 300ms) are suitable for detecting slower, more stealthy attack patterns. Some advanced persistent threats (APTs) may employ a slow and steady rate of penetration, attempting to circumvent traditional rule-based or signature-based defense mechanisms. These attacks may not immediately attract attention, but over time, they can gradually gain sensitive information or control. By setting sliding windows of 200ms and 300ms, this type of long-term, stealthy attack can be identified more effectively while maintaining a low false positive rate against normal communication traffic. Furthermore, longer time windows also help capture patterns of activity that attackers deliberately initiate intermittently to evade detection.

[0051] In some embodiments of this application, the sliding window employs an adaptive sliding step size strategy: (1) When the reconstruction error of a certain time window is continuous Secondary satisfaction At that time, the sliding step size of the window is automatically shortened to increase the detection frequency. Among these, This represents the current reconstruction error. This is the threshold value corresponding to the time window. For the preset proportional coefficient and , are positive integers and .

[0052] The purpose of this mechanism is to detect when traffic behavior is detected to be "nearly abnormal" but has not yet triggered an alarm (i.e., the error remains below the threshold but is close to the critical point), indicating that there may be potential risks in the current communication or that a slowly evolving attack (such as low-rate scanning, covert DoS, etc.) is taking place. In this case, shortening the sliding step size increases the sampling frequency of the window, enhancing the ability to respond to minute changes, thereby improving the timeliness and sensitivity of detection, avoiding the omission of key abnormal signals due to excessively large step sizes, and achieving "early warning."

[0053] (2) When the average communication load of the vehicle Ethernet within a preset time window is lower than the set load threshold, the sliding step size is extended to reduce computational overhead. This strategy aims to reduce the computational overhead of the system. During vehicle operation, there are many low-load periods (such as when the vehicle is parked, not driving, or when some functions are turned off), during which network traffic is sparse and the probability of attacks is low. By extending the sliding step size, the number of feature aggregations and model inferences per unit time can be reduced, thereby effectively reducing CPU utilization and memory access frequency, saving computing resources, improving the overall energy efficiency of the system, and making it more suitable for deployment on resource-constrained vehicle embedded platforms.

[0054] In some embodiments of this application, in step S140, the autoencoder model is trained unsupervised using only a normal traffic training set without attack labels during the offline training phase. After training, the model is compressed by weight quantization and layer pruning, and then deployed as a fixed-point computation version.

[0055] Specifically, since it does not rely on labeled anomalous data, the model focuses on learning the intrinsic structure and distribution patterns of normal communication behavior. During the inference phase, it can identify potential threats deviating from normal patterns by reconstructing errors. This semi-supervised paradigm not only improves the generalization detection capability against unknown attacks but also avoids performance degradation caused by imbalanced samples or label noise, laying the foundation for building practical and robust vehicle intrusion detection systems.

[0056] To further adapt to the resource constraints of automotive embedded platforms, the trained model underwent weight quantization and layer pruning compression before being deployed as a fixed-point computation version. Weight quantization converts floating-point parameters into low-bit integers, significantly reducing storage usage and accelerating computation; layer pruning eliminates redundant network structures, reducing computational load while maintaining accuracy; and fixed-point computation fully utilizes the hardware characteristics of automotive chips (such as T-Boxes or domain controllers) to improve inference efficiency, reduce power consumption, and enhance the determinism of execution latency. These optimization measures collectively ensure that the deep learning model can operate efficiently and stably in automotive environments with limited computing power and high real-time requirements, truly achieving a balance between safety and engineering feasibility.

[0057] In some embodiments of this application, step S150 involves setting an independent judgment threshold for each time window based on the reconstruction error distribution of the normal traffic verification set. Specifically, this includes: for each time window, calculating the mean of the reconstruction error on a verification set containing only normal traffic. with standard deviation And set the threshold as ,in This method fully leverages the characteristic of autoencoder models—that they can reconstruct normal data well but have poor reconstruction capabilities for abnormal data—and treats reconstruction error as an indicator of the degree of deviation. It introduces a statistical threshold (i.e., 3) under the Gaussian distribution assumption. Or 4 (In principle), the system can distinguish between "normal fluctuations" and "significant anomalies" in a scientific and interpretable way without attacking labels, thereby avoiding false alarms or missed alarms caused by fixed thresholds.

[0058] In some embodiments of this application, the above-described The value is dynamically adjusted according to the vehicle's operating conditions: It is set when driving at high speed or in ADAS activated state. Take off while parked or cruising at low speed To balance detection sensitivity and false alarm rate.

[0059] Specifically, during high-speed driving or when ADAS is activated, vehicles rely heavily on external environmental perception and control commands, and network communication is complex and critical. Any potential threat could lead to serious consequences; therefore, a lower... A higher threshold value (i.e., a more sensitive threshold) can improve detection sensitivity, promptly capture minute anomalies, and ensure rapid response. However, in relatively static and low-risk states such as parking or low-speed cruising, the network load is light and communication patterns are stable. Using an overly sensitive threshold in these situations can easily misinterpret normal service fluctuations as attacks, resulting in a high false alarm rate. Therefore, by increasing... By relaxing the judgment criteria, false alarms can be effectively reduced while ensuring basic safety, thus optimizing the user experience. This adaptive threshold strategy based on operating status achieves a dynamic balance between detection sensitivity and false alarm rate, giving the system stronger scenario adaptability and practicality, and making it particularly suitable for the changing operating environment of intelligent connected vehicles.

[0060] In some embodiments of this application, a cross-window consistency check mechanism is introduced when determining anomalies: if the reconstruction errors of two or more sliding windows with different time scales exceed their respective judgment thresholds within the same time interval, it is determined to be a high-confidence anomaly and a high-level response is triggered. If the reconstruction error of only a single short time window exceeds its judgment threshold, while the reconstruction errors of other time windows are all below their respective thresholds, it is considered as a momentary network jitter or normal fluctuation, and no alarm is triggered or only a low-priority log is recorded.

[0061] Specifically, a cross-window consistency verification mechanism is introduced to improve the accuracy and confidence of anomaly detection. This mechanism stipulates that the system only classifies the current communication as a high-confidence anomaly and triggers a high-level response (such as real-time alarms, cloud reporting, or local security policy execution) when the reconstruction errors of two or more sliding windows with different time scales (e.g., 100ms, 200ms, 300ms) exceed their respective judgment thresholds within the same time interval. This design fully leverages the collaborative perception capability of multi-scale time windows for attack behavior—real attacks often exhibit both short-term bursts and long-term accumulation of anomalous characteristics. Therefore, anomaly signals with multi-window consistency have stronger attack semantic support, effectively avoiding the risk of misjudgment caused by isolated judgments.

[0062] Conversely, if only a single short time window (e.g., 100ms) has a reconstruction error exceeding the threshold, while errors in other longer time windows remain within the normal range, the system treats this as a non-malicious phenomenon such as network jitter, protocol retransmission, or legitimate service fluctuations, and does not trigger a formal alarm, or only records it as a low-priority log for subsequent analysis. This "conservative verification" strategy fully considers the dynamic and complex communication patterns in vehicular networks. While ensuring high sensitivity to real attacks, it significantly suppresses false alarms caused by brief traffic fluctuations, improving the robustness and practicality of the entire intrusion detection system.

[0063] In some embodiments of this application, when an anomaly is determined to exist in the vehicle Ethernet, a structured alarm message containing a session identifier, timestamp, trigger window type, and reconstruction error value is generated and reported to the cloud platform via a T-Box. At the same time, local security policies are linked to perform fine-grained packet capture, communication rate limiting, or service degradation operations.

[0064] Specifically, when an anomaly is detected in the vehicle Ethernet, the system generates structured alarm information, including a session identifier (such as a 5-tuple), a timestamp, a trigger window type (such as 100ms, 200ms, etc.), and a reconstruction error value. These fields collectively provide the precise context of the anomaly: the session identifier is used to locate the communicating parties, the timestamp supports event alignment and cross-domain association, the window type reflects the temporal characteristics of the attack (sudden or covert), and the reconstruction error value quantifies the degree of anomaly. This structured alarm not only facilitates local log auditing but can also be reported to the cloud security platform in real time via T-Box, providing a high-quality data foundation for automakers to achieve remote monitoring, threat intelligence analysis, and global security situation awareness, thus forming a vehicle-cloud collaborative security operation capability.

[0065] Meanwhile, the system will coordinate with local security policies to execute granular response operations, rather than simply cutting off the network. For example, it will initiate fine-grained packet capture for abnormal sessions, recording only suspicious traffic for subsequent forensics; it will implement communication rate limiting on attack sources to suppress their resource consumption or spread capabilities; or, when necessary, it will trigger service degradation, temporarily shutting down non-critical functions (such as the entertainment system) to prioritize the normal operation of high-security domains such as ADAS and chassis control. This tiered, precise, and recoverable local handling mechanism effectively curbs potential threats while maximizing the maintenance of core vehicle functions, balancing network security, functional safety, and user experience, demonstrating the mature design of an active defense system for intelligent connected vehicles.

[0066] In some embodiments of this application, when an anomaly is detected in the vehicle Ethernet, the alarm status of the CAN bus anomaly detection module within the same time period is simultaneously queried. If both are anomaly-free, it is determined to be a cross-domain coordinated attack, and a vehicle-level security response is triggered, including ECU communication isolation or entering a safe operating mode.

[0067] Specifically, modern intelligent connected vehicles employ a heterogeneous network architecture. Critical control commands are typically transmitted via traditional buses such as CAN / CAN-FD, while high-bandwidth data (such as sensor fusion, OTA updates, and V2X communication) relies on in-vehicle Ethernet. To achieve greater destructive effects, attackers may employ cross-domain coordinated attack strategies—for example, first penetrating the T-Box or domain controller via Ethernet, and then issuing malicious control commands to the CAN bus (such as forging brake signals or tampering with steering commands). If only a single network domain is monitored in isolation, such attacks may be misjudged as independent events, making it difficult to identify their overall intent. However, by comparing cross-domain alarm states with time alignment, the system can discover the temporal coupling between "Ethernet anomalies + CAN anomalies," thereby inferring potential coordinated attack behaviors.

[0068] Once it is confirmed that both the vehicle's Ethernet and CAN bus report anomalies within the same time period, the system classifies the event as a cross-domain coordinated attack and triggers a vehicle-level security response mechanism, including but not limited to ECU communication isolation or entering a safe operating mode. This response strategy has extremely high security value: ECU communication isolation can cut off data interaction between infected nodes and other critical controllers, preventing the attack from spreading laterally; while entering a safe operating mode (such as limiting vehicle speed, disabling unnecessary functions, and enabling redundant control paths) can maintain the vehicle's controllability while ensuring the basic safety of occupants, avoiding complete loss of control due to network attacks. This design not only breaks through the limitations of traditional IDS's "single-domain island" detection, but also elevates network security incidents to the level of vehicle functional safety for coordinated handling, reflecting the intelligent vehicle protection concept of deep integration of "network-control-security". By building a linkage detection and response capability between multiple buses such as Ethernet and CAN, this application significantly improves the overall resilience of the vehicle against complex, advanced persistent threats.

[0069] In some embodiments of this application, the system employs a timer- and buffer-based aggregation mechanism when processing vehicle bus messages forwarded to Ethernet: when a periodic message CAN1 (bus ID 0xA, message ID 0x10, length 8 bytes) is received, if the timer has not yet started, the timer is immediately started, and a PDUHeader is added to the message before it is stored in the buffer; before the timer expires, if other periodic messages (such as CAN2, LIN1) are received and the buffer still has sufficient space, a PDUHeader is added to them and they are stored in the buffer sequentially; after the timer expires... The system packages all data with added PDUHeaders in the buffer into a single Ethernet packet and sends it out at once to improve transmission efficiency. If an event-type packet CANFD1 is received during this period, and the buffer capacity allows, the system immediately merges all cached data with PDUHeaders in the current buffer with the CANFD1 (also with added PDUHeaders) into a single Ethernet packet and sends it immediately, resetting the timer to 0. Subsequently, when a new periodic packet CANFD2 is received, the system restarts the timer and begins a new round of periodic packet aggregation. This mechanism balances the efficient batch transmission of periodic packets with the low-latency response requirements of event-type packets.

[0070] In some embodiments of this application, attackers may launch attacks through multiple entry points such as electronic control units (ECUs), gateways, or switches. To address this threat, the system deploys collaborative detection components at different network layers: at the CAN bus level, a CAN-IDS module (IDS stands for Intrusion Detection System) is set up to monitor the CAN_H and CAN_L differential signals, covering abnormal behavior at the physical and data link layers; at the vehicle Ethernet level, an Ethernet IDS module is deployed, focusing on detecting suspicious traffic and abnormal communication patterns at the network and transport layers. The two IDS modules share information and perform joint analysis through interfaces or gateways, not only conducting in-depth monitoring within their respective domains but also collaboratively identifying complex attacks across domains (such as sending malicious commands to the CAN bus after Ethernet penetration), thus forming a comprehensive security protection system covering the entire vehicle communication network and considering both defense-in-depth and lateral collaboration.

[0071] In some embodiments of this application, the intrusion detection system deploys an Ethernet-based intrusion detection system (IDS) within intelligent connected vehicles to achieve real-time monitoring and closed-loop response to network attacks. The overall system architecture includes key components such as onboard electronic control units (ECUs), CAN bus, gateway, switch, and T-Box. External attackers may launch intrusions via wireless communication or remote network interfaces. Data packets within the vehicle are forwarded via the switch and gateway, captured by a bypass mirror during transmission, and sent to the Ethernet-based IDS module for real-time analysis. The IDS performs deep inspection on each data packet, archiving normal communication events into "normal logging" for model maintenance and auditing. Once abnormal behavior is identified, a local alarm is immediately triggered, generating structured alarm information via the T-Box and reporting it to the cloud platform, thus realizing a linkage mechanism between vehicle-side detection and cloud-side collaboration. The entire process covers the complete chain from data acquisition, feature extraction, anomaly detection to alarm response, constructing an efficient, closed-loop in-vehicle network security protection system, significantly improving the ability of intelligent connected vehicles to perceive, identify, and handle potential network threats.

[0072] Secondly, refer to Figure 2 This application provides a vehicle Ethernet anomaly detection system based on multi-scale time windows, used to execute the aforementioned vehicle Ethernet anomaly detection method based on multi-scale time windows, including the following modules.

[0073] The data collection module is used to collect in-vehicle Ethernet data frames in a bypass mirroring manner at the gateway or switch of an intelligent connected vehicle.

[0074] The feature extraction module is used to extract the protocol type, transmission control flag, source IP address, source port, destination port, payload length, and deviation information of the payload from the preset normal format for each data frame, forming the original feature set.

[0075] The statistical aggregation module is used to set multiple sliding windows with different time scales, and to statistically aggregate the data frames falling into each sliding window according to the original feature set, generating a fixed-dimensional original window feature vector corresponding to each time window.

[0076] The feature reconstruction module is used to perform principal component analysis (PCA) dimensionality reduction on the original window feature vectors, and then input the dimensionality-reduced feature vectors into an autoencoder model trained using only normal flow to obtain the reconstructed feature vectors.

[0077] The anomaly detection module calculates the reconstruction error between the original window feature vector and the reconstructed feature vector, and sets an independent judgment threshold for each time window based on the reconstruction error distribution of the normal traffic verification set. If the reconstruction error of any time window exceeds its corresponding judgment threshold, an anomaly is determined in the current communication, and an alarm is triggered.

[0078] In summary, the vehicle Ethernet anomaly detection method and system based on multi-scale time windows provided in this application have the following technical effects.

[0079] This method effectively covers both sudden and slow-moving covert attacks by using a semi-supervised autoencoder model trained only on normal traffic, combined with PCA dimensionality reduction and multi-scale sliding windows (e.g., 100ms, 200ms, 300ms). It introduces cross-window consistency verification and a threshold mechanism dynamically adjusted based on vehicle operating conditions to significantly suppress false alarms. Furthermore, it greatly reduces computational overhead through model compression techniques such as weight quantization, layer pruning, and fixed-point computation, meeting the real-time detection requirements of resource-constrained platforms such as T-Boxes or domain controllers. Simultaneously, the bypass mirroring acquisition method ensures uninterrupted forwarding of the original service, balancing functional safety and network security.

[0080] Furthermore, the system possesses structured alarm and closed-loop response capabilities: once an anomaly is detected, standardized alarm information containing session identifiers, timestamps, window types, and reconstruction errors is generated, reported to the cloud via a T-Box, and coupled with the execution of local policies such as fine-grained packet capture, communication rate limiting, or service degradation. More importantly, the system supports collaborative work with the CAN bus anomaly detection module—when both Ethernet and CAN report anomalies within the same time period, it is determined to be a cross-domain coordinated attack, triggering high-level responses such as ECU communication isolation or the vehicle entering a safe operating mode. This design breaks through the limitations of single-domain detection, achieving a leap from network anomaly identification to vehicle-level security protection, providing an efficient, reliable, and implementable real-time intrusion prevention solution for intelligent connected vehicles supporting Time-Sensitive Networking (TSN).

[0081] It should be noted that in all specific embodiments of this application, all data processing activities related to user identity or personal characteristics, such as user information, user behavior data, historical data, and location information, will be conducted in accordance with the principles of legality, legitimacy, and necessity. All data collection, use, storage, and processing will be subject to compliance with applicable national and regional laws, regulations, and industry standards, and informed consent from users will be obtained in a clear and explicit manner before processing. For the processing of sensitive personal information, separate consent from users will be obtained through prominent means such as pop-up prompts and independent confirmation pages. If any processing conflicts with laws and regulations, the laws and regulations will prevail, and necessary data processing will only be carried out within the scope permitted by laws and regulations, ensuring that all data-based applications, analyses, and technical implementations are conducted within the scope permitted by laws and regulations.

[0082] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this application are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0083] Furthermore, although this application is described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding this application. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of ordinary skill of an engineer. Therefore, those skilled in the art can implement the application set forth in the claims using ordinary skill. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of this application, which is determined by the full scope of the appended claims and their equivalents.

[0084] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several programs to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0085] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequential list of executable programs for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, a program execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can retrieve and execute a program from or in conjunction with such a program execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can mean any means that can contain, store, communicate, propagate, or transmit a program for use by or in conjunction with a program execution system, apparatus, or device.

[0086] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Additionally, computer-readable media can even be paper or other suitable media on which programs can be printed, for example, by optically scanning the paper or other media, then editing, interpreting, or, if necessary, processing it in a suitable manner to obtain the program electronically, and then storing it in computer memory.

[0087] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable program execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0088] In the foregoing description of this specification, the reference to terms such as "one embodiment / implementation," "another embodiment / implementation," or "certain embodiments / implementations," etc., indicates that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in an embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0089] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0090] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A method for detecting abnormality of in-vehicle Ethernet based on multi-scale time window, characterized in that, The vehicle-mounted Ethernet supports a time-sensitive network, including the following steps: Data frames of the vehicle-mounted Ethernet are collected in a bypass mirroring manner at a gateway or a switch of the intelligent connected vehicle; For each data frame, a protocol type, a transmission control flag, a source IP address, a source port, a destination port, a payload length, and deviation information of the payload from a preset normal format are extracted to form an original feature set; A plurality of sliding windows of different time scales are set, and data frames falling within each sliding window are statistically aggregated according to the original feature set to generate a fixed-dimension original window feature vector corresponding to each time window; The original window feature vector is subjected to principal component analysis (PCA) dimension reduction processing, and the dimension-reduced feature vector is input into a self-encoder model trained only using normal traffic to obtain a reconstructed feature vector; The reconstruction error between the original window feature vector and the reconstructed feature vector is calculated, and an independent judgment threshold is set for each time window based on the reconstruction error distribution of a normal traffic verification set; If the reconstruction error of any time window exceeds the corresponding judgment threshold, it is determined that there is an abnormal communication, and an alarm is triggered.

2. The multi-scale time window based in-vehicle Ethernet anomaly detection method of claim 1, wherein, The bypass mirroring collection covers key Ethernet links between ADAS and chassis domains, infotainment and body domains, and original business data frames are not affected by the mirroring operation and continue to be normally forwarded, ensuring functional safety and real-time performance.

3. The multi-scale time window based in-vehicle Ethernet anomaly detection method of claim 1, wherein, The statistical aggregation is performed in units of sessions, which are uniquely identified by a five-tuple including a source IP, a destination IP, a source port, a destination port, and a protocol type, to generate a session-level window feature vector for detecting sudden increases in connection frequency, abnormal port scanning, or session duration anomalies.

4. The multi-scale time window based in-vehicle Ethernet anomaly detection method of claim 1, wherein, The size of the sliding window includes but is not limited to 100 ms, 200 ms, and 300 ms, which are respectively used to capture sudden attack behaviors and slow hidden attack patterns; The sliding window adopts an adaptive sliding step strategy: when the reconstruction error of a time window continuously satisfies , the sliding step of the window is automatically shortened to improve the detection frequency; wherein, is the current reconstruction error, is the determination threshold corresponding to the time window, is a preset proportion coefficient and , is a positive integer and ; When the average communication load of the vehicle-mounted Ethernet within a preset time window is lower than a set load threshold, the sliding step is lengthened to reduce the computational overhead.

5. The multi-scale time window based in-vehicle Ethernet anomaly detection method of claim 1, wherein, The self-encoder model is trained in an offline training phase using only a normal traffic training set without an attack label for unsupervised training, and after training, the model is compressed through weight quantization and layer pruning and deployed as a fixed-point operation version.

6. The multi-scale time window based in-vehicle Ethernet anomaly detection method of claim 1, wherein, The step of setting independent judgment thresholds for each time window based on the reconstruction error distribution of the normal traffic validation set specifically includes: for each time window, calculating the mean of the reconstruction error on a validation set containing only normal traffic. with standard deviation And set the threshold as ,in The The value is dynamically adjusted according to the vehicle's operating conditions: It is set when driving at high speed or in ADAS activated state. Take off while parked or cruising at low speed To balance detection sensitivity and false alarm rate.

7. The multi-scale time window based in-vehicle Ethernet anomaly detection method of claim 1, wherein, A cross-window consistency checking mechanism is introduced when an anomaly is determined: if the reconstruction error of two or more sliding windows of different time scales in the same time interval exceeds the corresponding judgment threshold, it is determined as a high-confidence anomaly and a high-level response is triggered; if only the reconstruction error of a single short time window exceeds the judgment threshold, while the reconstruction errors of other time windows are all lower than the respective thresholds, it is considered as network transient jitter or normal fluctuation, and no alarm is triggered or only a low-priority log is recorded.

8. The multi-scale time window based in-vehicle Ethernet anomaly detection method of claim 1, wherein, When it is determined that the vehicle-mounted Ethernet has an anomaly, structured alarm information including a session identifier, a timestamp, a trigger window type, and a reconstruction error value is generated and reported to a cloud platform through a T-Box, and a local security policy is linked to perform fine-grained packet capture, communication speed limiting, or service degradation operations.

9. The multi-scale time window based in-vehicle Ethernet anomaly detection method of claim 1, wherein, When it is determined that the vehicle-mounted Ethernet has an abnormality, the alarm state of the CAN bus abnormality detection module in the same time period is queried synchronously; if both have an abnormality, it is determined that there is a cross-domain cooperative attack, and a vehicle-level safety response is triggered, including ECU communication isolation or entering a safe operation mode.

10. A multi-scale time window based in-vehicle Ethernet anomaly detection system, comprising: The method for performing the multi-scale time window-based vehicle-mounted Ethernet abnormality detection method according to any one of claims 1 to 9 comprises the following modules: A data collection module is configured to collect data frames of the vehicle-mounted Ethernet in a bypass mirroring manner at a gateway or a switch of the intelligent connected vehicle; A feature extraction module is configured to extract, for each data frame, a protocol type, a transmission control flag, a source IP address, a source port, a destination port, a payload length, and deviation information of a payload from a preset normal format to form an original feature set; A statistical aggregation module is configured to set a plurality of sliding windows of different time scales, and perform statistical aggregation on data frames falling into each sliding window according to the original feature set to generate a fixed-dimension original window feature vector corresponding to each time window; A feature reconstruction module is configured to perform principal component analysis (PCA) dimension reduction processing on the original window feature vector, and input the dimension-reduced feature vector into a self-encoder model trained only using normal traffic to obtain a reconstructed feature vector; An abnormality detection module is configured to calculate reconstruction errors between the original window feature vector and the reconstructed feature vector, and set an independent determination threshold for each time window based on a reconstruction error distribution of a normal traffic verification set; if the reconstruction error of any time window exceeds the corresponding determination threshold, it is determined that the current communication has an abnormality, and an alarm is triggered.

Images