Automobile controller health monitoring and network security early warning system and method based on machine learning

Abstract

The invention belongs to the technical field of automobile electronics, and discloses an automobile controller health monitoring and network security early warning system and method based on machine learning, and the system comprises a data collection module, a data analysis and decision and visual management module, and the data collection module synchronously collects the health state of a controller and network security data; the data analysis module carries out correlation analysis on two types of data by adopting machine learning to realize real-time early warning of abnormity; and the decision and visualization management module executes decision response and completes visualization output. According to the system, a traditional detection independent operation mode is broken, the problems of delay of cooperative fault identification and high false alarm rate are solved, the early warning instantaneity and accuracy are improved, and integrated guarantee is provided for safe operation of the automobile controller.

Description

Technical Field

[0001] This invention belongs to the field of automotive electronics technology, specifically relating to a machine learning-based automotive controller health monitoring and network security early warning system and method. Background Technology

[0002] Currently, monitoring technologies for automotive electronic control units (ECUs) primarily rely on traditional diagnostic methods, such as rule-based detection and routine maintenance. These methods typically identify problems by reading fault codes or simple threshold comparisons, but lack real-time performance and predictive capabilities. Existing ECU monitoring systems often focus solely on hardware faults, neglecting software anomalies and cyberattack threats. Due to the increasing complexity of automotive networks, especially the prevalence of in-vehicle networks (such as CAN bus), ECUs are vulnerable to remote attacks, such as denial-of-service attacks and data injection attacks. Furthermore, traditional methods cannot handle multi-controller collaborative faults, leading to delayed fault identification and high false alarm rates. This is because existing technologies lack efficient data acquisition mechanisms, advanced algorithmic analysis, and comprehensive health status assessments. For example, many systems rely on offline analysis, cannot respond to dynamic threats in real time, and have limited visualization report generation capabilities, hindering rapid decision-making.

[0003] Fault and Anomaly Detection: Diagnostic Trouble Codes (DTCs) are developed for each controller. After a fault occurs, they are read by a diagnostic tool and analyzed by maintenance personnel. However, this method relies heavily on DTCs and the experience of maintenance personnel. It typically detects faults only after they have occurred, resulting in poor real-time performance. It cannot predict hidden risks such as controller hardware aging or software logic errors in advance. Furthermore, the large number of components leads to scattered data, requiring highly skilled analytical personnel and lacking intelligent fault prediction and root cause analysis capabilities. Network attack detection: This is achieved by integrating IDS (Intrusion Detection System) components into various controllers. After an attack occurs, the IDS detects the abnormal event. Network attack detection is mainly achieved through the integration of IDS components. However, IDS consumes system resources when detecting network attacks. Controllers with low computing power do not have the capability to integrate components, resulting in vulnerabilities in the entire vehicle.

[0004] Currently, there are no products on the market that can simultaneously perform fault and anomaly detection and network attack detection. Traditional fault and anomaly detection and network attack detection usually operate independently, but there is a certain correlation between controller faults and anomalies and network attacks. Summary of the Invention

[0005] The purpose of this invention is to solve the problems of poor real-time performance and high false alarm rate caused by the separation of fault detection and attack detection in the prior art, which makes it impossible to correlate and analyze them. The invention provides a machine learning-based automotive controller health monitoring and network security early warning system and method.

[0006] To achieve the above objectives, the present invention employs the following technical solution: The present invention proposes a machine learning-based vehicle controller health monitoring and cybersecurity early warning system, comprising: The data acquisition module is used to collect health status data and network security data from the vehicle controller. The data analysis module is used to perform health status analysis and network attack detection on the data collected by the data acquisition module. It uses machine learning methods to perform correlation analysis and obtain early warnings of abnormal health and security status of the controller. The decision-making and visualization management module is used to execute decision responses and provide visualization outputs based on abnormal warnings of the controller's health and safety status.

[0007] Preferably, the data analysis module includes a data preprocessing module, a health status analysis module, a network attack detection module, and a correlation analysis engine; The health status analysis module, when performing controller health status analysis, uses at least one machine learning algorithm among isolated forest, autoencoder, and LSTM network to establish a normal behavior baseline model of a single electronic control unit (ECU). The deviation of the ECU's real-time operating data from the baseline model is used as the basis for anomaly judgment, and deviation from the baseline is judged as an abnormal state. The network attack detection module employs an intrusion detection system, combining rule-based known attack signature detection with machine learning-based anomaly detection to detect abnormal network packets. The correlation analysis engine receives information from the health status analysis module and the network attack detection module, uses machine learning algorithms to perform correlation analysis, and provides early warnings of abnormal controller health and security status.

[0008] Preferably, the anomaly detection is achieved by learning normal network communication patterns through machine learning; the network attack types include at least one of message flooding, replay attack, or obfuscation attack.

[0009] Preferably, the health status analysis module is further configured to: construct a collaborative working model of multiple ECUs, analyze the communication interaction data and logic execution sequence between multiple ECUs, and detect collaborative failures caused by communication interruption or logic error.

[0010] Preferably, the logic of the correlation analysis engine is as follows: Input: Responses from the health status analysis module and responses from the network attack detection module; Association rule base / algorithm: Timing correlation: Check whether the occurrence times of two alarms highly overlap or have a sequential order; By establishing causal logical connections and building a knowledge graph, when high-frequency messages and ECU no-response alarms occur simultaneously, the system infers that the attack is the root cause and the fault is the result. Spatial correlation analysis identifies the location of the ECUs involved in the alarm within the network topology. Probabilistic statistical correlation uses a Bayesian network model to calculate the probability that a specific hardware failure will occur when a certain network alarm is detected. Output: If only a health alarm is detected, it is determined to be an inherent fault pointing to hardware aging or internal software defects; if only a security alarm is detected, it is recorded as an unsuccessful network attack attempt and the triggering of the highest level fault alarm is suppressed; if a health alarm and a security alarm occur simultaneously under preset spatiotemporal correlation conditions, it is confirmed as a controller fault caused by a security event and the highest level security fault linkage warning is immediately triggered.

[0011] Preferably, the data preprocessing module performs cleaning and normalization processing on the operating data of the vehicle controller.

[0012] Preferably, the decision-making and visualization management module includes a real-time early warning module, a root cause analysis module, a visualization dashboard, and a report generation module; The real-time early warning module, based on the risk level of the analysis results, sends different levels of alarm information to the driver or cloud platform through the vehicle human-machine interface or remote communication interface. The root cause analysis module provides preliminary inferences about the potential causes of failures or attacks based on the analysis results and a pre-defined rule base. A visual dashboard presents a system status view, including at least one of the following: historical data trends, alarm statistics, and a topology diagram of the affected electronic control units. The report generation module automatically generates diagnostic reports, which include recommendations for maintenance measures or security policy updates.

[0013] The machine learning-based method for vehicle controller health monitoring and cybersecurity early warning proposed in this invention includes the following steps: Acquire health status data and cybersecurity data from the vehicle controller; Health status analysis is performed on health status data, network attack detection is performed on network communication data, machine learning methods are used to analyze the correlation between health status and security status, and abnormal early warning information is generated. Based on abnormal early warning information, differentiated decision-making responses are executed, and visualized information is output.

[0014] A terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of a machine learning-based method for monitoring the health of a vehicle controller and providing network security early warning.

[0015] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of a machine learning-based method for health monitoring and cybersecurity early warning of an automotive controller.

[0016] Compared with the prior art, the present invention has the following beneficial effects: This invention proposes a machine learning-based automotive controller health monitoring and cybersecurity early warning system. First, the system uses a data acquisition module to synchronously aggregate the controller's internal operating status data and external network communication data, establishing a common data foundation for subsequent correlation analysis. Then, the data analysis module introduces machine learning algorithms to perform correlation analysis on these two types of signals. This enables the system to intelligently identify the inherent connections between abnormal events, reducing false alarms caused by single-dimensional detection. Finally, the decision-making and visualization management module quickly executes decision responses based on the correlation analysis results, avoiding the decision delay problem in traditional separate detection. The visualization output makes the anomaly correlation logic intuitively presented. This solves the problems of existing technologies that separate fault detection and attack detection, making correlation analysis impossible and resulting in poor real-time performance and high false alarm rates. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a diagram of the machine learning-based vehicle controller health monitoring and network security early warning system of the present invention.

[0019] Figure 2 This is a flowchart of the machine learning-based vehicle controller health monitoring and network security early warning method of the present invention.

[0020] Figure 3 This is a schematic diagram of the structure of an electronic device according to the present invention. Detailed Implementation

[0021] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0022] The present invention will now be described in further detail with reference to the accompanying drawings: Example 1 This invention proposes a comprehensive early warning system integrating ECU health status monitoring and network attack monitoring. By collecting real-time hardware, software, and communication-related data from the vehicle's ECU controller, and utilizing machine learning algorithms, it monitors the health status of single and multiple controllers in the vehicle domain, proactively identifying faults, anomalies, and security attacks. The system possesses capabilities for anomaly diagnosis, fault prediction, and visualization report generation. It monitors the controller's health status, analyzes potential network attacks, and issues early warnings for controller faults and anomalies, as well as network attacks. This addresses both the lag in traditional fault detection mechanisms and the problem of low-computing-power controllers being unable to deploy IDS components due to insufficient resources. By uniformly collecting data and using the same set of machine learning algorithms, it simultaneously achieves the goals of fault detection and network attack detection.

[0023] This invention proposes a machine learning-based vehicle controller health monitoring and network security early warning system, such as... Figure 1 ,include: The data acquisition module is used to collect health status data and network security data from the vehicle controller. The data analysis module is used to perform health status analysis and network attack detection on the data collected by the data acquisition module. It uses machine learning methods to perform correlation analysis and obtain early warnings of abnormal health and security status of the controller. The decision-making and visualization management module is used to execute decision responses and provide visualization outputs based on abnormal warnings of the controller's health and safety status.

[0024] The following is a detailed description of each module: The data acquisition module is a lightweight data acquisition agent deployed at various key nodes in the vehicle (such as gateways and important ECUs), fusing and acquiring real-time data from multiple sources. The acquired data includes, but is not limited to, the following: Health status data: CPU / memory usage, temperature, voltage, task execution cycle, error log, bus load rate, etc.; Network security data includes: message IDs, data fields, transmission frequencies, and timing characteristics on the CAN bus; illegal network access requests; and abnormal authentication behaviors.

[0025] The data analysis module is deployed in the cloud to reduce resource consumption on the vehicle side, and includes a data preprocessing module, a health status analysis module, a network attack detection module, and a correlation analysis engine. Data preprocessing module: Cleans and normalizes the operating data of the vehicle controller.

[0026] Health status analysis module: When performing controller health status analysis, at least one machine learning algorithm among isolated forest, autoencoder, and LSTM network is used to establish a baseline model of the normal behavior of a single electronic control unit (ECU). The degree of deviation between the real-time operating data of the ECU and the baseline model is used as the basis for anomaly judgment, and deviation from the baseline is judged as an abnormal state. The health status analysis module is further configured to: not only monitor a single ECU, but also analyze the communication interaction data and logic execution sequence between multiple ECUs by constructing a collaborative working model of multiple ECUs, and detect collaborative failures caused by communication interruptions or logic errors.

[0027] Network attack detection module: It adopts an intrusion detection system, combining known attack signature detection based on a rule base with anomaly detection based on machine learning to detect abnormal network packets; wherein, the anomaly detection is achieved by learning normal network communication patterns through machine learning; the network attack types include at least one of packet flooding, replay attack or obfuscation attack.

[0028] The correlation analysis engine receives information from the health status analysis module and the network attack detection module, uses machine learning algorithms to perform correlation analysis, and provides early warnings of abnormal controller health and security status. When a sudden spike in CPU utilization of an ECU is detected (health anomaly), and it is found that the ECU is receiving a large number of abnormal packets (network attack), the correlation engine can comprehensively determine that this is a denial-of-service attack targeting that ECU, rather than simply hardware overheating.

[0029] The ultimate goal of cyberattacks is often to cause ECU malfunctions (failures). Therefore, from a presentation perspective, a successful cyberattack and a hardware / software failure can have completely identical symptoms. For example, a data injection attack on the engine ECU (cybersecurity incident) may cause the engine to stall (functional failure). Traditional diagnostic systems will only report a "engine stalled unexpectedly" fault code, completely failing to identify that this was caused by a malicious attack. This invention designs a correlation analysis engine module, the logic of which is as follows: Input: Alert_A response from the health status analysis module (e.g., ECU_XX response timed out) and Alert_B response from the network attack detection module (e.g., ECU_XX ID was detected to be accessed at abnormally high frequency). Association rule base / algorithm: By examining the timing of the two alarms, we can determine if they occur at highly overlapping times or in a sequential order. If Alert_B occurs before Alert_A, it is highly likely that there is a causal relationship.

[0030] By establishing causal logical connections and building a knowledge graph, for example, a message flooding attack may exhaust ECU resources, causing ECU response timeouts or restarts. When high-frequency messages and ECU no-response alarms occur simultaneously, the system infers that the attack is the root cause and the fault is the result. Spatial correlation analysis identifies the location of the ECUs involved in the alarm within the network topology; for example, if the attack targets the gateway, but the fault occurs on multiple ECUs connected to the gateway, it can be inferred that the gateway was compromised, triggering a chain reaction.

[0031] Probabilistic statistical correlation uses a Bayesian network model to calculate the probability that a specific hardware failure will occur when a certain network alarm is detected. Output: Overall assessment: High confidence: ECU_XX suffered a denial-of-service attack, causing its functionality to fail.

[0032] Differentiated processing: If there is only a health alarm, it is determined to be an inherent fault pointing to hardware aging or internal software defects; if there is only a security alarm, it is recorded as an unsuccessful network attack attempt and the triggering of the highest level fault alarm is suppressed; if a health alarm and a security alarm occur simultaneously under preset spatiotemporal correlation conditions, it is confirmed as a controller fault caused by a security event and the highest level security fault linkage warning is immediately triggered.

[0033] The decision-making and visualization management module includes a real-time early warning module, a root cause analysis module, a visualization dashboard, and a report generation module. The real-time early warning module, based on the risk level of the analysis results, sends different levels of alarm information to the driver or cloud platform through the vehicle human-machine interface or remote communication interface. The root cause analysis module provides preliminary inferences about the potential causes of failures or attacks based on the analysis results and a pre-defined rule base. A visual dashboard presents a system status view, including at least one of the following: historical data trends, alarm statistics, and a topology diagram of the affected electronic control units. The report generation module automatically generates diagnostic reports, which include recommendations for maintenance measures or security policy updates.

[0034] The system proposed in this invention has the following advantages: 1) It integrates fault and anomaly detection with network attack detection, reducing system complexity and cost; 2) It improves accuracy, with machine learning models adaptively learning complex operating conditions and reducing false alarm rates by associating multiple key feature data of a single controller or single or multiple key feature data of multiple controllers; 3) It has predictive maintenance capabilities, enabling early warning before faults occur; 4) Fault and anomaly detection: It achieves real-time dynamic monitoring with millisecond-level response, covering the entire lifecycle of the controller; 5) Network attack detection: The analysis is deployed in the cloud, requiring no computing power or other resources from the vehicle-side controller; 6) It provides an intuitive visualization interface, supporting rapid decision-making.

[0035] Example 2 The present invention proposes a machine learning-based method for vehicle controller health monitoring and network security early warning, such as... Figure 2 It includes the following steps: Step 1: Obtain health status data and network security data of the vehicle controller; Step 2: Perform health status analysis on health status data, perform network attack detection on network communication data, use machine learning methods to perform correlation analysis between health status and security status, and generate abnormal early warning information; Step 3: Execute differentiated decision responses based on abnormal early warning information and output visualized information.

[0036] Example 3 Please see Figure 3 As shown, the present invention also provides an electronic device 100 for a machine learning-based method for health monitoring and network security early warning of vehicle controllers; the electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0037] The memory 101 can be used to store the computer program 103. The processor 102 implements the steps of the machine learning-based vehicle controller health monitoring and network security early warning method described in Embodiment 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101. The memory 101 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device 100 (such as audio data), etc. In addition, the memory 101 may include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other non-volatile solid-state storage device.

[0038] The at least one processor 102 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor. The processor 102 is the control center of the electronic device 100, connecting various parts of the electronic device 100 via various interfaces and lines.

[0039] The memory 101 in the electronic device 100 stores multiple instructions to implement a machine learning-based method for vehicle controller health monitoring and network security early warning. The processor 102 can execute the multiple instructions to achieve the following: Acquire health status data and cybersecurity data from the vehicle controller; Health status analysis is performed on health status data, network attack detection is performed on network communication data, machine learning methods are used to analyze the correlation between health status and security status, and abnormal early warning information is generated. Based on abnormal early warning information, differentiated decision-making responses are executed, and visualized information is output.

[0040] Example 4 If the modules / units integrated in the electronic device 100 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0041] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0042] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0043] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0044] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0045] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A machine learning-based vehicle controller health monitoring and cybersecurity early warning system, characterized in that, include: The data acquisition module is used to collect health status data and network security data from the vehicle controller. The data analysis module is used to perform health status analysis and network attack detection on the data collected by the data acquisition module. It uses machine learning methods to perform correlation analysis and obtain early warnings of abnormal health and security status of the controller. The decision-making and visualization management module is used to execute decision responses and provide visualization outputs based on abnormal warnings of the controller's health and safety status.

2. The vehicle controller health monitoring and network security early warning system based on machine learning according to claim 1, characterized in that, The data analysis module includes a data preprocessing module, a health status analysis module, a network attack detection module, and a correlation analysis engine. The health status analysis module, when performing controller health status analysis, uses at least one machine learning algorithm among isolated forest, autoencoder, and LSTM network to establish a normal behavior baseline model of a single electronic control unit (ECU). The deviation of the ECU's real-time operating data from the baseline model is used as the basis for anomaly judgment, and deviation from the baseline is judged as an abnormal state. The network attack detection module employs an intrusion detection system, combining rule-based known attack signature detection with machine learning-based anomaly detection to detect abnormal network packets. The correlation analysis engine receives information from the health status analysis module and the network attack detection module, uses machine learning algorithms to perform correlation analysis, and provides early warnings of abnormal controller health and security status.

3. The vehicle controller health monitoring and network security early warning system based on machine learning according to claim 2, characterized in that, The anomaly detection is achieved by learning normal network communication patterns through machine learning; the network attack types include at least one of message flooding, replay attack, or obfuscation attack.

4. The vehicle controller health monitoring and network security early warning system based on machine learning according to claim 2, characterized in that, The health status analysis module is further configured to: construct a collaborative working model of multiple ECUs, analyze the communication interaction data and logic execution sequence between multiple ECUs, and detect collaborative failures caused by communication interruptions or logic errors.

5. The machine learning-based vehicle controller health monitoring and network security early warning system according to claim 2, characterized in that, The logic of the correlation analysis engine is as follows: Input: Responses from the health status analysis module and responses from the network attack detection module; Association rule base / algorithm: Timing correlation: Check whether the occurrence times of two alarms highly overlap or have a sequential order; By establishing causal logical connections and building a knowledge graph, when high-frequency messages and ECU no-response alarms occur simultaneously, the system infers that the attack is the root cause and the fault is the result. Spatial correlation analysis identifies the location of the ECUs involved in the alarm within the network topology. Probabilistic statistical correlation uses a Bayesian network model to calculate the probability that a specific hardware failure will occur when a certain network alarm is detected. Output: If only a health alarm is detected, it is determined to be an inherent fault pointing to hardware aging or internal software defects; If there is only a security alert, log it as an unsuccessful network attack attempt and suppress the triggering of the highest level fault alert; If health alarms and safety alarms occur simultaneously under preset spatiotemporal correlation conditions, it is confirmed that the controller failure is caused by a safety event, and the highest level of safety fault linkage warning is immediately triggered.

6. The machine learning-based vehicle controller health monitoring and network security early warning system according to claim 2, characterized in that, The data preprocessing module cleans and normalizes the operating data of the vehicle controller.

7. The vehicle controller health monitoring and network security early warning system based on machine learning according to claim 1, characterized in that, The decision-making and visualization management module includes a real-time early warning module, a root cause analysis module, a visualization dashboard, and a report generation module. The real-time early warning module, based on the risk level of the analysis results, sends different levels of alarm information to the driver or cloud platform through the vehicle human-machine interface or remote communication interface. The root cause analysis module provides preliminary inferences about the potential causes of failures or attacks based on the analysis results and a pre-defined rule base. A visual dashboard presents a system status view, including at least one of the following: historical data trends, alarm statistics, and a topology diagram of the affected electronic control units. The report generation module automatically generates diagnostic reports, which include recommendations for maintenance measures or security policy updates.

8. A machine learning-based method for health monitoring and cybersecurity early warning of automotive controllers, characterized in that, Includes the following steps: Acquire health status data and cybersecurity data from the vehicle controller; Health status analysis is performed on health status data, network attack detection is performed on network communication data, machine learning methods are used to analyze the correlation between health status and security status, and abnormal early warning information is generated. Based on abnormal early warning information, differentiated decision-making responses are executed, and visualized information is output.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the machine learning-based vehicle controller health monitoring and network security early warning method as described in claim 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the machine learning-based vehicle controller health monitoring and network security early warning method as described in claim 8.

Images