Vehicle-mounted abnormity comprehensive detection method and system based on evidence deep learning

Abstract

The invention relates to the technical field of automobile electronic safety, in particular to a vehicle-mounted abnormity comprehensive detection method and system based on evidence deep learning. The evidence deep learning model in the invention comprises four layers of core structures. The feature input layer receives information entropy of a vehicle-mounted CAN message sequence; model parameters are built in the evidence reasoning layer, and input features are mapped into basic probability distribution corresponding to a plurality of categories; the uncertainty calculation layer quantifies uncertainty measurement in the classification process; and the decision output layer fuses the basic probability distribution and the uncertainty measurement result and outputs a classification result. In the training stage, a loss function formed by a multilayer perceptron evidence function and a product of a preset coefficient and uncertainty measurement is adopted, and in the verification stage, on the basis of the loss function in the training stage, an optimal annealing factor is added for weight adjustment. The optimal annealing factor is determined through correct classification on a maximized verification set and the proportion of samples with the uncertainty lower than an annealing threshold value, and the classification precision is effectively improved.

Description

Technical Field

[0001] This invention relates to the field of automotive electronic safety technology, specifically to a comprehensive detection method and system for in-vehicle anomalies based on evidence-based deep learning. Background Technology

[0002] With the acceleration of automotive electrification and intelligence, the complexity of vehicle electronic and electrical systems and on-board CAN bus networks continues to increase, and the security risks caused by physical faults and network intrusions are becoming increasingly prominent. There is an urgent need for high-precision and robust uncertainty classification and detection technologies to support the safe operation of vehicles.

[0003] In the field of uncertainty classification models, there are already classification schemes based on the combination of evidence theory and deep learning. These models generally have basic structures such as feature input, evidence reasoning, uncertainty calculation, and result output. They solve classification problems by extracting features of specific scenarios, constructing evidence extraction models, and quantifying uncertainty. For example, patent application CN202311683616.9 uses the load length and byte sequence of network traffic as input, calculates uncertainty values ​​based on Dirichlet distribution, and completes the classification of known and unknown traffic by combining relevant loss functions of evidence theory. However, when facing the scenario of vehicle CAN network security detection, these models have significant limitations: they do not design input features for the characteristics of vehicle CAN network communication, focus on general network traffic features but fail to accurately lock the key intrusion feature of CAN message sequence information entropy, and feature extraction lacks specificity; there is no unified standardized definition for uncertainty measurement calculation, and the calculation logic of different models varies greatly, resulting in inaccurate classification confidence measurement; the loss function does not incorporate a dynamically adjustable annealing factor, but only adjusts the weights by fixed parameters, which is difficult to adapt to the differences in data distribution under complex vehicle conditions and cannot effectively suppress uncertainty interference.

[0004] Therefore, the core problem with the above technologies is the lack of targeted adaptation to the vehicle CAN network security detection scenario. From input feature selection and uncertainty quantification standards to loss function optimization, no complete solution has been formed that fits the scenario, and ultimately, it is impossible to achieve accurate classification of vehicle network anomalies. Summary of the Invention

[0005] To address the technical problem of low detection accuracy caused by existing classification models based on evidence theory and deep learning failing to adapt to the vehicle CAN network security detection scenario, this invention provides an evidence-based deep learning model for uncertainty classification. Based on this evidence-based deep learning model, this invention also provides, sequentially, a training method for the evidence-based deep learning model, a vehicle network intrusion detection method based on evidence-based deep learning, a vehicle electronic and electrical fault diagnosis method based on evidence-based deep learning, and a comprehensive vehicle electronic and electrical security detection system.

[0006] To achieve the above objectives, the present invention provides the following technical solution: An evidence deep learning model for uncertainty classification includes: The feature input layer receives the input feature vector, which is the information entropy H of the vehicle CAN network message sequence. ID ; The evidence reasoning layer, connected to the feature input layer, contains model parameters θ, which are used to map the input feature vector to basic probability assignments for K categories; The uncertainty calculation layer, connected to the evidence reasoning layer, is used to calculate the uncertainty measure U(H) based on the basic probability assignment. ID ), U(H ID ) = 1 - max(m(A)), where A is the focus element, m(A) is the basic probability assignment, and max(m(A)) is the maximum basic probability assignment value; The decision output layer, connected to the evidence reasoning layer and the uncertainty calculation layer, is used to output classification results; Loss function L during model training entropy The loss function representation L during the validation phase cal They are respectively: ; ; ; In the formula, f(·;θ) is the evidence function of the multilayer perceptron; α is the preset coefficient; β is the optimal annealing factor; N acc_det (β') represents the number of samples correctly classified by the model on the validation set when using the candidate factor β' with uncertainty below a preset annealing threshold; N total To verify the total number of samples; argmax(·) represents maximizing the solution.

[0007] As a further optimization of the above technical solution: the value of the optimal annealing factor β is determined by performing a grid search on the candidate factor β' on the validation set, with a search interval of [0.1, 2.0] and a search step size of 0.1.

[0008] A training method for an evidence-based deep learning model includes the following training steps: S1. Obtain the vehicle CAN network message sequence dataset labeled with network status categories, and divide it into training set and validation set; S2. Calculate the information entropy of each message sequence in the dataset and use the information entropy as the input feature vector; S3. Input the input feature vector into the evidence deep learning model, sequentially through: The feature input layer receives the input feature vector; The evidence reasoning layer maps the input feature vector to basic probability assignments for K network state categories; The uncertainty calculation module calculates the uncertainty measure based on the basic probability assignment and feeds the basic probability assignment and uncertainty measure back to the training process. S4. Using the training set, through L... entropy The model is initially trained; then, a validation set is used, through L... cal The initially trained model is optimized to obtain the optimal model parameters and determine the optimal model.

[0009] A vehicle network intrusion detection method based on evidence-based deep learning includes the following detection steps: The system collects vehicle CAN network message sequences in real time and divides them into preset time windows; it calculates the information entropy of the message sequence within each time window and uses it as the network intrusion feature vector within the current time window. Input the network intrusion feature vector into the evidence deep learning model, or input it into the evidence deep learning model trained by the training method of the evidence deep learning model; The network intrusion is determined when the classification results output by the evidence deep learning model and its corresponding uncertainty measure are higher than the set measurement threshold and the peak-to-valley difference of the uncertainty measure exceeds the set dynamic change threshold.

[0010] As a further optimization of the above technical solution: the measurement threshold is 0.3, and the dynamic change threshold is twice the standard deviation of the uncertainty measurement of the previous B consecutive time windows of the current time window; When the uncertainty measure is less than or equal to 0.3, the network intrusion type is determined directly based on the classification results.

[0011] A method for diagnosing vehicle electronic and electrical faults based on evidence-based deep learning includes the following judgment steps: The runtime current signal of the vehicle's electronic and electrical system is acquired in real time and detrended to obtain a residual current signal sequence; at the same time, continuous wavelet transform is performed on the runtime current signal to extract local frequency domain feature coefficients. Calculate the dynamic time warping distance (DTW) between residual current signal sequences; simultaneously, receive the optimal annealing factor during the detection process of the whole vehicle network intrusion detection method; Based on the optimal annealing factor, the benchmark discrimination threshold T base Perform calibration to obtain the current dynamic discrimination threshold T. new =T base ×β; when T new When the value is greater than DTW, the anomaly determination of the local frequency domain characteristic coefficients confirms that a physical fault has occurred in the vehicle's electronic and electrical system.

[0012] As a further optimization of the above technical solution: the runtime current signal is detrended using a Savitzky-Golay filter, and the trend estimate of the runtime current signal at time t is calculated. At the same time Calculate the residual current signal sequence; r(t) is the residual current signal at time t; x actual (t) represents the runtime current signal actually collected at time t.

[0013] As a further optimization of the above technical solution, the calculation formula for Dynamic Time Warped Distance (DTW) is as follows: ; In the formula, r1 and r2 are two residual current signal sequences to be compared; r1(i) represents the value of r1 at time i, and r2(j) represents the value of r2 at time j; π is an optimal curved path that constrains the length of the residual current signal sequence with a Sakoe-Chiba bandwidth of ±10%, and consists of a series of pairs (i,j), representing the rule for matching corresponding points of the two sequences; d(r1(i),r2(j)) is the Euclidean distance between r1(i) and r2(j); min is the minimum value of π for all of them; DTW(r1,r2) is the dynamic time warping distance between r1 and r2.

[0014] As a further optimization of the above technical solution: after determining that a physical fault has occurred in the vehicle's electronic and electrical system, a probability distribution of the fault type is output through a neural network; The probability threshold is set at 0.7; If the probability value of the fault type corresponding to the maximum probability value in the probability distribution is greater than or equal to 0.7, then output the fault type. If the maximum probability value is less than 0.7, an uncertainty warning will be output.

[0015] A comprehensive vehicle electronic and electrical safety testing system, comprising: The data acquisition unit is used to synchronously acquire the vehicle CAN network message sequence and the operating signals of the vehicle's electronic and electrical systems, ensuring that the sampling synchronization error is <10ms; The signal enhancement and feature extraction unit is used to perform time-domain smoothing and frequency-domain logarithmic enhancement processing on the operating signal, and to calculate the information entropy H corresponding to the message sequence of the vehicle CAN network. ID The system performs continuous wavelet transform on the running signal to extract local frequency domain feature coefficients, and calculates the residual current signal sequence and dynamic time warp distance (DTW) through Savitzky-Golay filter. The network intrusion detection unit is used to execute the whole vehicle network intrusion detection method, output the intrusion judgment result, uncertainty measure and optimal annealing factor β, and simultaneously receive feature data fed back by the physical fault judgment unit to optimize the basic probability allocation and uncertainty estimation. The physical fault diagnosis unit is used in the vehicle's electronic and electrical fault diagnosis method. It receives the operating signals from the data acquisition unit, the local frequency domain characteristic coefficients from the signal enhancement and feature extraction unit, the residual current signal sequence, and the dynamic time warping distance. It also receives the optimal annealing factor β from the network intrusion detection unit to calibrate the dynamic discrimination threshold T. new The network uses a neural network to output and identify the probability distribution of fault types, and feeds back the local frequency domain feature coefficients and the validity of the residual signal to the network intrusion detection unit. The result fusion unit is used to fuse the output results of the network intrusion detection unit and the physical fault judgment unit through a weighted voting mechanism to generate a final detection report that includes anomaly type, subclass, occurrence time window, confidence level, location estimation and maintenance suggestions. The network intrusion detection unit is connected to the physical fault judgment unit to achieve bidirectional closed-loop coordination of optimal annealing factor β transmission and feature data feedback.

[0016] Compared with the prior art, the beneficial effects of the present invention are: 1. For the network security detection scenario of vehicle CAN, the evidence deep learning model of this invention first explicitly limits the input feature to the information entropy H of the vehicle CAN message sequence. ID This approach precisely focuses on the core characteristics of network intrusions, avoiding the problem of insufficient detection specificity caused by the generalization of model input features, and significantly improving the sensitivity of identifying anomalies in vehicle networks. Next, it clearly defines the uncertainty metric calculation method, achieving standardization and precise quantification of classification confidence, solving the problems of ambiguous uncertainty metric logic and inconsistent results, and providing a reliable basis for subsequent decision-making. Finally, it incorporates a two-stage loss function with a dynamically optimized annealing factor β, which can adaptively adjust the uncertainty penalty weight according to the complex operating conditions of vehicles, effectively suppressing uncertainty interference, significantly improving the model's classification accuracy and robustness in complex environments, and ultimately achieving accurate classification of vehicle network anomalies.

[0017] 2. This invention uses a grid search on the validation set to determine the optimal β. Compared to existing technologies that use fixed annealing factors or lack standard search logic, this approach fully utilizes the characteristics of the validation set data, ensuring a high degree of matching between β and the distribution of in-vehicle data. This avoids the drawback of fixed parameters being difficult to adapt to complex operating conditions. Furthermore, by determining β with the goal of maximizing the proportion of samples that are correctly classified and whose uncertainty is below a threshold, a dynamic balance between classification accuracy and uncertainty suppression can be achieved. This further enhances the generalization ability and classification stability of the evidence deep learning model in in-vehicle scenarios, providing key parameter support for the efficient operation of the evidence deep learning model.

[0018] 3. This invention uses the information entropy of the vehicle CAN message sequence as the core intrusion feature, continuing the scenario-specific advantages of the evidence deep learning model. It can accurately capture message distribution anomalies caused by network intrusions, improving the sensitivity of intrusion identification. It adopts a dual judgment logic of "uncertainty measurement threshold + peak-valley difference dynamic threshold". It not only filters high-confidence classification results through fixed measurement thresholds, but also uses the time-series fluctuation characteristics of uncertainty reflected by peak-valley difference to effectively distinguish between normal signal fluctuations and anomalies caused by network intrusions, significantly reducing the false alarm rate under complex vehicle operating conditions. At the same time, it directly reuses the evidence deep learning model and training results, ensuring the coherence of the technical route and the stability of detection accuracy. Ultimately, it achieves accurate identification and type determination of various network intrusions, providing efficient and reliable intrusion protection support for the electronic and electrical security of the whole vehicle.

[0019] 4. The vehicle electronic and electrical fault judgment method in this invention firstly performs detrending processing and continuous wavelet transform on the runtime current signal simultaneously. This not only removes normal trend interference and focuses on abnormal fluctuations through the residual current signal sequence, but also captures spectral anomalies caused by faults using local frequency domain feature coefficients, forming a dual fault representation of "time domain residual + frequency domain feature". This overcomes the deficiency of single features in distinguishing between electromagnetic interference and real physical faults, significantly improving the identification accuracy of fault features. Next, the optimal annealing factor β output by the network intrusion detection method is received, and the baseline discrimination threshold T is adjusted accordingly. base Dynamic calibration enables the fault judgment threshold to adaptively adjust with changes in vehicle operating conditions, effectively solving the problems of poor adaptability and high false alarm rate of fixed thresholds under complex operating conditions. At the same time, the dual judgment logic of "dynamic threshold and local frequency domain feature anomaly" further enhances the accuracy of fault judgment, avoids misjudgment that may be caused by single distance judgment, and ensures accurate identification of physical faults such as short circuits, arcing, and component degradation. Finally, it forms a closed-loop collaboration with the network intrusion detection module, which not only reuses the key parameters of the previous detection, but also ensures the targeting of physical fault detection through dedicated fault feature extraction logic. This provides reliable fault judgment support for the comprehensive vehicle electronic and electrical safety testing system and greatly meets the needs of practical engineering applications. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the evidence deep learning structure in this invention.

[0021] Figure 2 This is a flowchart of the dual-module closed-loop collaborative comprehensive detection method in this invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] like Figure 1 and Figure 2 As shown, this invention achieves accurate and comprehensive detection of vehicle electronic and electrical physical faults and network intrusions through "evidence deep learning + dual-module closed-loop collaboration," specifically as follows: The vehicle's CAN network message sequence and electronic and electrical operating signals are synchronously acquired and strictly time-aligned (synchronization error <10ms). After time-domain smoothing and frequency-domain logarithmic enhancement processing, network intrusion features (message sequence information entropy H) are extracted in parallel. ID The system integrates physical fault characteristics (continuous wavelet transform local frequency domain coefficients, residual current signals, and DTW with constrained Sakoe-Chiba bandwidth); it trains and infers based on an evidence-based deep learning model (including feature input, evidence reasoning, uncertainty calculation, and decision output layers), and achieves bidirectional collaboration between the network intrusion detection unit and the physical fault judgment unit through dynamically optimized optimal annealing factor β (β calibrates the fault detection threshold, and fault feature feedback optimizes the intrusion detection uncertainty estimation); finally, the outputs of the two units are fused by weighted voting to generate a detection report containing anomaly type, subclass, occurrence time, confidence level, location, and maintenance suggestions. This solves the pain point of existing technologies being unable to distinguish between two types of anomalies, achieving a low false alarm rate of 1.8% and a high type discrimination accuracy of 96.5%.

[0024] I. Preparations for Implementation

[0025] (I) Hardware Platform Setup

[0026] 1. Real vehicle testing platform

[0027] The vehicle is equipped with a complete vehicle electronic and electrical system (engine control ECU, body control BCM, chassis control MCU, etc.) and a CAN2.0 bus network. Fault simulation points are set at A (engine compartment wiring harness node), B (body control module interface), and C (chassis CAN bus branch). It supports physical fault simulation (short circuit: simulated resistance ≤5Ω; arc: voltage breakdown threshold ≥200V; component degradation: capacitor capacity decay 30%, resistor value drift 20%) and network intrusion injection (DoS attack: message transmission frequency 1000 frames / second; Fuzzy attack: message data segment random disturbance ±5%; Gear spoofing attack: forged gear signal; RPM spoofing attack: tampering with speed message).

[0028] 2. Data Acquisition System

[0029] Physical signal acquisition module: High-precision current / voltage sensor (model: ACS712 / ADS1256) is selected, with a sampling rate of 1kHz and an accuracy of ±0.01A / ±0.01V, to synchronously acquire the runtime current signal x(t) and voltage signal of each fault simulation point.

[0030] CAN message acquisition module: It adopts a CAN bus analyzer (model: CANoe 11.0 matching hardware), with a sampling rate of 500kbps, supports real-time message parsing and storage, and achieves time alignment with the physical signal acquisition module through a synchronous trigger circuit. The sampling synchronization error is ≤8ms (meeting the requirement of <10ms).

[0031] Data processing unit: Equipped with an Intel Core i7-12700H processor, 32GB DDR5 memory, and 1TB NVMe SSD, it supports real-time signal processing, model inference, and data storage. The processing time for a single time window is ≤50ms, meeting the real-time requirements of engineering.

[0032] (II) Software Environment Configuration

[0033] Programming languages ​​and core frameworks: Python 3.7, PyTorch 1.11.0 (for training and inference of evidence-based deep learning models).

[0034] Auxiliary tool libraries: NumPy 1.21.6 (numerical computation), SciPy 1.7.3 (signal processing, FFT transform, continuous wavelet transform), PyCAN 4.0.0 (CAN message parsing and acquisition), Wavelets 1.4.1 (continuous wavelet transform implementation), Scikit-learn 1.0.2 (dataset partitioning, model evaluation), Matplotlib 3.5.3 (result visualization).

[0035] Operating system: Ubuntu 20.04 LTS (real vehicle data acquisition and real-time processing), Windows 10 (model training and simulation verification).

[0036] (III) Dataset Construction and Preprocessing

[0037] 1. Data Source

[0038] Simulated data: Physical fault data is generated through fault simulation points A / B / C, and network intrusion data is generated through CAN intrusion injection tools, covering scenarios with different fault intensities and intrusion frequencies.

[0039] Real-world data: Collected from real-vehicle road tests, covering normal operation data and natural fault data under complex mixed conditions such as urban congestion, highway driving, hill driving, low temperature start (-10℃), and high temperature idling (45℃).

[0040] 2. Data partitioning and labeling

[0041] The hybrid dataset (simulated data + real data) is divided into training, validation, and test sets in a 6:3:1 ratio, with a total of 12,000 samples. Each sample set contains time window data of "current signal + voltage signal + CAN network message sequence". Each sample set is labeled with network status category (normal, DoS attack, Fuzzy attack, Gear spoofing attack, RPMspoofing attack), physical fault category (short circuit, arc, component degradation) or no abnormality label, with a labeling accuracy of 100%.

[0042] Time window division: When the vehicle speed is ≤30km / h, the time window length is 2 seconds; when the vehicle speed is 30km / h < vehicle speed ≤100km / h, the time window length is 1 second; when the vehicle speed is >100km / h, the time window length is 0.5 seconds, to ensure that the electrical signals and CAN messages are strictly aligned on the time axis.

[0043] II. Synchronous Data Collection

[0044] Start the data acquisition unit to synchronously acquire the vehicle CAN network message sequence and the operating signals (current x(t) and voltage signals) of the vehicle's electronic and electrical systems. During the acquisition process, the clock of the acquisition device is calibrated through the time module to ensure that the sampling synchronization error between the two is ≤10ms.

[0045] The collected raw data is divided into sequences according to preset time windows. The dataset in each time window contains "current signals of 2 seconds / 1 second / 0.5 seconds + voltage signals of corresponding duration + CAN network message sequences of corresponding duration". Each time window is assigned a unique identifier (including acquisition time, vehicle speed, and operating condition label) to provide a precise time basis for subsequent feature association and closed-loop collaboration.

[0046] III. Signal Enhancement

[0047] This section enhances the collected electronic and electrical operating signals, suppressing noise interference and highlighting potential abnormal fluctuations.

[0048] (a) Temporal smoothing

[0049] The original current signal x(t) is smoothed in the time domain by iterative filtering to obtain the enhanced signal x at the current time t. enhanced (t), the precise calculation formula is: ; In the formula, x(t) is the original current sample value at the current time t, x(t-1) is the current enhancement value at the previous time, ε is the smoothing coefficient (typically 0.7, used to control historical weights), γ is the median filter weight (typically 0.3, used to remove impulse noise), and median_filter( ) is a median filter with a window size of 5, used to remove impulse noise.

[0050] (ii) Frequency Domain Logarithmic Enhancement

[0051] For the time-domain enhanced signal x enhanced (t) Perform logarithmic enhancement in the frequency domain to obtain the enhanced frequency domain signal X. enhanced (k) further highlights the spectral anomalies, and the precise calculation formula is: ; In the formula, FFT(·) is the Fast Fourier Transform (the window length is the same as the time window). k is the discrete frequency domain index, 0 ≤ k ≤ M / 2, and M is the number of sampling points. |·| 2 This represents the power spectral density. It is a small positive constant (typically 1e-6, to prevent underflow in the logarithm field).

[0052] Finally, the precisely enhanced frequency domain signal X is obtained. enhanced (k) is used to highlight specific frequency anomalies caused by electromagnetic interference.

[0053] IV. Parallel Feature Extraction

[0054] This section extracts network intrusion features and physical fault features in parallel from enhanced signals and CAN messages.

[0055] (a) Extracting network intrusion characteristics

[0056] Extracting the information entropy H of the vehicle CAN network message sequence ID The calculation process is as follows: 1. Probability of occurrence The probability P(id) of a message sequence with ID id occurring within a unit time window is calculated as follows: ; In the formula, N(id) is the count of the message sequence ID id within the current time window. total This represents the total number of message sequences within the current time window. λ is the Laplace smoothing factor (typically 1 to avoid zero probability). |ID set | is the size of the unique ID set within the current time window (typically 8~12 in this embodiment).

[0057] 2. Weighted self-information

[0058] Calculate the weighted self-information of the message sequence ID: ; In the formula, I(id) is the weighted self-information of the message sequence with ID id within the current time window. Log2 is a logarithmic function with base 2, and log2 is used to precisely quantify uncertainty in information-theoretic bit units.

[0059] 3. Information Entropy

[0060] Calculate the information entropy H of the message sequence within the current time window. ID : ; H ID The higher the value, the greater the uncertainty of the message sequence and the higher the probability of intrusion. Therefore, it is used as the core feature vector for network intrusion judgment.

[0061] (II) Physical Fault Feature Extraction

[0062] The parallel extraction of three types of features—"continuous wavelet transform local frequency domain features + residual current signal + dynamic time warped distance (DTW)"—is performed as follows: 1. Extracting continuous wavelet transform features For enhanced frequency domain signal X enhanced (k) Perform continuous wavelet transform, the exact formula is: ; In the formula, a>0 is the scaling parameter (corresponding to frequency 1 / a), b is the translation parameter, and W(a,b) are the local frequency domain characteristic coefficients. ψ To select the complex conjugate of the mother wavelet (such as Morlet), the integral is computed using discrete numerical methods (sampling rate matching).

[0063] 2. Calculate the residual current signal

[0064] The runtime current signal is detrended using a Savitzky-Golay filter (window size 15-31 points), and the trend estimate at time t is calculated. The residual current signal sequence is calculated using the following formula: ; In the formula, r(t) is the residual current signal at time t; x actual (t) represents the runtime current signal actually collected at time t.

[0065] 3. Calculate the dynamic time warp distance

[0066] The residual current signal sequence under normal operating conditions is selected as the reference sequence r1, and the residual sequence of the current time window is selected as the sequence to be detected r2. The dynamic time warping distance is calculated according to the following formula: ; In the formula, r1(i) represents the value of r1 at time i, and r2(j) represents the value of r2 at time j. π is an optimal curved path, constraining the length of the residual current signal sequence with a Sakoe-Chiba bandwidth of ±10%, consisting of a series of pairs (i,j), representing the rule for matching corresponding points of two sequences. d(r1(i),r2(j)) is the Euclidean distance between r1(i) and r2(j). min is the minimum value of π over all iterations. DTW(r1,r2) is the dynamic time warping distance between r1 and r2.

[0067] V. Evidence-based Deep Learning Model

[0068] This section performs network intrusion detection and uncertainty calibration based on an evidence-based deep learning model.

[0069] (I) Model Structure and Parameter Settings

[0070] 1. Model Structure

[0071] Feature input layer: Receives H ID As input feature vectors.

[0072] Evidence reasoning layer: a three-layer fully connected perceptron with 64, 32, and K neurons respectively (K=5, corresponding to the "normal + 4 intrusion" categories). The model parameters θ (weight matrix, bias vector) are initialized using a He normal distribution. ID The mapping is a basic probability assignment m to K categories.

[0073] Uncertainty calculation layer: according to formula U(H) ID The uncertainty measure is calculated as 1 - max(m(A)), where A is the focal element and max(m(A)) is the maximum basic probability assignment.

[0074] Decision output layer: Outputs classification results (network state category) and corresponding confidence scores (max(m(A))).

[0075] 2. Key parameters

[0076] The preset coefficient α = 0.7, and the annealing threshold = 0.1 (samples in the validation set with uncertainty below this value are considered "determined classification samples"). The optimal annealing factor β is determined by grid search on the validation set (search interval [0.1, 2.0], step size 0.1). The percentage of correctly classified samples with uncertainty < 0.1 corresponding to each candidate annealing factor β' is calculated, and the β' corresponding to the maximum value is taken as the optimal value. In this embodiment, the optimal β = 1.2.

[0077] The measurement threshold is 0.3, the dynamic threshold is 2σ, where σ is the standard deviation of the uncertainty measure of the previous B consecutive time windows of the current time window, and B = 100.

[0078] (II) Model Training

[0079] Complete the model training by following these steps: 1. Obtain the vehicle CAN network message sequence dataset labeled with network status categories, and divide it into training set, validation set, and test set in a 6:3:1 ratio.

[0080] 2. For each message sequence, calculate the information entropy H according to the "Extracting Network Intrusion Features" step described above. ID , as the input feature vector.

[0081] 3. H ID The input evidence deep learning model passes through a feature input layer, an evidence reasoning layer, and an uncertainty calculation layer in sequence, and outputs a basic probability assignment m and an uncertainty measure U(H). ID ), and feed it back into the training process.

[0082] 4. Initial Training (Training Set): Using loss function L entropy To optimize the objective, the Adam optimizer (learning rate 1e-3), batch size 32, and 100 iterations are used, stopping when the accuracy improvement is ≤0.1% for 10 consecutive iterations; training (validation set) optimization is performed using a loss function L. cal To optimize the objective, the model was trained for another 50 rounds, and the model with the highest accuracy on the validation set was selected as the optimal model.

[0083] Loss function L during model training entropy The loss function representation L during the validation phase cal They are respectively: ; ; ; In the formula, f(·;θ) is the evidence function of the multilayer perceptron; α is the preset coefficient; β is the optimal annealing factor; N acc_det (β') represents the number of samples correctly classified by the model on the validation set when using the candidate factor β' with uncertainty below a preset annealing threshold; N total To verify the total number of samples; argmax(·) represents maximizing the solution.

[0084] (III) Intrusion Detection

[0085] 1. Set the H of the current time window ID Input the optimal model, output the classification result and uncertainty measure U(H) ID ).

[0086] 2. Judgment Logic: If U(H) ID )>0.3, and the peak-to-valley difference of the uncertainty measure (current U(H)) ID If the absolute value of the difference between the U mean and the mean of the most recent 10 time windows exceeds the dynamic threshold 2σ, a network intrusion is determined to have occurred.

[0087] If U(H) ID If the confidence level is ≤0.3, the network intrusion type (DoS attack, Fuzzy attack, etc.) can be determined directly based on the classification results, and the classification confidence level is ≥0.7.

[0088] 3. Output Results

[0089] Intrusion determination result (whether an intrusion occurred, type of intrusion), uncertainty measure U(H) ID The optimal annealing factor β is then passed to the physical fault judgment unit.

[0090] VI. Physical Fault Detection

[0091] This section is used to receive calibration parameters and physical fault characteristics, and to perform fault detection.

[0092] (a) Threshold calibration

[0093] Receive the optimal annealing factor β (β=1.2 in this embodiment) output above, and set the benchmark discrimination threshold T. base =5.0 (obtained through statistics from normal samples in the training set), calculate the dynamic discrimination threshold: T new =T base ×β=5.0×1.2=6.0.

[0094] (II) Preliminary Fault Assessment

[0095] When T newWhen DTW(r1,r2) is reached, the abnormality judgment of the local frequency domain characteristic coefficient W(a,b) is combined (if the amplitude of W(a,b) exceeds the 3σ range under normal operating conditions, it is judged as a characteristic abnormality), confirming that a physical fault has occurred in the vehicle's electronic and electrical system.

[0096] For example, in this embodiment, at a certain detection time, DTW=4.2<6.0, and the amplitude of W(a,b) exceeds 3σ, which is initially determined to be a physical fault.

[0097] (III) Fault Type Identification

[0098] The continuous wavelet transform feature coefficients W(a,b) and DTW are combined to form a feature vector (dimension 1×1024), which is then input into a neural network (3 hidden layers, 256, 128, and 64 neurons, with Sigmoid activation function).

[0099] The neural network outputs the probability distribution of fault types (short circuit, arc, component degradation), and sets the probability judgment threshold to 0.7.

[0100] If the probability of a certain fault type is ≥0.7, output the fault type (for example, in this embodiment, the probability of "arc fault" is 0.82, so output arc fault); if the maximum probability is <0.7, output an uncertainty warning.

[0101] Output results: Fault determination results (whether it is a fault, fault type), confidence level, local frequency domain feature coefficients and residual signal validity. At the same time, the feature data is fed back to the evidence deep learning model to optimize the basic probability allocation and uncertainty estimation.

[0102] VII. Results Integration and Final Output

[0103] This section achieves the fusion of outputs from both the physical fault detection module and the network intrusion detection module through a result fusion unit.

[0104] 1. Weighted voting fusion

[0105] A weighted voting mechanism is adopted, and the weights are dynamically adjusted with β (the larger β is, the higher the weight of the network intrusion detection unit and the lower the weight of the physical fault judgment unit). In this embodiment, β=1.2, the weight of the intrusion detection unit is 0.55, and the weight of the fault judgment unit is 0.45.

[0106] 2. Generate the final test report

[0107] The report includes the anomaly type (physical fault / network intrusion), sub-category (such as arc fault, fuzzy attack), occurrence time window (collection time corresponding to the unique identifier), confidence level (≥0.7), location estimation (fault simulation point A / B / C or CAN bus node), and maintenance suggestions (such as "check the line insulation of fault point A" and "investigate the CAN bus intrusion injection port").

[0108] 3. Report output: The report can be output in two ways: through display on the vehicle's central control screen and through transmission to the background management system via CAN bus, to meet the needs of real-time early warning and subsequent data analysis.

[0109] VIII. Performance Verification

[0110] (I) Design of comparative experiments

[0111] Three experimental groups were set up to verify the technical effects of the present invention: Experimental Group 1: Only the physical fault detection module is run to realize the method of judging electronic and electrical faults in the whole vehicle.

[0112] Experimental Group 2: Only the network intrusion detection module is run to implement the whole vehicle network intrusion detection method.

[0113] Experiment Group 3: Simultaneously run both the physical fault detection module and the network intrusion detection module to realize a complete integrated detection method.

[0114] (II) Test Results

[0115] 1200 multi-condition tests were conducted, and the average value was taken as the test result, as shown in Table 1.

[0116] Table 1 Test Results

[0117] Based on the preceding text and the data in Table 1, we can conclude that: The optimal annealing factor β output by the evidence deep learning model dynamically optimizes the DTW threshold and residual analysis criteria of the physical fault detection module, thereby increasing the accuracy of physical fault detection from 92.8% to 98.2%, an improvement of 5.4%.

[0118] The local frequency domain feature coefficients and residual signal validity extracted by the physical fault detection module are fed back to the evidence reasoning layer of the evidence deep learning model, enriching the distribution dimension of the basic probability assignment m, enhancing the robustness to false faults, and improving the intrusion detection F1 Score from 0.912 to 0.994, an improvement of 0.082.

[0119] The two modules work together in a two-way collaborative manner to form a closed loop, solving the technical problem that existing technologies cannot distinguish between physical faults and network intrusions, and achieving accurate type differentiation.

[0120] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A deep learning model for evidence classification of uncertainty, characterized in that, include: The feature input layer receives the input feature vector, which is the information entropy H of the vehicle CAN network message sequence. ID ; The evidence reasoning layer, connected to the feature input layer, contains model parameters θ, which are used to map the input feature vector to basic probability assignments for K categories; The uncertainty calculation layer, connected to the evidence reasoning layer, is used to calculate the uncertainty measure U(H) based on the basic probability assignment. ID ), U(H ID ) = 1 - max(m(A)), where A is the focus element, m(A) is the basic probability assignment, and max(m(A)) is the maximum basic probability assignment value; The decision output layer, connected to the evidence reasoning layer and the uncertainty calculation layer, is used to output classification results; Loss function L during model training entropy The loss function representation L during the validation phase cal They are respectively: ； ； ； In the formula, f(·;θ) is the evidence function of the multilayer perceptron; α is the preset coefficient; β is the optimal annealing factor; N acc_det (β') represents the number of samples correctly classified by the model on the validation set when using the candidate factor β' with uncertainty below a preset annealing threshold; N total To verify the total number of samples; argmax(·) represents maximizing the solution.

2. The evidence deep learning model for uncertainty classification according to claim 1, characterized in that, The optimal annealing factor β is determined by performing a grid search on the candidate factor β' on the validation set, with a search interval of [0.1, 2.0] and a search step size of 0.

1.

3. A training method for an evidence-based deep learning model, characterized in that, The training steps include the following: S1. Obtain the vehicle CAN network message sequence dataset labeled with network status categories, and divide it into training set and validation set; S2. Calculate the information entropy of each message sequence in the dataset and use the information entropy as the input feature vector; S3. Input the input feature vector into the evidence deep learning model for uncertainty classification as described in claim 1 or 2, sequentially via: The feature input layer receives the input feature vector; The evidence reasoning layer maps the input feature vector to basic probability assignments for K network state categories; The uncertainty calculation module calculates the uncertainty measure based on the basic probability assignment and feeds the basic probability assignment and uncertainty measure back to the training process. S4. Using the training set, through L... entropy Perform initial training on the model; Then, using the validation set, through L cal The initially trained model is optimized to obtain the optimal model parameters and determine the optimal model.

4. A vehicle network intrusion detection method based on evidence-based deep learning, characterized in that, The following testing steps are included: The system collects vehicle CAN network message sequences in real time and divides them into preset time windows; it calculates the information entropy of the message sequence within each time window and uses it as the network intrusion feature vector within the current time window. The network intrusion feature vector is input into the evidence deep learning model for uncertainty classification as described in claim 1 or 2, or into the evidence deep learning model trained by the training method of the evidence deep learning model as described in claim 3. The network intrusion is determined when the classification results output by the evidence deep learning model and its corresponding uncertainty measure are higher than the set measurement threshold and the peak-to-valley difference of the uncertainty measure exceeds the set dynamic change threshold.

5. The whole vehicle network intrusion detection method based on evidence deep learning according to claim 4, characterized in that, The measurement threshold is 0.3, and the dynamic threshold is twice the standard deviation of the uncertainty measurement of the previous B consecutive time windows of the current time window; When the uncertainty measure is less than or equal to 0.3, the network intrusion type is determined directly based on the classification results.

6. A method for diagnosing vehicle electronic and electrical faults based on evidence-based deep learning, characterized in that, The following judgment steps are included: The runtime current signal of the vehicle's electronic and electrical system is acquired in real time and detrended to obtain a residual current signal sequence; at the same time, continuous wavelet transform is performed on the runtime current signal to extract local frequency domain feature coefficients. Calculate the dynamic time warping distance (DTW) between residual current signal sequences; simultaneously, receive the optimal annealing factor during the detection process of the whole vehicle network intrusion detection method based on evidence deep learning as described in claim 4 or 5. Based on the optimal annealing factor, the benchmark discrimination threshold T base Perform calibration to obtain the current dynamic discrimination threshold T. new =T base ×β; when T new When the value is greater than DTW, the anomaly determination of the local frequency domain characteristic coefficients confirms that a physical fault has occurred in the vehicle's electronic and electrical system.

7. The method for determining vehicle electronic and electrical faults based on evidence-based deep learning according to claim 6, characterized in that, The runtime current signal is detrended using a Savitzky-Golay filter, and the trend estimate of the runtime current signal at time t is calculated. At the same time Calculate the residual current signal sequence; r(t) is the residual current signal at time t; x actual (t) represents the runtime current signal actually collected at time t.

8. The method for determining vehicle electronic and electrical faults based on evidence-based deep learning according to claim 7, characterized in that, The formula for calculating the Dynamic Time Warped Distance (DTW) is as follows: ； In the formula, r1 and r2 are two residual current signal sequences to be compared; r1(i) represents the value of r1 at time i, and r2(j) represents the value of r2 at time j; π is an optimal curved path that constrains the length of the residual current signal sequence with a Sakoe-Chiba bandwidth of ±10%, and consists of a series of pairs (i,j), representing the rule for matching corresponding points of the two sequences; d(r1(i),r2(j)) is the Euclidean distance between r1(i) and r2(j); min is the minimum value of π for all of them; DTW(r1,r2) is the dynamic time warping distance between r1 and r2.

9. The method for determining vehicle electronic and electrical faults based on evidence-based deep learning according to claim 8, characterized in that, After determining that a physical fault has occurred in the vehicle's electronic and electrical systems, a probability distribution of the fault type is output through a neural network; The probability threshold is set at 0.7; If the probability value of the fault type corresponding to the maximum probability value in the probability distribution is greater than or equal to 0.7, then output the fault type. If the maximum probability value is less than 0.7, an uncertainty warning will be output.

10. A comprehensive vehicle electronic and electrical safety testing system, characterized in that, include: The data acquisition unit is used to synchronously acquire the vehicle CAN network message sequence and the operating signals of the vehicle's electronic and electrical systems, ensuring that the sampling synchronization error is <10ms; The signal enhancement and feature extraction unit is used to perform time-domain smoothing and frequency-domain logarithmic enhancement processing on the operating signal, and to calculate the information entropy H corresponding to the message sequence of the vehicle CAN network. ID The system performs continuous wavelet transform on the running signal to extract local frequency domain feature coefficients, and calculates the residual current signal sequence and dynamic time warp distance (DTW) through Savitzky-Golay filter. The network intrusion detection unit is used to execute the whole vehicle network intrusion detection method based on evidence deep learning as described in claim 4 or 5, output the intrusion judgment result, uncertainty measure and optimal annealing factor β, and simultaneously receive feature data fed back by the physical fault judgment unit to optimize the basic probability allocation and uncertainty estimation. The physical fault judgment unit is used to execute the vehicle electronic and electrical fault judgment method based on evidence deep learning as described in any one of claims 6-9. It receives the operating signal from the data acquisition unit, the local frequency domain feature coefficients from the signal enhancement and feature extraction unit, the residual current signal sequence, and the dynamic time warping distance. It also receives the optimal annealing factor β transmitted by the network intrusion detection unit to calibrate the dynamic discrimination threshold T. new The network uses a neural network to output and identify the probability distribution of fault types, and feeds back the local frequency domain feature coefficients and the validity of the residual signal to the network intrusion detection unit. The result fusion unit is used to fuse the output results of the network intrusion detection unit and the physical fault judgment unit through a weighted voting mechanism to generate a final detection report that includes anomaly type, subclass, occurrence time window, confidence level, location estimation and maintenance suggestions. The network intrusion detection unit is connected to the physical fault judgment unit to achieve bidirectional closed-loop coordination of optimal annealing factor β transmission and feature data feedback.

Images