Method and system for detecting data stream anomaly of internet of vehicles based on dynamic particle model

Abstract

The application discloses a vehicle networking data stream anomaly detection method and system based on a dynamic particle ball model, which comprises the following steps: acquiring original running data of a vehicle networking data pipeline in each observation window, and extracting multi-dimensional health degree features; mapping the multi-dimensional health degree features of each observation window into historical health state points in a high-dimensional health feature space to form a historical health state point sequence; constructing a dynamic reference health particle ball model according to time slices; forming a multivariate time sequence input according to the time sequence of the historical health state point sequence and inputting the multivariate time sequence input into a state point time sequence prediction model to estimate the position of a state point of a next observation window and obtain a predicted state point; selecting a corresponding dynamic reference health particle ball model according to a time slice to which a current observation window belongs; respectively calculating the relative spatial approximation degrees of a real-time state point and the predicted state point relative to the selected dynamic reference health particle ball model; and calculating a data stream health score, performing anomaly grading detection and risk early warning.

Description

Technical Field

[0001] This invention relates to the fields of data quality governance, stream computing, and intelligent operation and maintenance, specifically to a method and system for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model. It is particularly suitable for data pipeline operation status modeling, health prediction, and graded anomaly alarms in scenarios of multi-source heterogeneous, high-concurrency, and highly time-varying data streams in vehicle network platforms. Background Technology

[0002] Vehicle-to-everything (V2X) platforms typically need to continuously receive real-time data from a massive number of vehicle terminals, roadside units, edge gateways, and third-party service systems. This data includes location data, sensor data, diagnostic data, control command feedback data, and multimedia event data. Such data is characterized by its wide range of sources, high concurrency, large fluctuations, and strong time-varying nature, resulting in significantly different operating states of the platform's data pipeline at different times of the day. For example, during morning and evening rush hours, inclement weather, large event areas, or holiday return travel scenarios, the platform experiences a significant surge in traffic; while during low-activity periods such as the early morning, the traffic volume decreases noticeably.

[0003] Existing technologies typically monitor data streams using static thresholds, such as triggering alarms based on whether the received data volume per unit time falls below a fixed value or the latency exceeds a fixed duration. This type of method has the following drawbacks:

[0004] 1. Static thresholds cannot adapt to the inherent periodic fluctuations in vehicle network data streams. During peak traffic periods, even if the system is operating normally, false alarms may be triggered due to the natural increase in traffic; during off-peak traffic periods, even if there is a blockage in a local pipeline, it may not be detected in time because the fixed threshold has not been reached.

[0005] 2. Existing methods typically monitor only a single indicator independently, lacking the ability to represent the overall health status of the data flow in a unified manner. They are difficult to comprehensively reflect the true operating status under the combined influence of multiple factors such as traffic volume, distribution dispersion, protocol composition, and arrival rhythm.

[0006] 3. Most existing methods are post-event detection mechanisms, that is, alarms are only triggered when an anomaly has occurred and reached a threshold. They lack the ability to model the trend of state evolution and cannot provide forward-looking warnings before an anomaly is formed.

[0007] In view of the above, this application is hereby submitted. Summary of the Invention

[0008] The technical problem this invention aims to solve is that existing technologies typically use static threshold methods to monitor data streams, which suffer from poor adaptability to complex traffic fluctuations, coexistence of false alarms and missed alarms, and inability to provide proactive early warnings. The purpose of this invention is to provide a method for anomaly detection in vehicle-to-everything (V2X) data streams based on a dynamic particle model. This method establishes a dynamic baseline health particle model based on the multidimensional characteristics and periodic evolution of V2X data streams, and combines state prediction to achieve proactive early warning and tiered detection. This invention effectively overcomes the problems of high false alarm rates, high missed alarm rates, and delayed early warnings in peak and valley traffic scenarios caused by traditional static threshold monitoring, realizing an intelligent operation and maintenance transformation of V2X data streams from passive alarms to proactive prediction, and from single-point monitoring to overall health assessment.

[0009] This invention is achieved through the following technical solution:

[0010] In a first aspect, the present invention provides a method for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model, the method comprising:

[0011] Acquire raw operational data of the vehicle network data pipeline within each observation window, and extract multidimensional health features from the raw operational data;

[0012] The multidimensional health features of each observation window are mapped to historical health status points in a high-dimensional health feature space, forming a sequence of historical health status points.

[0013] Based on the periodic patterns of historical health status points, a dynamic baseline healthy particle model is constructed by time slices using the particle-sphere evolution algorithm.

[0014] The historical health status point sequence is arranged in chronological order to form a multivariate time series input, and the multivariate time series input is used as the input of a pre-built state point time series prediction model. Based on the state point time series prediction model, the position of the state point in the next observation window is predicted to obtain the predicted state point.

[0015] Based on the time slice to which the current observation window belongs, select the corresponding dynamic baseline healthy particle model; calculate the relative spatial approximation of the real-time state point and the predicted state point relative to the selected dynamic baseline healthy particle model;

[0016] Based on the relative spatial approximation, a data flow health score is calculated; and based on the data flow health score, real-time status points, and predicted status points, anomaly classification detection and risk warning are performed.

[0017] Furthermore, the raw operational data of the vehicle-to-everything (V2X) data pipeline within each observation window is acquired, and multi-dimensional health features are extracted from the raw operational data, including:

[0018] Obtain the raw operational data of the vehicle network data pipeline within each observation window. The raw operational data includes: total data packet information, time characteristic information, spatial distribution information, protocol distribution information, and quality auxiliary information.

[0019] The information includes: total data packet information, comprising one or more of the following: total number of data packets received within the window, total number of data packets sent, and total number of data packets successfully added to the database; time characteristic information, comprising one or more of the following: arrival timestamp of each data packet, arrival time interval between adjacent data packets, window processing delay, and queuing delay; spatial distribution information, comprising one or more of the following: data source region identifier, edge node identifier, and region identifier of the vehicle terminal; protocol distribution information, comprising one or more of the following: number and percentage of data packets corresponding to different communication protocols, data types, or message topics; and quality auxiliary information, comprising one or more of the following: number of lost packets, number of duplicate packets, number of out-of-order packets, and number of retransmissions.

[0020] Multidimensional health features were extracted from the raw operational data, including the total number of data packets per unit time. Geographical distribution diversity and entropy characteristics Data packet arrival time interval distribution characteristics and multi-protocol data ratio characteristics ;

[0021] Among them, the distribution characteristics of data packet arrival time intervals Includes at least one of the following: mean interval of arrival, standard deviation of interval of arrival, and coefficient of variation of interval of arrival; multi-protocol data proportion characteristics. This is a vector representing the proportion of data packets of different protocol types to the total number of data packets in the window.

[0022] Furthermore, the periodic patterns include at least daily, weekly, and holiday patterns. These periodic patterns are obtained through statistical analysis of historical health status point sequences aligned by time. Corresponding dynamic benchmark health particle models are then established based on different periodic labels.

[0023] Furthermore, the construction process of the dynamic benchmark healthy granulocyte model is as follows:

[0024] With time slices The corresponding set of historical health status points As input;

[0025] Calculate the set of historical health status points Initial center vector of internal state points ;

[0026] Calculate the vector from each state point to the initial center. Find the Euclidean distance between them, and calculate the mean and standard deviation of the distance;

[0027] Calculate the initial radius based on the mean distance and the standard deviation of the distance. ;

[0028] When newly arriving historical health samples belong to a time slice At that time, for the initial center vector and initial radius Perform a recursive update to obtain the updated center vector. and the updated radius ;

[0029] Based on the updated center vector and the updated radius When a time slice is detected When a multimodal health distribution exists internally, the set of historical health state points is used. The time slice is divided into multiple subsets, and multiple sub-spheres are generated for each subset. Then, based on the minimum coverage principle and stability criterion, the corresponding spheres are merged or retained to obtain the final time slice. The dynamic baseline healthy granule model.

[0030] Furthermore, the state point time series prediction model adopts any one of the following: vector autoregression model, long short-term memory network model, or gated recurrent unit model.

[0031] Furthermore, the relative spatial approximation of real-time state points The expression is:

[0032] ;

[0033] In the formula, For real-time status points, A typical health status center representing the vehicle-to-everything (V2X) data stream at the corresponding time slice. This represents the permissible range of fluctuations in normal health status during this period; A dynamic baseline healthy granule model; The distance between the centers of the real-time status points;

[0034] Predicting the relative spatial approximation of state points The expression is:

[0035] ;

[0036] In the formula, To predict state points, This is the center distance for predicting state points.

[0037] Furthermore, the relative spatial approximation includes:

[0038] Boundary distance component is used to characterize the normalized distance between the real-time state point or the predicted state point and the center of the dynamic baseline healthy particle model.

[0039] Boundary deviation component, used to characterize the degree to which a real-time state point or predicted state point deviates from the boundary of the dynamic baseline healthy particle model:

[0040] The trend approximation component is used to characterize the speed at which a real-time state point or a predicted state point approaches or moves away from the boundary of the dynamic baseline healthy particle model.

[0041] Furthermore, data flow health score The formula is:

[0042] ;

[0043] in, The relative spatial approximation of the real-time state point; For predicting the boundary deviation components of the state points; To approximate the weight of the trend; , , Let be the weighting coefficients, and satisfy: Boundary deviation component It can be represented as: The trend is approaching the weight. It can be represented as: .

[0044] Furthermore, based on the data stream health score, real-time status points, and predicted status points, anomaly classification detection and risk warning are performed, including:

[0045] when and When the time is right, it is considered a healthy state; among them, The relative spatial approximation of the real-time state point; To predict the relative spatial approximation of the state points;

[0046] when and ,and Greater than the preset trend threshold When this occurs, it is determined to be a potential risk state, triggering an early warning; among which, To approximate the weight of the trend;

[0047] when And continuously exceeds the continuous window threshold If the condition is as described above, it is determined to be an actual abnormal state, and an abnormal alarm is output; and according to... or The magnitude of the abnormal state is used to classify its severity:

[0048] like If so, it is a level one minor abnormality; if If so, it is classified as a level two moderate abnormality; if If so, it is classified as a level three severe abnormality; among them, Represents the relative spatial approximation of real-time state points. Or predict the relative spatial approximation of the state points Any one of them.

[0049] Secondly, this invention also provides a vehicle network data stream anomaly detection system based on a dynamic particle sphere model, the system comprising:

[0050] The data acquisition and feature extraction unit is used to acquire the raw operating data of the vehicle network data pipeline within each observation window, and extract multi-dimensional health features from the raw operating data.

[0051] The state point sequence forming unit is used to map the multidimensional health characteristics of each observation window into historical health state points in a high-dimensional health feature space, thereby forming a historical health state point sequence.

[0052] The dynamic baseline healthy particle building unit is used to construct a dynamic baseline healthy particle model based on the periodic patterns of historical health status points and using the particle evolution algorithm in time slices.

[0053] The state point prediction unit is used to construct a multivariate time series input by arranging the historical health state point sequence in chronological order, and to use the multivariate time series input as the input of the pre-built state point time series prediction model. Based on the state point time series prediction model, the position of the state point in the next observation window is predicted to obtain the predicted state point.

[0054] The relative spatial approximation calculation unit is used to select the corresponding dynamic benchmark healthy particle model according to the time slice to which the current observation window belongs; and to calculate the relative spatial approximation of the real-time state point and the predicted state point relative to the selected dynamic benchmark healthy particle model.

[0055] The health scoring and risk warning unit is used to calculate the health score of the data stream based on the relative spatial approximation; and to perform anomaly classification detection and risk warning based on the data stream health score, real-time status points and predicted status points.

[0056] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0057] This invention relates to a method and system for anomaly detection in vehicle-to-everything (V2X) data streams based on a dynamic particle model. It establishes a dynamic baseline health particle model based on the multidimensional characteristics and periodic evolution of V2X data streams, and combines this with state prediction to achieve proactive early warning and tiered detection. This invention effectively overcomes the problems of high false alarm rates, high false negative rates, and delayed early warnings associated with traditional static threshold monitoring in peak and valley traffic scenarios. It enables intelligent operation and maintenance of V2X data streams, shifting from passive alarms to proactive prediction and from single-point monitoring to overall health assessment.

[0058] (1) The status of vehicle network data flow is improved from single-index threshold judgment to multi-dimensional health status space representation, which can more comprehensively depict the operation status of data pipeline;

[0059] (2) The dynamic benchmark healthy particle model is used to model different time slices separately, so that the normal flow peak and valley fluctuations are included in the benchmark range, effectively reducing the false alarm rate;

[0060] (3) By predicting the location of the status point in the next observation window, trend warnings before anomalies are formed can be achieved, thereby improving the initiative of operation and maintenance;

[0061] (4) By combining the boundary distance component, boundary deviation component and trend approximation component, it is possible not only to determine whether there is an anomaly, but also to determine the degree and direction of the anomaly, thereby improving the interpretability of the alarm.

[0062] (5) It is applicable to data flow governance scenarios in the Internet of Vehicles that are multi-source, heterogeneous, frequently updated, and dynamically changing, and has strong engineering implementation value. Attached Figure Description

[0063] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0064] Figure 1 This is a flowchart of the vehicle network data stream anomaly detection method based on the dynamic particle model of the present invention;

[0065] Figure 2 This is a block diagram of the vehicle network data stream anomaly detection system based on the dynamic particle model of the present invention. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0067] This invention addresses the real-time reporting data stream, edge node forwarding data stream, and platform-internal processing data stream within a vehicle-to-everything (V2X) platform. First, it collects raw traffic data, latency data, protocol distribution data, and regional distribution data characterizing the data pipeline's operational status, extracting multidimensional health features in sliding time windows. Then, it maps the multidimensional feature vectors within each observation window to state points in a high-dimensional feature space, thus forming a temporal evolution trajectory of the data stream's health status (i.e., a historical health status point sequence). Further, based on daily, weekly, and holiday patterns in historical data, a dynamic benchmark health particle model is constructed according to different time slices. The particle center represents the typical health status of the corresponding time period, and the particle radius represents the allowable normal fluctuation range for that time period. Then, a temporal prediction model is established based on the historical sequence of state points to predict the position of the state point in the next observation window. Finally, the spatial approximation, boundary deviation, and movement trend of the real-time and predicted state points relative to the corresponding dynamic benchmark health particle model are calculated, and health scores, risk warnings, and anomaly classification detection results are output accordingly.

[0068] This invention can effectively overcome the problems of high false alarm rate, high false alarm rate and delayed early warning in traditional static threshold monitoring under peak and valley traffic scenarios, and realize the intelligent operation and maintenance transformation of vehicle network data flow from passive alarm to active prediction, and from single point monitoring to overall health assessment.

[0069] The terminology used in this invention is explained uniformly as follows:

[0070] 1. Observation Window : refers to the continuous vehicle network data stream of a fixed length The division obtained by the first Statistical time intervals.

[0071] 2. Window feature vector : refers to the observation window The multidimensional health feature set is extracted and standardized.

[0072] 3. State Points : Refers to the window feature vector The coordinate representation in the high-dimensional health feature space is used to characterize the overall health status of the data stream within the window.

[0073] 4. Time slice : Refers to the runtime category obtained by dividing the daytime period or by overlaying scene tags.

[0074] 5. Dynamic benchmark healthy granule model Pointer to time slice The established health state space benchmark model is composed of a central vector. and radius composition.

[0075] 6. Real-time status points : Refers to the actual state point corresponding to the current observation window.

[0076] 7. Predicting state points : Refers to the predicted state point of the next observation window obtained based on the time series prediction model.

[0077] 8. Relative spatial approximation The ratio of the Euclidean distance from the state point to the center of the healthy sphere to the radius of the sphere is used to reflect how close the state is to the healthy baseline.

[0078] 9. Boundary deviation , This refers to the degree to which the state point exceeds the boundary of a healthy granule.

[0079] 10. Trend Approaching Volume The difference between the predicted approximation and the real-time approximation is used to characterize the direction and intensity of the boundary evolution of the state.

[0080] 11. Health Score This refers to the quantitative result of the health status of the data stream obtained by combining the current state, the predicted state, and the evolution trend.

[0081] Example 1

[0082] like Figure 1 As shown, the present invention provides a method for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model. This method includes:

[0083] S1, acquire the raw operational data of the vehicle network data pipeline in each observation window, and extract multi-dimensional health features from the raw operational data;

[0084] Specifically, step S1 includes:

[0085] S11 performs real-time monitoring of the data access layer, message queue layer, stream processing layer, and storage layer in the vehicle networking platform, and collects and obtains the raw operating data of the vehicle networking data pipeline in each observation window. The raw operating data includes: total data packet information, time characteristic information, spatial distribution information, protocol distribution information, and quality auxiliary information.

[0086] The information includes: total data packet information, comprising one or more of the following: total number of data packets received within the window, total number of data packets sent, and total number of data packets successfully added to the database; time characteristic information, comprising one or more of the following: arrival timestamp of each data packet, arrival time interval between adjacent data packets, window processing delay, and queuing delay; spatial distribution information, comprising one or more of the following: data source region identifier, edge node identifier, and region identifier of the vehicle terminal; protocol distribution information, comprising one or more of the following: number and percentage of data packets corresponding to different communication protocols, data types, or message topics; and quality auxiliary information, comprising one or more of the following: number of lost packets, number of duplicate packets, number of out-of-order packets, and number of retransmissions.

[0087] S12, divide the continuous data stream of the original running data into segments of length [length missing]. The sliding observation window is used for segmented statistics, and in each observation window... Extract multidimensional health features, i.e., window feature vectors, from each element. Multidimensional health characteristics include the total amount of data packets per unit time. Geographical distribution diversity and entropy characteristics Data packet arrival time interval distribution characteristics and multi-protocol data ratio characteristics Optional extended features include one or more of the following: latency fluctuation features, packet loss rate features, and duplicate packet rate features.

[0088] Among them, the distribution characteristics of data packet arrival time intervals Includes at least one of the following: mean interval of arrival, standard deviation of interval of arrival, and coefficient of variation of interval of arrival; multi-protocol data proportion characteristics. This is a vector representing the proportion of data packets of different protocol types to the total number of data packets in the window.

[0089] In this embodiment, the monitoring object is the vehicle-to-everything (V2X) platform data pipeline, including the terminal access gateway, message middleware, real-time computing engine, and database entry service module. The system uses a fixed length... The sliding observation window segments the continuous data stream and optimizes its selection. for , or .

[0090] For each observation window Collect the following raw data: (1) Total number of data packets in the window (2) Data packet timestamp sequence (3) The region identifier of each data packet; (4) The protocol type or message subject of each data packet; (5) Statistics on latency, packet loss, retransmission, and duplicate packets in the processing link.

[0091] Based on the raw data collected above, the following multidimensional health features are extracted:

[0092] (1) Characteristics of total data packets per unit time

[0093]

[0094] in, Indicates the first The total number of data packets received within each observation window. Indicates the length of the observation window.

[0095] This feature is used to characterize the overall throughput level within the window.

[0096] (2) Entropy characteristics of geographical distribution diversity

[0097]

[0098] in, This indicates the number of geographic categories involved within the observation window. Indicates the first The proportion of data packets originating from a specific region to the total number of data packets in the window.

[0099] This feature characterizes the degree of dispersion of data sources. When regional sources are excessively concentrated or abruptly change, it may indicate local acquisition anomalies, regional network jitter, or roadside equipment malfunctions.

[0100] (3) Distribution characteristics of data packet arrival time intervals

[0101] Data packet arrival time interval distribution characteristics It includes at least one of the following: mean arrival interval, standard deviation of arrival interval, and coefficient of variation of arrival interval.

[0102] Define the interval between adjacent data packets. for:

[0103]

[0104] in, Indicates the first The arrival timestamp of each data packet.

[0105] Further extract the mean, standard deviation, or coefficient of variation as arrival rhythm features, where the average arrival interval is:

[0106]

[0107] standard deviation of arrival interval for:

[0108]

[0109] These features are used to reflect whether the data stream arrives evenly and whether there are sudden congestion or intermittent blockages.

[0110] (4) Multi-protocol data ratio characteristics

[0111] Multi-protocol data ratio characteristics This is a vector representing the proportion of data packets of different protocol types to the total number of data packets in the window.

[0112] Assume there are a total of Class protocol, and the first The number of class protocols is The protocol scaling vector is then:

[0113]

[0114] in, Indicates the number of protocol types. Indicates the first Class protocol in The number of data packets in each observation window.

[0115] This feature is used to reflect changes in the composition of different protocols or message types. When a certain protocol spikes or drops abnormally, it may mean that there is an anomaly in the data collection link, application service, or device behavior.

[0116] (5) Extended features

[0117] In addition to the core features mentioned above, extended features such as average processing latency, latency standard deviation, packet loss rate, duplicate packet rate, and out-of-order rate can be extracted to form a more complete health feature space.

[0118] S2, map the multidimensional health characteristics of each observation window to historical health status points in a high-dimensional health feature space, forming a sequence of historical health status points;

[0119] Specifically, after extracting all health features, the following processing is performed on all health features:

[0120] 1. Missing value imputation;

[0121] 2. Remove or truncate obviously dirty data;

[0122] 3. Uniformity of dimensions;

[0123] 4. Max-min normalization or Z-score standardization.

[0124] After normalization, the vectors are concatenated into a fixed-length feature vector according to a preset order:

[0125]

[0126] And define it as a state point. :

[0127]

[0128] The above maps the processed fixed-length feature vector to... By defining the health feature space, the data stream state points corresponding to the observation window are obtained:

[0129]

[0130] in, Indicates the first The state points corresponding to each observation window Indicates the first The health characteristics in the first Standardized values ​​under each observation window, with state points used to characterize the overall health status of the vehicle network data stream within that observation window.

[0131] Therefore, the state point Essentially, it is a coordinate representation of the overall operational status of the data stream within a certain observation window in a high-dimensional health feature space. Since each dimension of the coordinate corresponds to a specific health characteristic, the state points can uniformly characterize the health status of the data stream within that window. As time progresses, continuous state points form a state trajectory, which reflects the evolution of the data stream's operational status.

[0132] S3, based on the periodic patterns of historical health status points, uses the particle-sphere evolution algorithm to construct a dynamic benchmark health particle-sphere model by time slice;

[0133] Step S3 of this invention is to establish the spatial range of normal health status for different time scenarios. This involves time alignment and label filtering of historical health status point sequences, extracting health status point samples from historical data, and grouping them according to preset time slices. These time slices are at least based on intraday time periods and can be further overlaid with one or more scenario labels such as weekday / rest day, holiday, weather level, or regional business load level.

[0134] First, the historical health status point sequence is screened, retaining the status points corresponding to windows with no manual fault markings, no system fault records, and normal basic operation as health samples. Then, their periodic patterns are analyzed. These periodic historical patterns mainly include:

[0135] (1) Daily cycle pattern: such as morning peak, noon off-peak, evening peak, and early morning trough;

[0136] (2) Weekly cycle pattern: such as the difference between weekdays and rest days;

[0137] (3) Special day patterns: such as holidays, major event days and other special business load patterns.

[0138] The above patterns can be obtained through historical window timestamps, calendar labels, and long-term statistical mean and variance curves.

[0139] To accommodate the differences in traffic patterns across different time slices, this invention employs a time-slice modeling approach. For each time slice... Extract the corresponding set of historical health status points. ,

[0140]

[0141] Based on a set of historical health status points, a dynamic baseline health granular model corresponding to the given time slice is constructed using the granular evolution algorithm. Dynamic benchmark healthy granule model The construction process is as follows:

[0142] (1) Using time slices The corresponding set of historical health status points As input;

[0143] (2) Calculate the set of historical health status points The mean vector of the internal state points is used as the initial center vector. (i.e., the center of the granule);

[0144]

[0145] The initial center vector Each dimension in the sphere corresponds one-to-one with the corresponding feature in step S1. Therefore, the center of the sphere represents the typical value of each health feature under normal health conditions in this time slice.

[0146] (3) Calculate the vector from each state point to the initial center. Euclidean distance And calculate the mean distance. and distance standard deviation ;

[0147]

[0148] (4) Calculate the initial radius based on the mean distance and the standard deviation of the distance. (i.e., particle radius);

[0149]

[0150] in, Distance sequence The mean of the distances; This represents the standard deviation of the distance sequence, i.e., the distance standard deviation. This is the fluctuation adjustment coefficient, used to control the extent to which the normal fluctuation range is tolerated;

[0151] (5) When the newly arrived historical health sample belongs to the time slice At that time, for the initial center vector and initial radius Perform a recursive update to obtain the updated center vector. and the updated radius ;

[0152] Since the traffic patterns of vehicle-to-everything (V2X) networks are not static, this invention employs an adaptive update mechanism to continuously correct the particle parameters. When the time slice... New healthy samples have appeared. When the center vector is updated, it is done as follows: :

[0153]

[0154] Corresponding update radius :

[0155]

[0156] in, Update the step size around the center. Update the step size for the radius. This indicates the degree of dispersion of the sample distance distribution within the updated time slice; The center vector before the update; The radius before the update.

[0157] Therefore, the particle evolution algorithm in this invention is not a one-time static modeling, but a dynamic recursive update method designed in conjunction with the time-varying nature of vehicle network data streams. Its core lies in the fact that the baseline particle evolves gradually as healthy samples continuously arrive, in order to maintain the consistency between the healthy baseline model and the real business environment.

[0158] For healthy state samples with multi-peak distribution, this invention further adopts a sub-sphere partitioning mechanism to divide the original set into multiple sub-health clusters and establish multiple sub-spheres for each cluster, so as to avoid distortion of the description of the health range caused by a single sphere being too large.

[0159] (6) Based on the updated center vector and the updated radius When a time slice is detected When a multimodal health distribution exists internally, the set of historical health state points is used. The time slice is divided into multiple subsets, and multiple sub-spheres are generated for each subset. Then, based on the minimum coverage principle and stability criterion, the corresponding spheres are merged or retained to obtain the final time slice. The dynamic baseline healthy granule model.

[0160] For any time slice Its dynamic baseline healthy granule model is expressed as:

[0161]

[0162] in, A typical health status center representing the vehicle-to-everything (V2X) data stream at the corresponding time slice. It represents the permissible range of fluctuations in normal health status during this period.

[0163] Preferably, the dynamic baseline healthy granule model is associated with the time axis in the form of a piecewise function:

[0164]

[0165] in, Indicates different time intervals, This represents the baseline healthy granule parameters for the corresponding time slice.

[0166] S4. The historical health status point sequence is arranged in chronological order to form a multivariate time series input. The multivariate time series input is used as the input of the pre-built status point time series prediction model. Based on the status point time series prediction model, the position of the status point in the next observation window is predicted to obtain the predicted status point.

[0167] The purpose of step S4 in this invention is to predict where the health status of the data stream in the next observation window will fall in the high-dimensional space. Specifically, it involves using the state point sequence obtained in step S1. The multivariate time series input is constructed in chronological order, and a state point location prediction model is established for the state points in the next observation window. Make a forecast.

[0168] Due to state point The data flow operation status of the window has been comprehensively expressed; therefore, modeling the state point sequence is essentially a time-series prediction of the data flow health status. This invention can use a state point time-series prediction model, such as:

[0169] (1) Vector autoregression model, which is suitable for scenarios with strong linear coupling;

[0170] (2) Long Short-Term Memory Network Model, which is suitable for scenarios with strong nonlinearity and obvious long-term dependence;

[0171] (3) Gated loop unit model, suitable for lightweight deployment scenarios.

[0172] Preferably, the state point time series prediction model adopts a multivariate state point recursive prediction method, which will continuously predict the state point time series. The model is trained by taking the state points of each observation window as input and minimizing the error between the predicted state point and the actual state point of the next window.

[0173] Specifically, a multivariate recursive prediction model is used to jointly model the features of each dimension and output the predicted state point for the next window:

[0174]

[0175] in, Represents the time series prediction function. Indicates the length of the playback window. Indicates the first Predicted state points for each observation window.

[0176] Output the predicted state points for the next window. .because It is still a vector with the same dimension as step S1, so it represents the coordinate position of the expected overall health status of the data stream in the high-dimensional space under the next observation window.

[0177] Furthermore, to reflect the state evolution trend, the motion vector from the current state point to the predicted state point is calculated, i.e., the predicted motion vector of the state point:

[0178]

[0179] in, Indicates starting from the current state point Pointing to the predicted state point The direction and magnitude of the evolution are predicted, and this predicted motion vector is used for subsequent risk warning and judgment.

[0180] If the predicted motion vector points clearly outside the boundary of the baseline healthy particle, it indicates that although the current data stream is not abnormal, there is a risk of evolving into an anomaly.

[0181] S5. Select the corresponding dynamic baseline healthy particle model based on the time slice to which the current observation window belongs; calculate the relative spatial approximation of the real-time state point and the predicted state point relative to the selected dynamic baseline healthy particle model.

[0182] The purpose of step S5 in this invention is to quantify the deviation between the real-time state point and the predicted state point relative to the selected dynamic benchmark healthy particle model. This involves relative spatial approximation. The calculation formula is:

[0183]

[0184] in, This represents the state point to be determined, which can be a real-time state point. Or predict state point ; This represents the center vector of the baseline healthy sphere in the corresponding time slice; This represents the radius of the baseline healthy granule for the corresponding time slice; This represents the Euclidean distance between the state point and the center of the grain; This represents the normalized spatial distance of the state point relative to the healthy particle.

[0185] Step S5 specifically includes:

[0186] Based on the time slice of the current observation window Select the corresponding dynamic baseline healthy granule model Calculate the real-time state points respectively. and predicted state points Euclidean distance from the center of the grain:

[0187]

[0188]

[0189] Dividing the Euclidean distance by the radius of the sphere yields the normalized relative spatial approximation:

[0190]

[0191]

[0192] in: This indicates the real-time status point of the current observation window; Indicates the predicted state point for the next observation window; This represents the typical health status center of the vehicle-to-everything (V2X) data stream in the current time slice, i.e., the center vector of the baseline health particle corresponding to the current time slice. This indicates the allowable fluctuation range of normal health status during this period, i.e., the radius of the baseline healthy sphere corresponding to the current time slice; This represents the center distance of the real-time state point, i.e., the Euclidean distance from the real-time state point to the center of the particle; This represents the center distance of the predicted state point, i.e., the Euclidean distance from the predicted state point to the center of the particle; This represents the normalized distance of the real-time state point relative to the healthy particle; This represents the normalized distance between the predicted state point and the healthy particle.

[0193] when When, it indicates that the real-time state point is located inside the particle or on its boundary; when When this occurs, it indicates that the real-time state point has detached from the healthy particle; when This indicates that the data stream status is at risk of going out of bounds in the next observation window.

[0194] Furthermore, the relative spatial approximation includes not only the normalized distance itself mentioned above: (1) the boundary distance component, i.e. or It also includes its derivatives:

[0195] (2) Boundary deviation component

[0196] The boundary deviation component is used to characterize the extent to which a real-time state point or a predicted state point deviates from the boundary of a healthy sphere.

[0197]

[0198]

[0199] in: This represents the deviation of the real-time state point from the boundary of the healthy sphere. This indicates the deviation of the predicted state point from the boundary of the healthy sphere.

[0200] (3) Trend Approaching Component

[0201] The trend approximation component is used to characterize whether the state point moves outward from the boundary or converges towards the center from the current moment to the next moment.

[0202]

[0203] in: The trend approaches the weight. When When, it indicates that the state has a tendency to expand outwards from the boundary; when When this occurs, it indicates that the state is converging towards the center of the grain.

[0204] Therefore, the relative spatial approximation in step S5 is not a single distance value, but a comprehensive quantification of the relationship between the state and the health benchmark position, including at least three aspects: boundary distance, outbound deviation, and trend change.

[0205] S6 calculates the data stream health score based on the relative spatial approximation; and performs anomaly classification detection and risk warning based on the data stream health score, real-time status points and predicted status points.

[0206] The purpose of step S6 is to transform the geometric quantization results of step S5 into actionable health scores, risk warnings, and anomaly alerts.

[0207] First, according to , and Calculate the health score of the data stream :

[0208]

[0209] in, The relative spatial approximation of the real-time state point; For predicting the boundary deviation components of the state points; To approximate the weight of the trend; , , Let be the weighting coefficients, and satisfy: .

[0210] The above data stream health score The range of values ​​is The higher the score, the healthier the current data flow is.

[0211] Data Stream Health Score The meaning is:

[0212] (1) When the real-time state point is located inside the sphere and close to the center, Smaller, higher score;

[0213] (2) When there is a risk of the predicted state point going out of bounds, Increase, score decreases;

[0214] (3) When the future trend continues to expand outward from the boundary, The score dropped further.

[0215] Then, a grading determination is performed based on the data flow health score and boundary relationships:

[0216] 1. Health status

[0217] when and When the current state and the short-term future are both within the healthy range, it is judged as a healthy state.

[0218] in, The relative spatial approximation of the real-time state point; To predict the relative spatial approximation of the state points;

[0219] 2. Risk warning status

[0220] when and ,and Greater than the preset trend threshold If the current boundary has not been crossed, but the next window is predicted to cross the boundary and the expansion trend is obvious, it is judged as a potential congestion risk, triggering an early warning.

[0221] in, To approximate the weight of the trend;

[0222] 3. Actual Abnormal State

[0223] when And continuously exceeds the continuous window threshold When this occurs, it indicates that the current state has stabilized outside the healthy range and is not considered an occasional fluctuation. It is determined to be an actual abnormal state, and an abnormal alarm is output.

[0224] 4. Classification of Abnormal Levels

[0225] Anomalies can be classified into different levels based on their normalized approximation degree:

[0226] when At that time, it is considered a minor abnormality;

[0227] when At that time, it is considered a moderate abnormality;

[0228] when If so, it is considered a serious abnormality.

[0229] in, Represents the relative spatial approximation of real-time state points. Or predict the relative spatial approximation of the state points Any one of the following. If the predicted value exceeds the limit but the real-time value does not, output the warning level; if the real-time value exceeds the limit, output the alarm level.

[0230] In practical implementation, taking a provincial-level vehicle networking platform as an example, the system sets the observation window length. Data stream health features are extracted every minute. Selected features include total number of data packets per unit time, geographic distribution entropy, average arrival interval, standard deviation of arrival interval, protocol scaling vector, average processing latency, and packet loss rate, constituting a total of [features]. Dimensional state point.

[0231] The system filters 30 consecutive days of historical operational data, removes fault record windows, and establishes healthy sample sets according to time slices such as "weekday morning peak," "weekday afternoon off-peak," and "nighttime off-peak," and constructs corresponding dynamic baseline healthy spheres. For the current time slice, the system calculates the status point in real time. And utilize the recent Predict the next window state point from the current window state point. .

[0232] During one run, the system calculated the following:

[0233]

[0234]

[0235]

[0236] Since the current state is still within the healthy sphere, but the predicted state has crossed the boundary, and the trend approximation is greater than the preset threshold. Therefore, the system identifies this as a potential blocking risk and outputs an early warning before the actual anomaly occurs. Subsequently, if multiple consecutive windows meet the requirements... If so, the system will be further upgraded to an actual anomaly alarm.

[0237] This embodiment demonstrates that the present invention can identify the deterioration trend of data flow health status before an anomaly is fully formed, thereby providing a basis for advance intervention in the operation and maintenance system.

[0238] Therefore, this invention achieves real-time assessment and proactive early warning of the health status of vehicle network data streams through a complete technical chain: "multi-dimensional feature extraction → state point mapping → dynamic benchmark health particle model construction → state prediction → spatial approximation calculation → health scoring and anomaly classification determination." The method of this invention can adapt to the periodic fluctuations of vehicle network data streams and effectively identify real anomalies and their development trends, possessing significant practical and engineering application value.

[0239] Example 2

[0240] like Figure 2 As shown, the difference between this embodiment and Embodiment 1 is that this embodiment provides a vehicle-to-everything (V2X) data stream anomaly detection system based on a dynamic particle sphere model. This system corresponds one-to-one with the V2X data stream anomaly detection method based on a dynamic particle sphere model in Embodiment 1. The system includes:

[0241] The data acquisition and feature extraction unit is used to acquire the raw operating data of the vehicle network data pipeline within each observation window, and extract multi-dimensional health features from the raw operating data.

[0242] The state point sequence forming unit is used to map the multidimensional health characteristics of each observation window into historical health state points in a high-dimensional health feature space, thereby forming a historical health state point sequence.

[0243] The dynamic baseline healthy particle building unit is used to construct a dynamic baseline healthy particle model based on the periodic patterns of historical health status points and using the particle evolution algorithm in time slices.

[0244] The state point prediction unit is used to construct a multivariate time series input by arranging the historical health state point sequence in chronological order, and to use the multivariate time series input as the input of the pre-built state point time series prediction model. Based on the state point time series prediction model, the position of the state point in the next observation window is predicted to obtain the predicted state point.

[0245] The relative spatial approximation calculation unit is used to select the corresponding dynamic benchmark healthy particle model according to the time slice to which the current observation window belongs; and to calculate the relative spatial approximation of the real-time state point and the predicted state point relative to the selected dynamic benchmark healthy particle model.

[0246] The health scoring and risk warning unit is used to calculate the health score of the data stream based on the relative spatial approximation; and to perform anomaly classification detection and risk warning based on the data stream health score, real-time status points and predicted status points.

[0247] The execution process of each unit can be carried out according to the steps of the vehicle network data flow anomaly detection method based on dynamic particle model in Example 1, and will not be described in detail in this example.

[0248] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0249] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0250] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0251] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0252] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in vehicle network data streams based on a dynamic particle-sphere model, characterized in that, The method includes: Obtain the raw operational data of the vehicle network data pipeline within each observation window, and extract multidimensional health features from the raw operational data; The multidimensional health features of each observation window are mapped to historical health status points in a high-dimensional health feature space, forming a sequence of historical health status points. Based on the periodic patterns of the historical health status points, a dynamic benchmark healthy particle model is constructed by time slices using the particle evolution algorithm. The historical health status point sequence is arranged in chronological order to form a multivariate time series input, and the multivariate time series input is used as the input of a pre-constructed status point time series prediction model. Based on the status point time series prediction model, the position of the status point in the next observation window is estimated to obtain the predicted status point. Based on the time slice to which the current observation window belongs, select the corresponding dynamic benchmark healthy particle model; calculate the relative spatial approximation of the real-time state point and the predicted state point relative to the selected dynamic benchmark healthy particle model; Based on the relative spatial approximation, a data stream health score is calculated; and based on the data stream health score, the real-time status point, and the predicted status point, anomaly classification detection and risk warning are performed.

2. The method for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model according to claim 1, characterized in that, Obtain raw operational data of the vehicle-to-everything (V2X) data pipeline within each observation window, and extract multidimensional health features from the raw operational data, including: Obtain the raw operational data of the vehicle network data pipeline within each observation window. The raw operational data includes: total data packet information, time characteristic information, spatial distribution information, protocol distribution information, and quality auxiliary information. Multidimensional health features are extracted from the original operating data. These health features include the total number of data packets per unit time, the entropy of geographical distribution diversity, the distribution of data packet arrival time intervals, and the proportion of multi-protocol data.

3. The method for detecting anomalies in vehicle network data streams based on a dynamic particle model according to claim 1, characterized in that, The periodic patterns include at least daily, weekly, and holiday patterns, which are obtained through statistical analysis of historical health status point sequences aligned by time.

4. The method for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model according to claim 1, characterized in that, The construction process of the dynamic benchmark healthy granule model is as follows: With time slices The corresponding set of historical health status points As input; Calculate the set of historical health status points Initial center vector of internal state points ; Calculate the vector from each state point to the initial center. Find the Euclidean distance between them, and calculate the mean and standard deviation of the distance; Calculate the initial radius based on the mean and standard deviation of the distance. ; When newly arriving historical health samples belong to a time slice At that time, for the initial center vector and initial radius Perform a recursive update to obtain the updated center vector. and the updated radius ; According to the updated center vector and the updated radius When a time slice is detected When a multimodal health distribution exists internally, the set of historical health state points is used. The time slice is divided into multiple subsets, and multiple sub-spheres are generated for each subset. Then, based on the minimum coverage principle and stability criterion, the corresponding spheres are merged or retained to obtain the final time slice. The dynamic baseline healthy granule model.

5. The method for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model according to claim 1, characterized in that, The state point time series prediction model adopts any one of the following: vector autoregression model, long short-term memory network model, or gated recurrent unit model.

6. The method for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model according to claim 1, characterized in that, The relative spatial approximation of the real-time state points The expression is: ； In the formula, For real-time status points, A typical health status center representing the vehicle-to-everything (V2X) data stream at the corresponding time slice. This represents the permissible range of fluctuations in normal health status during this period; A dynamic baseline healthy granule model; The distance between the centers of the real-time status points; The relative spatial approximation of the predicted state point The expression is: ； In the formula, To predict state points, This is the center distance for predicting state points.

7. The method for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model according to claim 1, characterized in that, The relative spatial approximation includes: Boundary distance component is used to characterize the normalized distance between the real-time state point or the predicted state point and the center of the dynamic baseline healthy particle model. Boundary deviation component, used to characterize the degree to which a real-time state point or predicted state point deviates from the boundary of the dynamic baseline healthy particle model: The trend approximation component is used to characterize the speed at which a real-time state point or a predicted state point approaches or moves away from the boundary of the dynamic baseline healthy particle model.

8. The method for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model according to claim 1, characterized in that, The data stream health score The formula is: ； in, The relative spatial approximation of the real-time state point; For predicting the boundary deviation components of the state points; To approximate the weight of the trend; , , Let be the weighting coefficients, and satisfy: .

9. The method for detecting anomalies in vehicle network data streams based on a dynamic particle sphere model according to claim 1, characterized in that, Based on the data stream health score, the real-time status point, and the predicted status point, anomaly classification detection and risk warning are performed, including: when and When the time is right, it is considered a healthy state; among them, The relative spatial approximation of the real-time state point; To predict the relative spatial approximation of the state points; when and ,and Greater than the preset trend threshold When this occurs, it is determined to be a potential risk state, triggering an early warning; among which, To approximate the weight of the trend; when And continuously exceeds the continuous window threshold If the condition is as described above, it is determined to be an actual abnormal state, and an abnormal alarm is output; and according to... or The magnitude of the abnormal state is used to classify its severity: like If so, it is a level one minor abnormality; if If so, it is classified as a level two moderate abnormality; if If so, it is classified as a level three severe abnormality; among them, Represents the relative spatial approximation of real-time state points. Or predict the relative spatial approximation of the state points Any one of them.

10. A vehicle-to-everything (V2X) data stream anomaly detection system based on a dynamic particle-sphere model, characterized in that, The system includes: The data acquisition and feature extraction unit is used to acquire the raw operating data of the vehicle network data pipeline in each observation window, and extract multi-dimensional health features from the raw operating data. The state point sequence forming unit is used to map the multidimensional health characteristics of each observation window into historical health state points in a high-dimensional health feature space, thereby forming a historical health state point sequence. The dynamic benchmark healthy particle construction unit is used to construct a dynamic benchmark healthy particle model by time slice based on the periodic pattern of the historical health state points and using the particle evolution algorithm. The state point prediction unit is used to construct a multivariate time series input by arranging the historical health state point sequence in chronological order, and to use the multivariate time series input as the input of a pre-constructed state point time series prediction model. Based on the state point time series prediction model, the state point position of the next observation window is estimated to obtain the predicted state point. The relative spatial approximation calculation unit is used to select the corresponding dynamic benchmark healthy particle model according to the time slice to which the current observation window belongs; and to calculate the relative spatial approximation of the real-time state point and the predicted state point relative to the selected dynamic benchmark healthy particle model. The health scoring and risk warning unit is used to calculate the data stream health score based on the relative spatial approximation; and to perform anomaly classification detection and risk warning based on the data stream health score, the real-time status point and the predicted status point.

Images