Method for identifying abnormal behavior of commercial vehicle on-board terminal communication protocol

Abstract

This invention relates to the field of data processing technology, specifically to a method for identifying abnormal behavior in the communication protocol of a commercial vehicle in-vehicle terminal. The method includes: collecting raw uplink payload data streams and multi-dimensional vehicle operating status data from the in-vehicle terminal based on a unified timestamp within a preset time window; parsing the payload data stream into an ordered semantic token sequence and discretizing and encoding the operating status data to obtain a state feature vector; calculating and fusing the multi-dimensional communication payload entropy feature vector with the state feature vector to obtain a single-step hybrid feature vector; collecting multi-window data to form a temporal hybrid feature vector; inputting the temporal hybrid feature vector into a pre-trained temporal reconstruction network model; and determining abnormal behavior of the in-vehicle terminal based on a continuous window comparison between the reconstruction error and a judgment threshold. This invention improves the accuracy of identifying abnormal communication behavior of in-vehicle terminals.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method for identifying abnormal behavior of communication protocols for commercial vehicle in-vehicle terminals. Background Technology

[0002] Commercial vehicle on-board terminals serve as the communication hub for data interaction, remote control, and information services between vehicles and cloud platforms, undertaking critical functions such as reporting vehicle operating status and receiving dispatch instructions. With the deepening deployment of vehicle-to-everything (V2X) technology in logistics and fleet management, the cybersecurity threats faced by on-board terminals are becoming increasingly severe. Attackers can control on-board terminals through network penetration and firmware tampering, thereby forging or altering reported communication payload data, or executing unauthorized remote control commands, interfering with the normal operation and supervision of the fleet, and posing a threat to vehicle driving safety.

[0003] To address these security needs, the industry has proposed intrusion detection solutions based on communication data streams. Some solutions analyze the metadata characteristics of communication data packets and use statistical methods or traditional machine learning algorithms to establish a baseline model of normal behavior, detecting abnormal communication patterns that deviate from the baseline. However, these methods face the following difficulties in practical deployment: On the one hand, most existing solutions perform shallow statistical analysis of communication traffic, establishing a detection baseline only based on basic statistical characteristics such as message frequency and byte distribution. Attackers can evade detection by carefully constructing attack payloads to achieve malicious purposes while maintaining the basic statistical characteristics unchanged.

[0004] On the other hand, existing methods separate communication behavior from the actual operating state of the vehicle, failing to consider the inherent correlation between the two. A normal communication command when the vehicle is stationary may constitute abnormal behavior when the vehicle is traveling at high speed. This lack of contextual information leads to high false positives and high false negatives in detection models. Furthermore, many detection models only perform static analysis on communication data within a single time point or short window, failing to model the continuous changes in attack behavior over time and thus unable to identify complex and covert attacks that are implemented step by step through a series of seemingly normal steps. Summary of the Invention

[0005] To address the technical problems of existing communication anomaly detection methods that rely on shallow statistical features that are easily circumvented and fail to integrate vehicle operating status and temporal continuity, this invention provides an anomaly behavior identification method for commercial vehicle in-vehicle terminal communication protocols, including: Within a preset time window, the uplink communication raw payload data stream of the vehicle terminal and the real-time multi-dimensional vehicle operation status data of the commercial vehicle are collected based on a unified timestamp alignment. Based on a preset communication protocol syntax model, the uplink communication raw payload data stream is parsed and converted into an ordered semantic token sequence, while the multi-dimensional vehicle operation status data is discretized and encoded to generate a status feature vector. Entropy values ​​are calculated based on the unary frequency distribution of semantic tokens and the binary joint frequency distribution of adjacent semantic tokens to form a multidimensional communication payload entropy feature vector. The multidimensional communication payload entropy feature vector is fused with the state feature vector in series to form a single-step hybrid feature vector, and the single-step hybrid feature vectors of multiple consecutive time windows are collected to obtain a temporally sequenced hybrid feature vector. The temporal hybrid feature vector is input into a pre-trained temporal reconstruction network model used to represent the baseline pattern of normal behavior, and then transformed and decoded to obtain the reconstructed hybrid feature vector. The reconstruction error between the temporal hybrid feature vector and the reconstructed hybrid feature vector is calculated. When the reconstruction error exceeds the judgment threshold set based on the statistical analysis of historical normal operation data for a continuous preset number of time windows, it is determined that the vehicle terminal has abnormal behavior.

[0006] This invention parses the original uplink communication payload data stream into an ordered semantic token sequence and calculates a multi-dimensional communication payload entropy feature vector. This feature vector is then concatenated and fused with the state feature vector obtained from the discretized encoding of multi-dimensional vehicle operating status data of commercial vehicles to form a temporal hybrid feature vector. This vector is then transformed and decoded by a pre-trained temporal reconstruction network model, and abnormal behavior is determined based on a continuous window comparison between the reconstruction error and the judgment threshold. This allows anomaly identification to simultaneously utilize the deep statistical regularities of the communication payload and the contextual information of the vehicle's real-time operating conditions. Furthermore, by modeling temporal dependencies, it captures the behavioral pattern shifts of progressive covert attacks, thereby reducing the false alarm rate and the false negative rate, and improving the accuracy and timeliness of identifying abnormal communication behavior of the vehicle terminal.

[0007] Preferably, the uplink communication raw payload data stream is parsed and converted into an ordered semantic token sequence based on a pre-defined communication protocol syntax model, including: A finite state machine parser based on the JT / T808 protocol is used to read the raw uplink communication payload data stream byte by byte, and extract the message ID field according to the frame header, message header, message body and check code structure defined by the protocol. The extracted message ID 0x0002 is mapped to a terminal heartbeat semantic token, the extracted message ID 0x0200 is mapped to a location information reporting semantic token, and the remaining extracted message IDs are uniformly mapped to general transaction semantic tokens. The semantic tokens are stored in a first-in-first-out queue according to the order of receipt, resulting in an ordered semantic token sequence.

[0008] A finite state machine parser based on the JT / T808 protocol is used to read the raw payload data stream of uplink communication byte by byte and extract the message ID field for semantic token mapping. This enables the protocol parsing process to strictly follow the frame structure definition for layer-by-layer decomposition, improving the accuracy of semantic token sequence extraction and protocol compatibility.

[0009] Preferably, the multi-dimensional vehicle operating state data is discretized and encoded to generate a state feature vector, including: Vehicle speed status is divided into five speed levels; The engine speed status is divided into four speed levels; Each state dimension after being classified into levels is converted into a binary vector using one-hot encoding. The binary vectors of all dimensions are then concatenated in a predetermined order to obtain the state feature vector.

[0010] Preferably, the calculation of the multidimensional communication payload entropy feature vector includes: When there is no communication payload data within the time window, the multidimensional communication payload entropy feature vector is assigned a preset constant value; When communication payload data exists within the time window, the univariate probability is estimated by statistically analyzing the occurrence frequency of each individual semantic token. For a pre-defined number of Reni entropy orders that are not equal to 1 Each of them, according to the expression Calculate the order of Raney entropy The corresponding first group of Reni entropy ; Statistical analysis of the frequency of occurrence of adjacent semantic token pairs to estimate the binary joint probability. For a pre-defined number of Reni entropy orders that are not equal to 1 Each of them, according to the expression Calculate the order of Raney entropy The corresponding second group of Reni entropy ; The first set of Reni entropy and the second set of Reni entropy are used to construct a multidimensional communication payload entropy feature vector.

[0011] The first set of Reni entropy representing the univariate frequency distribution of semantic tokens and the second set of Reni entropy representing the binary joint frequency distribution of adjacent semantic tokens are calculated separately and assigned to preset constants when there is no communication payload data. This allows the multidimensional communication payload entropy feature vector to not only represent the degree of disorder in the distribution of a single semantic token type, but also to capture the transition probability information between adjacent semantic tokens. This enables the identification of a temporal attack pattern implemented by an attacker by tampering with the order of semantic tokens while maintaining the frequency of a single semantic token unchanged.

[0012] Preferably, the multidimensional communication payload entropy feature vector and the state feature vector are concatenated and fused into a single-step hybrid feature vector, including: At the end of each time window, the calculated first set of Raney entropy, the second set of Raney entropy, and the state feature vector are concatenated in a fixed order to obtain the single-step mixed feature vector of the time window.

[0013] Preferably, the temporally sequenced mixed feature vector is obtained by aggregating single-step mixed feature vectors from multiple consecutive time windows, including: Stack the 10 single-step mixed feature vectors generated in the 10 most recent consecutive time windows in chronological order to form a 10-row array. The time series matrix of the column is used as the time-series hybrid feature vector, where The length of the single-step mixed feature vector provides input data containing the multi-window variation patterns for subsequent temporal reconstruction network models.

[0014] An autoencoder consisting of an encoder and a decoder is used as the temporal reconstruction network model. The encoder consists of two stacked long short-term memory network layers with 64 hidden units each, and the decoder consists of two stacked long short-term memory network layers with 64 hidden units each, plus a fully connected output layer. This enables the model to encode and reconstruct long-term dependencies in the input temporally mixed feature vectors, and it has a strong ability to identify slow, gradual abnormal behaviors.

[0015] Preferably, the temporal reconstruction network model is a long short-term memory network autoencoder, comprising: The encoder consists of two stacked long short-term memory network layers with 64 hidden units each, and the decoder consists of two stacked long short-term memory network layers with 64 hidden units each, plus a fully connected output layer. Long Short-Term Memory (LSTM) network autoencoders compress temporally mixed feature vectors into hidden states through an encoder, and then recover the original sequence from the hidden states through a decoder to obtain reconstructed mixed feature vectors.

[0016] The square of the difference between the input vector and the reconstructed vector is calculated element by element, and the arithmetic mean is taken as the reconstruction error. The degree of model reconstruction deviation is measured by a unified standard, which provides a judgment basis with a clear numerical scale for subsequent anomaly judgment.

[0017] Preferably, calculating the reconstruction error between the temporally sequenced mixed feature vector and the reconstructed mixed feature vector includes: For each time step and feature dimension of the temporally sequenced hybrid feature vector and the reconstructed hybrid feature vector, the square of the difference is calculated element by element. The arithmetic mean of the squares of the differences of all elements is then obtained, and the arithmetic mean is used as the reconstruction error.

[0018] The judgment threshold is set by the sum of the mean and three standard deviations of the reconstruction error distribution based on the normal behavior verification dataset. Abnormal behavior is only judged when the reconstruction error exceeds the judgment threshold for five consecutive time windows. This filters out instantaneous error spikes caused by data noise and improves the accuracy and anti-interference ability of anomaly judgment.

[0019] Preferably, the setting of the judgment threshold and the determination of the consecutive preset number include: A validation dataset containing only normal behavior is collected. The validation dataset is then input into a pre-trained temporal reconstruction network model to calculate the reconstruction error distribution, obtaining the mean and standard deviation of the reconstruction error distribution. The decision threshold is set as the sum of the mean and three times the standard deviation. The preset number of consecutive time windows is 5. When the reconstruction error calculated for 5 consecutive time windows is greater than the judgment threshold, the vehicle terminal is judged to have abnormal behavior and an alarm is generated.

[0020] Preferably, the five speed levels are arranged in ascending order of vehicle speed as follows: less than 20 km / h, greater than or equal to 20 km / h and less than 60 km / h, greater than or equal to 60 km / h and less than 100 km / h, greater than or equal to 100 km / h and less than or equal to 150 km / h, and an abnormal speed level exceeding 150 km / h; the four engine speed levels are arranged in ascending order of engine speed as follows: less than 800 r / min, greater than or equal to 800 r / min and less than 2000 r / min, greater than or equal to 2000 r / min and less than or equal to 4000 r / min, and an abnormal engine speed level exceeding 4000 r / min.

[0021] The technical solution of the present invention has the following beneficial technical effects: This invention parses the original uplink communication payload data stream into an ordered semantic token sequence based on a communication protocol syntax model. It then calculates the Reni entropy for both univariate and binary joint frequency distributions at multiple Reni entropy orders to construct a multidimensional communication payload entropy feature vector. This provides a complete characterization of the deep statistical structure of the communication payload, rather than merely remaining at the shallow message counting level. Furthermore, the multidimensional communication payload entropy feature vector is concatenated and fused with a discretized vehicle operating state feature vector. This allows for the identification of abnormal behavior based on cross-validation between communication semantics and vehicle operating conditions, effectively compensating for the contextual deficiencies caused by the separation of these two aspects.

[0022] Furthermore, the fused features from multiple consecutive time windows are aggregated to form a temporal hybrid feature vector, which is then input into a pre-trained temporal reconstruction network model for transformation and decoding reconstruction. The temporal dependencies and baseline patterns of normal behavior are thus deeply learned. Combined with a continuous window comparison and judgment mechanism based on reconstruction error and judgment threshold, instantaneous error spikes caused by data noise are filtered out. It has a high accuracy in identifying both known anomalies and unknown types of attacks, reducing false positive and false negative rates. Attached Figure Description

[0023] Figure 1 This is a flowchart of the abnormal behavior identification method of the commercial vehicle in-vehicle terminal communication protocol of the present invention; Figure 2 This is a comparison chart of the detection performance of the multimodal feature fusion and feature representation methods of this invention; Figure 3 This is a time-series variation diagram of reconstruction error during the abnormal behavior recognition process of this invention. Detailed Implementation

[0024] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0025] Reference Figure 1 The method for identifying abnormal behavior of the communication protocol of a commercial vehicle in-vehicle terminal includes steps S101 to S103, which are described in detail below.

[0026] S101, within a preset time window, collects the uplink communication raw payload data stream of the vehicle terminal and the real-time multi-dimensional vehicle operation status data of the commercial vehicle based on a unified timestamp alignment; based on a preset communication protocol syntax model, the uplink communication raw payload data stream is parsed and converted into an ordered semantic token sequence, and the multi-dimensional vehicle operation status data is discretized and encoded to generate a status feature vector.

[0027] A fixed-duration time window is set. In the JT / T808 protocol, the reporting cycle for terminal heartbeat and location information is typically on the order of seconds. In this embodiment, the time window duration is set to 1 second to match the protocol's minimum reporting interval. A network time protocol service is deployed to synchronize the data acquisition server and the vehicle-mounted terminal, ensuring consistent timestamps across all data sources. The acquisition server listens for and receives the uplink raw payload data stream sent by the vehicle-mounted terminal via TCP / IP sockets. Simultaneously, it reads and decodes multi-dimensional vehicle operating status data from the commercial vehicle via the CAN bus interface. This multi-dimensional vehicle operating status data includes vehicle speed and engine speed. At the end of each time window, the received uplink raw payload data stream and multi-dimensional vehicle operating status data are aggregated into two data blocks for subsequent processing.

[0028] Since the communication protocol of commercial vehicle onboard terminals transmits binary-encoded byte streams, it cannot be directly used for statistical analysis or feature extraction. Therefore, it is necessary to parse the raw byte stream into information units with clear semantics, i.e., semantic tokens, based on the grammatical structure of the communication protocol. In this embodiment, the parsing of the raw payload data stream of uplink communication is implemented using a protocol parser generated based on the grammatical model of the communication protocol. This parser converts the binary data stream within the time window into a series of parse trees, traverses the parse trees, extracts the identifier of each protocol field, and obtains a list of identifiers arranged in the original receiving order, i.e., an ordered semantic token sequence.

[0029] In an optional embodiment, the uplink communication raw payload data stream is parsed and converted into an ordered semantic token sequence based on a preset communication protocol syntax model. This includes: using a finite state machine parser built based on the JT / T808 protocol to read the uplink communication raw payload data stream byte by byte; extracting the message ID field according to the frame header, message header, message body, and checksum structure defined by the protocol; mapping the extracted 0x0002 message ID to a terminal heartbeat semantic token and mapping the extracted 0x0200 message ID to a location information reporting semantic token; and storing the semantic tokens in a first-in-first-out queue according to the order of receipt to obtain an ordered semantic token sequence.

[0030] The finite state machine parser initially waits for the frame header. The parser reads the raw uplink payload data byte-by-byte from a circular buffer. In this embodiment, the size of the circular buffer is 4096 bytes; in other embodiments, it can be adjusted between 2048 and 8192 bytes depending on the communication bandwidth. When the JT / T808 protocol identifier 0x7E is encountered, the finite state machine parser switches to parsing the message header and message body. The parser continuously reads subsequent bytes and processes escape characters: when 0x7D is followed by 0x02, the escape character is restored to 0x7E; when 0x7D is followed by 0x01, the escape character is restored to 0x7D. According to the JT / T808 protocol, the first and second bytes of the message header together constitute a 16-bit message ID. Taking a data frame with message ID 0x0002 as an example, after the parser recognizes the byte sequence [0x00, 0x02], it extracts the message ID 0x0002 and maps it to a terminal heartbeat semantic token. Taking a data frame with message ID 0x0200 as an example, after the parser recognizes the byte sequence [0x02, 0x00], it extracts the message ID 0x0200 and maps it to a location information reporting semantic token. For other message IDs besides 0x0002 and 0x0200, the parser uniformly maps them to general transaction semantic tokens to retain the placeholder information of non-core message types in the communication sequence and avoid deviations in the timing relationship of adjacent token pairs due to discarding. After the parser completes the verification and calculation of a frame of data and confirms the frame end 0x7E, it pushes the generated semantic token into a first-in-first-out queue. Considering the peak level of terminal message concurrency within a single time window, the maximum capacity of the first-in-first-out queue is 1024 elements, which corresponds to the upper limit of communication load under a second-level window. In scenarios with high communication link load, it can be adjusted within the range of 512 to 2048.

[0031] Simultaneously, the collected multidimensional vehicle operating status data is discretized and encoded to generate state feature vectors. Discretization encoding is the process of converting continuous vehicle operating status values ​​into a finite number of categories, enabling vehicle states under different operating conditions to participate in subsequent feature fusion in a standardized vector form.

[0032] In an optional embodiment, the multidimensional vehicle operating state data is discretized and encoded to generate a state feature vector, including: for the vehicle speed state, the vehicle speed state is divided into five speed levels; for the engine speed state, the engine speed state is divided into four speed levels; each state dimension after being divided into levels is converted into a binary vector using one-hot encoding; and the binary vectors of all dimensions are concatenated in a predetermined order to obtain the state feature vector.

[0033] The five speed levels, ordered from lowest to highest vehicle speed, are: less than 20 km / h, greater than or equal to 20 km / h and less than 60 km / h, greater than or equal to 60 km / h and less than 100 km / h, greater than or equal to 100 km / h and less than or equal to 150 km / h, and an abnormal speed level exceeding 150 km / h. The four engine speed levels, ordered from lowest to highest engine speed, are: less than 800 rpm, greater than or equal to 800 rpm and less than 2000 rpm, greater than or equal to 2000 rpm and less than or equal to 4000 rpm, and an abnormal engine speed level exceeding 4000 rpm.

[0034] Assuming a vehicle speed of 75 km / h and an engine speed of 1500 r / min, the vehicle speed is discretized. 75 km / h falls within the range of 60 to 100 km / h, which is the third speed level. The vehicle speed state is encoded as a 5-dimensional one-hot vector [0, 0, 1, 0, 0]. The engine speed is 1500 r / min, which falls within the range of 800 to 2000 r / min, which is the second speed level. The engine speed state is encoded as a 4-dimensional one-hot vector [0, 1, 0, 0]. Following a predetermined order of vehicle speed first, followed by engine speed, the two binary vectors are concatenated to generate the state feature vector for that moment. The state feature vector is a 9-dimensional vector [0, 0, 1, 0, 0, 0, 1, 0, 0], representing the current macroscopic operating condition of the vehicle.

[0035] S102, calculate the entropy value based on the unary frequency distribution of semantic tokens and the binary joint frequency distribution of adjacent semantic tokens to form a multidimensional communication load entropy feature vector; fused the multidimensional communication load entropy feature vector with the state feature vector into a single-step hybrid feature vector, and collected the single-step hybrid feature vectors of multiple consecutive time windows to obtain a temporal hybrid feature vector.

[0036] Raine entropy is a generalized form of Shannon entropy, defined by introducing an order parameter. The uncertainty of a probability distribution is measured from different perspectives. When When the entropy approaches 1, the Raney entropy degenerates into the Shannon entropy. When the entropy is large, the Raney entropy is more sensitive to high-probability events. When the value is smaller, it is more sensitive to low-probability events. A pre-defined Reni entropy order is used. array, We take values ​​of 0.5, 1.5, and 2.5 respectively. A value of 0.5 indicates greater sensitivity to abnormal fluctuations in low-probability semantic tokens. When the value is 2.5, the focus is on capturing the distribution offset of high-probability semantic tokens. Depending on the detection accuracy requirements, no less than two different order values ​​can be selected within the range of (0,5).

[0037] In an optional embodiment, the calculation of the multidimensional communication payload entropy feature vector includes: when there is no communication payload data within the time window, assigning the multidimensional communication payload entropy feature vector a preset constant; when there is communication payload data within the time window, estimating the univariate probability by statistically analyzing the occurrence frequency of each individual semantic token. For every Reni entropy order not equal to 1 Calculate the first group of Raney entropy using the following expression: ; In the formula, For the order of entropy of Reni The corresponding Reni entropy value; For the first The frequency of occurrence of a semantic token within a time window, i.e., its unary probability, is determined by the frequency of occurrence of the first semantic token in the ordered sequence of semantic tokens. The number of occurrences of a semantic token is divided by the total number of semantic tokens. Let be the order of the Reni entropy.

[0038] Statistical analysis of the frequency of occurrence of adjacent semantic token pairs to estimate the binary joint probability. For every Reni entropy order not equal to 1 Calculate the second group of Raney entropy using the following expression: ; In the formula, For semantic tokens With the semantic token Semantic tokens that appeared later The frequency of occurrence of adjacent token pairs within a time window, i.e., the binary joint probability, is determined by the frequency of occurrence of adjacent semantic token pairs in the ordered semantic token sequence. The number of occurrences is obtained by dividing the total number of adjacent semantic token pairs.

[0039] The first set of Reni entropy and the second set of Reni entropy are used to construct a multidimensional communication payload entropy feature vector.

[0040] It is worth noting that when When the value is 1, the denominator in the Reynolds entropy expression is zero. At this point, the Reynolds entropy is defined as the limiting value of the Shannon entropy, i.e. The example selected in this embodiment Since none of the values ​​are 1, the denominator in the above expression will not be zero during the calculation process. When there is no communication payload data within the time window, the probability distribution cannot be estimated. Therefore, each component of the multidimensional communication payload entropy feature vector is assigned a value of 0 to distinguish it from the non-zero entropy value under normal communication conditions.

[0041] We substitute a set of runtime data into the first set of Reni entropy expressions for verification. Assume that within a certain time window, 100 semantic tokens are extracted from an ordered semantic token sequence; the location information reporting semantic token appears 80 times, and the terminal heartbeat semantic token appears 20 times. The univariate probability distribution is... It is 0.8. It is 0.2. Take... Substituting 0.5 into the first set of Reni entropy expressions, Calculation results show that the univariate distribution uncertainty of the communication load within this window is... When the value is 0.5, it is 0.846 bits. (For...) For 1.5 and Repeat the calculation for 2.5 to obtain a 3-dimensional first set of Raney entropy vectors.

[0042] The second set of Raney entropy is verified. 100 semantic tokens generate 99 adjacent semantic token pairs. Assume that the adjacent semantic token pair (LR, LR) occurs 65 times, (LR, TH) occurs 15 times, and (TH, LR) occurs 19 times. The binary joint probability distribution is as follows: It is 65 / 99. It is 15 / 99. It is 19 / 99. Take... Substituting 0.5 into the second set of Reni entropy expressions, .right For 1.5 and Repeat the calculation for 2.5 to obtain the second set of 3-dimensional Reni entropy vectors.

[0043] The specific process of merging the multidimensional communication payload entropy feature vector and the state feature vector into a single-step hybrid feature vector includes: at the end of each time window, the calculated first set of Reni entropy, the second set of Reni entropy and the state feature vector are concatenated in a fixed order to obtain the single-step hybrid feature vector of the time window.

[0044] by Indicates time window The first set of Reni entropy vectors, with Indicates time window The second set of Rainier entropy vectors, with Indicates time window The state feature vector. It is 3D. It is 3D. It is 9-dimensional. According to... A fixed order is used to concatenate the three vectors to obtain a dimension. Single-step blending feature vector of value 15 .

[0045] For example, the method of aggregating single-step blended feature vectors from multiple consecutive time windows to obtain a temporally sequenced blended feature vector is as follows: stack the 10 single-step blended feature vectors generated in the most recent 10 consecutive time windows in chronological order to form a 10-row blended feature vector. The time series matrix of the column is used as the time-series hybrid feature vector. is the length of the single-step mixed feature vector.

[0046] Maintain a first-in, first-out queue of length 10 to store the latest single-step blended feature vectors. At the end of each time window, the newly generated single-step blended feature vectors are... Add it to the tail of the FIFO queue. If the FIFO queue is full, remove the oldest single-step mixed feature vector from the head of the queue. The FIFO queue always maintains a sequence from the time window. Time window The 10 consecutive time windows are used to generate single-step hybrid feature vectors. These 10 15-dimensional single-step hybrid feature vectors are then vertically stacked in chronological order to obtain a 10×15 matrix, which is the temporally sequenced hybrid feature vector. This temporally sequenced hybrid feature vector not only contains the statistical characteristics of communication load and vehicle operating status information in the current time window, but also implies the changing patterns of communication behavior and vehicle status within the last 10 time windows, providing a temporal input basis for the subsequent temporal reconstruction network model.

[0047] S103, input the temporal hybrid feature vector into the pre-trained temporal reconstruction network model used to represent the baseline pattern of normal behavior, transform and decode to reconstruct the reconstructed hybrid feature vector; calculate the reconstruction error between the temporal hybrid feature vector and the reconstructed hybrid feature vector; when the reconstruction error exceeds the judgment threshold set based on the statistical analysis of historical normal operation data within a consecutive preset number of time windows, it is determined that the vehicle terminal has abnormal behavior.

[0048] The working principle of the temporal reconstruction network model is as follows: The network is trained using only normal behavioral data, allowing it to learn the inherent temporal dependencies and statistical regularities of normal behavioral patterns. After training, the network can accurately reconstruct input sequences that conform to normal patterns, while generating significant reconstruction errors for abnormal inputs that deviate from normal patterns. This embodiment uses a Long Short-Term Memory (LSTM) autoencoder network as the temporal reconstruction network model. This network structure consists of an encoder and a decoder, and the network training aims to minimize the mean squared error between the input and the reconstructed output.

[0049] In an optional embodiment, the temporal reconstruction network model is a long short-term memory network autoencoder, comprising: an encoder consisting of two stacked long short-term memory network layers with 64 hidden units each, and a decoder consisting of two stacked long short-term memory network layers with 64 hidden units each and a fully connected output layer; the long short-term memory network autoencoder compresses the temporal hybrid feature vector into a hidden state through the encoder, and then recovers the original sequence from the hidden state through the decoder to obtain the reconstructed hybrid feature vector.

[0050] The encoder consists of two stacked Long Short-Term Memory (LSTM) network layers, each with 64 hidden units. The encoder receives a temporally sequenced hybrid feature vector as input (the aforementioned 10×15 temporal matrix), processes the input sequence step-by-step, and compresses the sequence information into the hidden state vector output by the encoder at the last time step. The decoder consists of a repeating vector layer, two stacked LSM layers with 64 hidden units each, and a temporally distributed fully connected output layer. The fully connected output layer has 15 neurons and uses a linear activation function. A linear activation function is used because the reconstruction task requires an unrestricted output range to restore the numerical range of the original features. The repeating vector layer copies and expands the hidden state vector output by the encoder into a sequence of the same length as the input sequence, i.e., it copies it 10 times to form a 10×64 matrix. Subsequently, the two LSM layers of the decoder decode step-by-step, and the fully connected output layer maps the 64-dimensional hidden state at each time step back to a 15-dimensional feature space, resulting in a 10×15 reconstructed hybrid feature vector.

[0051] The number of hidden units, 64, is set based on engineering experience from similar temporal anomaly detection tasks. In other implementations, it can be adjusted within the range of 32 to 128 depending on the feature dimension. The number of stacked layers of the Long Short-Term Memory network is 2. Stacking two layers can achieve a balance between the complexity of capturing temporal dependencies and computational overhead. As an optional solution, in scenarios with higher feature dimensions or more complex temporal dependencies, the number of stacked layers can be increased to 3.

[0052] In an optional embodiment, calculating the reconstruction error between the temporally sequenced hybrid feature vector and the reconstructed hybrid feature vector includes: calculating the square of the difference element by element for all time steps and all feature dimensions of the temporally sequenced hybrid feature vector and the reconstructed hybrid feature vector, obtaining the arithmetic mean of the squares of all element differences, and using the arithmetic mean as the reconstruction error.

[0053] Let the temporally sequenced hybrid eigenvectors be matrices. The matrix has dimensions of 10×15. The elements are , From 1 to 10, From 1 to 15. The reconstructed mixed feature vector obtained after passing through the Long Short-Term Memory network autoencoder is a matrix. The dimension is also 10×15, matrix The elements are Reconstruction error The calculation is performed according to the following expression: ; In the formula, The reconstruction error is a non-negative scalar value. The first feature vector in the temporal hybrid feature vector The first time step The element values ​​of each feature dimension are generated by the process of stacking temporally hybrid feature vectors; The element values ​​at corresponding positions in the reconstructed hybrid feature vector are generated by the decoder output of the Long Short-Term Memory network autoencoder; 150 represents the total number of matrix elements, i.e., 10 × 15. In other words, the reconstruction error measures the degree to which the temporal reconstruction network model reconstructs the input sequence. The smaller the reconstruction error, the closer the input behavior pattern is to the normal baseline pattern learned by the network; the larger the reconstruction error, the more severe the deviation of the input behavior from the normal pattern.

[0054] In an optional embodiment, the setting of the judgment threshold and the determination of the consecutive preset number include: collecting a verification dataset containing only normal behavior; inputting the verification dataset into a pre-trained temporal reconstruction network model to calculate the reconstruction error distribution and obtain the mean and standard deviation of the reconstruction error distribution; setting the judgment threshold as the sum of the mean and three times the standard deviation; and setting the consecutive preset number to 5. When the reconstruction error calculated for 5 consecutive time windows is greater than the judgment threshold, the vehicle terminal is judged to have abnormal behavior and an alarm is generated.

[0055] The determination of the judgment threshold is divided into an offline setting stage and an online monitoring stage. In the offline setting stage, a verification dataset containing only normal behavior is prepared. In this embodiment, 500,000 time-series hybrid feature vector samples collected from normally operating commercial vehicles are used. This sample size covers data distributions under different operating conditions and time periods, which is statistically sufficient to support stable estimation of the reconstruction error distribution parameters. The 500,000 samples are then input one by one into the pre-trained time-series reconstruction network model, and 500,000 corresponding reconstruction error values ​​are calculated. Statistical analysis is performed on the reconstruction error values ​​to obtain the mean of the reconstruction error distribution. and standard deviation The threshold for judgment will be determined. Set as .

[0056] Assuming that the statistics are completed during the offline setup phase, the mean of the reconstructed error distribution is... The standard deviation is 0.085. The threshold value is 0.012. Since the reconstruction error of normal behavior data approximately follows a normal distribution, the mean plus three standard deviations corresponds to a coverage of 99.7% of normal samples. That is, only about 0.3% of normal samples will have a reconstruction error exceeding the judgment threshold, thus keeping the false alarm rate at a low level.

[0057] During the online monitoring phase, an anomaly counter is initialized with an initial value of 0. For each new time window, the real-time reconstruction error is calculated. If the real-time reconstruction error exceeds the judgment threshold, the anomaly counter is incremented by 1; if the real-time reconstruction error does not exceed the judgment threshold, the anomaly counter is immediately reset to zero. When the value of the anomaly counter reaches a preset number of 5 consecutive times, an abnormal behavior is detected in the vehicle terminal, and an alarm is generated. Subsequently, the anomaly counter is reset to 0, ready to detect the next abnormal event. Setting the preset number of consecutive times to 5, rather than judging based on a single exceeding the threshold, can filter out individual error spikes caused by data noise or instantaneous network jitter, making anomaly detection more stable and reliable. In actual engineering deployments, the preset number of consecutive times can also be adjusted within the range of 3 to 10 based on the trade-off between response speed and false alarm rate.

[0058] To verify the effectiveness of the technical solution proposed in this invention, the following three sets of experiments were set up.

[0059] The first set of experiments validated the effectiveness of multimodal feature fusion. The experimental conditions were as follows: a real vehicle terminal dataset containing 100,000 normal samples and 5,000 abnormal samples was used, covering data forgery and state anomalies; all models employed a Long Short-Term Memory (LSTM) autoencoder network. Scheme 1 used only Reni entropy communication features calculated based on semantic token sequences, achieving a detection accuracy of 93.5%, a recall of 86.2%, and an F1 score of 89.7%. Scheme 2 used only one-hot encoded feature vectors of vehicle operating status, achieving a detection accuracy of 91.8%, a recall of 82.5%, and an F1 score of 86.9%. Scheme 3, proposed in this invention, fused communication payload entropy features and vehicle operating status features, achieving a detection accuracy of 97.2%, a recall of 94.6%, and an F1 score of 95.9%. Scheme 3 outperforms Scheme 1 and Scheme 2 in all aspects. This is because by integrating communication semantic features and vehicle operating status features, anomaly detection can cross-verify the consistency between communication behavior and vehicle operating conditions, covering more types of anomaly scenarios and reducing false negatives and false positives when relying on a single modality feature.

[0060] To verify the effectiveness of the Reni entropy feature representation method, the detection performance of different communication feature representation methods was compared under the same dataset and Long Short-Term Memory (LSTM) autoencoder model. Using the original message count feature—the number of terminal heartbeat and location information reports within a statistical time window—as the baseline, the F1 score was 85.1%, and the average anomaly detection latency was 8.7 time windows. After using only the first set of Reni entropies representing a univariate frequency distribution, the F1 score improved to 92.3%, and the average anomaly detection latency decreased to 6.2 time windows. Furthermore, by introducing a second set of Reni entropies representing a binary frequency distribution, the F1 score further improved to 95.9%, and the average anomaly detection latency decreased to 4.5 time windows. The raw message count does not include the temporal distribution information of messages. Univariate Reni entropy can reflect the statistical distribution characteristics of message types but cannot capture the sequential relationship between messages. Binary Reni entropy supplements the transition probability information of adjacent semantic tokens and can identify temporal attack patterns such as abnormal insertion of terminal heartbeat semantic tokens into the sequence of reported semantic tokens. Therefore, the combined use of the first set of Reni entropy and the second set of Reni entropy can more comprehensively characterize the inherent statistical laws of communication behavior.

[0061] To verify the necessity of the temporal reconstruction network model, the input features were unified into the fusion features proposed in this invention, and the performance differences of different detection models were compared on the same dataset. The Isolation Forest algorithm achieved a detection accuracy of 89.6% and a recall of 78.8%. This algorithm has a certain ability to identify isolated anomalies at a single time point, but it cannot capture behavioral change patterns over time. After processing the single-step mixed feature vector of a single time window using a standard autoencoder based on a fully connected layer, the detection accuracy improved to 94.1%, and the recall reached 88.5%. The Long Short-Term Memory (LSTM) network autoencoder used in this invention takes the temporally-based mixed feature vector obtained by stacking 10 consecutive time windows as input, achieving a detection accuracy of 97.2% and a recall of 94.6%. Behavioral anomalies in vehicle terminals are usually manifested as persistent pattern deviations rather than instantaneous events. Isolation Forest and the standard autoencoder can only detect static anomalies at a single time point. The LSM network can capture the long-term dependencies of features over time and has a stronger ability to identify progressive attacks or pattern-drifting anomalies that require historical context for judgment.

[0062] Reference Figure 2Three detection schemes were compared: the Reni entropy communication feature model, the operational status coding model, and the multimodal fusion model. The Reni entropy communication feature model, using only communication payload entropy features, achieved a detection accuracy of 93.5%, a recall of 86.2%, and an F1 score of 89.7%. The operational status coding model, using only vehicle operational status features, achieved a detection accuracy of 91.8%, a recall of 82.5%, and an F1 score of 86.9%. The multimodal fusion model, employing the proposed scheme that integrates communication payload entropy features and vehicle operational status features, improved the detection accuracy to 97.2%, the recall to 94.6%, and the F1 score to 95.9%. Figure 2 As can be seen, the three detection performance indicators of the multimodal fusion model are all better than those of the two single-modal schemes, which verifies that the cascade fusion of communication payload entropy features and vehicle operating status features can effectively utilize the cross-validation information of communication semantics and vehicle operating conditions, thereby reducing the false alarm rate and false negative rate.

[0063] Reference Figure 3 Before the anomaly injection, during the normal behavior period, the reconstruction error fluctuated below the judgment threshold, and the temporal reconstruction network model could accurately reconstruct the normal behavior pattern. A momentary error spike caused by data noise appeared at time window number 18. Although the reconstruction error in this window exceeded the judgment threshold, the system did not trigger an anomaly alarm because the condition of exceeding the threshold for five consecutive time windows was not met, demonstrating the filtering capability of the continuous window comparison judgment mechanism for momentary noise. After the anomaly injection, the reconstruction error continued to increase and continuously exceeded the judgment threshold. When the reconstruction error of five consecutive time windows was greater than the judgment threshold, the system determined that the vehicle terminal had abnormal behavior and generated an alarm. Figure 3 As can be seen, the continuous window comparison judgment mechanism between reconstruction error and judgment threshold can accurately identify continuous abnormal behavior pattern shifts while filtering out instantaneous error spikes caused by data noise, thereby improving the accuracy of anomaly judgment and anti-interference ability.

[0064] It should be noted that those skilled in the art can make various modifications and improvements without departing from the inventive concept, and these all fall within the scope of protection of this invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A method for identifying abnormal behavior in the communication protocol of a commercial vehicle's onboard terminal, characterized in that, include: Within a preset time window, the uplink communication raw payload data stream of the vehicle terminal and the real-time multi-dimensional vehicle operation status data of the commercial vehicle are collected based on a unified timestamp. Based on a pre-defined communication protocol syntax model, the original uplink communication payload data stream is parsed and converted into an ordered semantic token sequence. At the same time, the multi-dimensional vehicle operation status data is discretized and encoded to generate a status feature vector. Entropy values ​​are calculated based on the unary frequency distribution of semantic tokens and the binary joint frequency distribution of adjacent semantic tokens to form a multidimensional communication payload entropy feature vector. The multidimensional communication payload entropy feature vector is fused with the state feature vector in series to form a single-step hybrid feature vector, and the single-step hybrid feature vectors of multiple consecutive time windows are collected to obtain a temporally sequenced hybrid feature vector. The temporal hybrid feature vector is input into a pre-trained temporal reconstruction network model used to represent the baseline pattern of normal behavior, and then transformed and decoded to obtain the reconstructed hybrid feature vector. The reconstruction error between the temporal hybrid feature vector and the reconstructed hybrid feature vector is calculated. When the reconstruction error exceeds the judgment threshold set based on the statistical analysis of historical normal operation data for a continuous preset number of time windows, it is determined that the vehicle terminal has abnormal behavior.

2. The method for identifying abnormal behavior of the communication protocol of a commercial vehicle in-vehicle terminal according to claim 1, characterized in that, Based on a pre-defined communication protocol syntax model, the raw uplink communication payload data stream is parsed and converted into an ordered sequence of semantic tokens, including: A finite state machine parser based on the JT / T808 protocol is used to read the raw uplink communication payload data stream byte by byte, and extract the message ID field according to the frame header, message header, message body and check code structure defined by the protocol. The extracted message ID 0x0002 is mapped to a terminal heartbeat semantic token, the extracted message ID 0x0200 is mapped to a location information reporting semantic token, and the remaining extracted message IDs are uniformly mapped to general transaction semantic tokens. The semantic tokens are stored in a first-in-first-out queue according to the order of receipt, resulting in an ordered semantic token sequence.

3. The method for identifying abnormal behavior of the commercial vehicle on-board terminal communication protocol according to claim 1, characterized in that, Discretize and encode multidimensional vehicle operating status data to generate state feature vectors, including: Vehicle speed status is divided into five speed levels; The engine speed status is divided into four speed levels; Each state dimension after being classified into levels is converted into a binary vector using one-hot encoding. The binary vectors of all dimensions are then concatenated in a predetermined order to obtain the state feature vector.

4. The method for identifying abnormal behavior of the commercial vehicle on-board terminal communication protocol according to claim 1, characterized in that, The calculation of the multidimensional communication payload entropy feature vector includes: when there is no communication payload data within the time window, the multidimensional communication payload entropy feature vector is assigned a preset constant value; When communication payload data exists within the time window, the univariate probability is estimated by statistically analyzing the occurrence frequency of each individual semantic token. For a pre-defined number of Reni entropy orders that are not equal to 1 Each of them, according to the expression Calculate the order of Raney entropy The corresponding first group of Reni entropy ; Statistical analysis of the frequency of occurrence of adjacent semantic token pairs to estimate the binary joint probability. For a pre-defined number of Reni entropy orders that are not equal to 1 Each of them, according to the expression Calculate the order of Raney entropy The corresponding second group of Reni entropy ; The first set of Reni entropy and the second set of Reni entropy are used to construct a multidimensional communication payload entropy feature vector.

5. The method for identifying abnormal behavior of the communication protocol of a commercial vehicle on-board terminal according to claim 4, characterized in that, The multidimensional communication payload entropy feature vector and the state feature vector are concatenated and fused into a single-step hybrid feature vector, including: At the end of each time window, the calculated first set of Raney entropy, the second set of Raney entropy, and the state feature vector are concatenated in a fixed order to obtain the single-step mixed feature vector of the time window.

6. The method for identifying abnormal behavior of the communication protocol of a commercial vehicle on-board terminal according to claim 1, characterized in that, The temporally sequenced blended feature vectors are obtained by aggregating the single-step blended feature vectors from multiple consecutive time windows, including: Stack the 10 single-step mixed feature vectors generated in the 10 most recent consecutive time windows in chronological order to form a 10-row array. The time series matrix of the column is used as the time-series hybrid feature vector, where is the length of the single-step mixed feature vector.

7. The method for identifying abnormal behavior of the communication protocol of a commercial vehicle on-board terminal according to claim 1, characterized in that, The temporal reconstruction network model is a long short-term memory network autoencoder, including: The encoder consists of two stacked long short-term memory network layers with 64 hidden units each, and the decoder consists of two stacked long short-term memory network layers with 64 hidden units each, plus a fully connected output layer. Long Short-Term Memory (LSTM) network autoencoders compress temporally mixed feature vectors into hidden states through an encoder, and then recover the original sequence from the hidden states through a decoder to obtain reconstructed mixed feature vectors.

8. The method for identifying abnormal behavior of the communication protocol of a commercial vehicle on-board terminal according to claim 1, characterized in that, The reconstruction error between the temporally induced blended feature vector and the reconstructed blended feature vector is calculated, including: For each time step and feature dimension of the temporally sequenced hybrid feature vector and the reconstructed hybrid feature vector, the square of the difference is calculated element by element. The arithmetic mean of the squares of the differences of all elements is then obtained, and the arithmetic mean is used as the reconstruction error.

9. The method for identifying abnormal behavior of the communication protocol of a commercial vehicle in-vehicle terminal according to claim 1, characterized in that, The setting of the judgment threshold and the determination of the consecutive preset number include: A validation dataset containing only normal behavior is collected. The validation dataset is then input into a pre-trained temporal reconstruction network model to calculate the reconstruction error distribution, obtaining the mean and standard deviation of the reconstruction error distribution. The decision threshold is set as the sum of the mean and three times the standard deviation. The preset number of consecutive time windows is 5. When the reconstruction error calculated for 5 consecutive time windows is greater than the judgment threshold, the vehicle terminal is judged to have abnormal behavior and an alarm is generated.

10. The method for identifying abnormal behavior of the communication protocol of a commercial vehicle on-board terminal according to claim 3, characterized in that, The five speed levels, from lowest to highest vehicle speed, are: less than 20 km / h, greater than or equal to 20 km / h and less than 60 km / h, greater than or equal to 60 km / h and less than 100 km / h, greater than or equal to 100 km / h and less than or equal to 150 km / h, and an abnormal speed level exceeding 150 km / h; the four engine speed levels, from lowest to highest engine speed, are: less than 800 r / min, greater than or equal to 800 r / min and less than 2000 r / min, greater than or equal to 2000 r / min and less than or equal to 4000 r / min, and an abnormal engine speed level exceeding 4000 r / min.

Images