AI real-time early warning method based on internet of vehicles jtt808 protocol

Abstract

The application provides an AI real-time early warning method based on a vehicle networking JTT808 protocol, comprising the following steps: S1: log collection and E2E-ID identification extraction; S2: link aggregation and bidirectional association; S3: node index storage and link index aggregation analysis; S4: AI early warning analysis; S5: client data visualization interaction and display; the application realizes automatic bidirectional association of uplink and downlink by generating a globally unique E2E-ID and transmitting and inheriting, combines with an associated ID to form a unified full-link track, does not need manual association, and improves fault troubleshooting efficiency; meanwhile, probes are deployed at four types of nodes to collect fine-grained data, a node list and an edge list are generated, end-to-end node observation is realized through multi-view visualization, and an abnormal node is accurately located.

Description

Technical Field

[0001] This invention relates to the field of vehicle networking technology, and in particular to an AI real-time early warning method based on the vehicle networking JTT808 protocol. Background Technology

[0002] With the rapid development of the Internet of Things (IoT), cloud computing, and edge computing, modern data systems generally adopt a complex three-layer or multi-layer architecture of "terminal-gateway-cloud." In typical scenarios such as connected vehicles, industrial IoT, and smart cities, data transmission links typically include uplinks and downlinks. The uplink involves data collected by terminal devices, aggregated by the gateway, and processed by the parsing service. Data is stored on disk; the downlink involves cloud-based commands that are parsed, routed by the service, forwarded by the gateway, and then executed by the terminal device; this bidirectional link architecture ensures system observability, and operations and maintenance personnel need to monitor key information such as data transmission status, latency, command issuance, and terminal response in real time. Currently, some end-to-end tracing technologies have emerged in the industry, such as Zipkin and Jaeger based on distributed tracing, as well as cloud-native observability platforms like DataBuFF and ChengYun Digital. These technologies generate unified transaction IDs or request IDs to achieve link association across service calls. At the same time, AI-based anomaly detection technologies have also begun to be applied in the field of operation and maintenance monitoring, such as using the Transformer architecture for time series prediction and using reinforcement learning to dynamically adjust early warning thresholds. Although end-to-end tracking and AI-based early warning technologies have been applied, existing systems still have the following drawbacks in the monitoring of bidirectional data links using the JTT808 protocol in vehicle-to-everything (V2X) networks: One-way tracking is the main method, and the uplink and downlink links are isolated from each other: The existing full-link tracking technology mainly monitors one-way data flow. The uplink data link and the downlink command link adopt independent tracking mechanisms and do not establish a correlation between the uplink and downlink links. When problems such as commands are issued but the terminal does not respond or data is reported but not received by the cloud occur, the operation and maintenance personnel need to query the uplink and downlink logs separately and manually correlate and analyze them, which results in low efficiency in troubleshooting. Link visualization is coarse-grained and lacks end-to-end node-by-node details: Existing monitoring systems mostly display links using service topology diagrams, where nodes only represent overall service units such as gateways and parsing services. They cannot present the specific status of a single piece of data or a single instruction in each link of the link, making it difficult to locate the specific node where a particular data transmission fails or an instruction is discarded. Summary of the Invention

[0003] The purpose of this invention is to address the shortcomings of existing technologies by proposing an AI real-time early warning method based on the JTT808 protocol for vehicle networking.

[0004] To achieve the above objectives, the present invention adopts the following technical solution: The AI ​​real-time early warning method based on the JTT808 protocol for vehicle-to-everything (V2X) communication includes the following steps: S1: Log collection and E2E-ID extraction; Includes the following sub-steps: S11: Collect transmission link logs; Log collection probes are deployed on the nodes of the transmission link, including four types of nodes: terminal nodes, gateway nodes, parsing service nodes, and storage system nodes. The log collection probe captures uplink data transmission events or downlink command transmission events in real time through the JTT808 protocol message processing interface and data transmission channel of the listening node, and extracts transmission event information synchronously. The transmission event information includes timestamps, node identifiers, link transmission direction, data / instruction identifiers, status codes, node latency, metadata, etc.; the data / instruction identifiers include service IDs, etc. The link transmission direction includes uplink and downlink; the node latency is the difference between the time it takes for a message to enter the node and the time it takes for a message to leave the node; the status code corresponds to the node processing result, including success, failure, timeout, etc. If the transmitted event information contains an E2E-ID identifier, then the E2E-ID identifier is extracted synchronously. S12: Generate and transmit the E2E-ID identifier; When data or instructions first enter the transmission link, that is, when the terminal initiates uplink data transmission or the cloud initiates downlink instruction transmission, the E2E-ID generator generates a globally unique end-to-end tracking identifier, namely the E2E-ID identifier. After the E2E-ID identifier is generated, it is transmitted between nodes through the message protocol header. The message protocol header includes the HTTP protocol message header and the MQTT protocol user-defined attributes. When each node processes a message request, it extracts the E2E-ID identifier from the corresponding message protocol header and associates the E2E-ID identifier with the corresponding node's log record. The log record includes the corresponding timestamp, node ID, and node-level metrics. When the cloud sends downlink commands in response to the terminal's uplink data request, it retrieves the E2E-ID identifier corresponding to the uplink data and uses that E2E-ID identifier in the downlink command message. At the same time, it generates a unique association ID to identify the correspondence between the downlink command and the uplink data request. S2: Link aggregation and bidirectional association; Includes the following sub-steps: S21: Link aggregation based on E2E-ID identifier; The link aggregation analyzer uses E2E-ID identifiers as the grouping basis and collects the log records corresponding to each E2E-ID identifier. For the same E2E-ID identifier, it uses the timestamp of each log record as the sorting basis to determine the order in which the message flows through each node, extracts relevant information of each node, and generates a complete link access trajectory. The link access trajectory includes E2E-ID identifier, link transmission direction, node sequence, total link time, associated ID, service ID, link start time, and link end time; The node sequence refers to the node order obtained by sorting all log records corresponding to the same E2E-ID according to timestamps; it includes node ID, entry time, departure time, node timeout, and status code; where the entry time is the time when the message arrives at the corresponding node, and the departure time is the time when the message completes processing and leaves the node; The total link time is the total duration between the entry time of the first node in the node sequence and the departure time of the last node. And generate a list of nodes and a list of edges; S22: Uplink and downlink bidirectional association; Based on the link transmission direction, the access trajectories of each link obtained by aggregation in step S21 are classified into uplink and downlink; a bidirectional correlator establishes the mapping relationship between uplink and downlink; After all links have been traversed, links that fail to establish uplink / downlink mapping relationships or fail to establish same-source link mapping relationships are determined to be unassociated links. All successfully matched uplink and downlink data are stored in the link association table; the relevant data includes the E2E-ID identifier, association time, and service type of the uplink and downlink.

[0005] S3: Node metric storage and link metric aggregation analysis; Includes the following sub-steps: S31: Extract node-level metrics and save them to the time series database; Based on the associated and unassociated links obtained in step S22, the corresponding node IDs are extracted from the node sequences contained in the access trajectories of each link, and the corresponding node-level metrics are extracted from the log records based on the node IDs; the node-level metrics include latency, throughput, error rate, etc. Each node ID is used as a real-time node-level indicator and saved to a time-series database in the order of timestamps recorded in the logs; the time-series database also contains historical node-level indicators. S32: Aggregated link-level metrics; Pre-divide continuous and non-overlapping time windows, the time windows including start time, end time, duration specifications, etc. The system retrieves real-time node-level metrics stored in the time-series database and compares the timestamps of the log records corresponding to the real-time node-level metrics with the start and end time ranges of each time window. If the timestamp of the log record falls between the start and end times of a certain time window, the real-time node-level metric is assigned to the corresponding time window. After completing the assignment matching of all real-time node-level metrics in sequence, the system performs data aggregation and statistics within each time window to obtain the link-level metrics for each time window, including the total number of links, transmission success rate, average latency, and P99 latency. Simultaneously, statistics are performed based on node IDs, and the average processing time of nodes within each group is calculated to obtain the average processing time of each node; the error rates within each group are summarized, the arithmetic mean is calculated, and the overall error rate of each node is obtained.

[0006] S4: Perform AI-based early warning analysis; Extract historical node-level indicators from the time series database, divide the historical node-level indicators according to a preset time window and perform standardization processing to construct a time series input sequence; A time series prediction model is built using an LSTM (Long Short-Term Memory) network or a Transformer structure. The time series input sequence is fed into the time series prediction model, and the time series prediction model outputs the predicted values ​​of node-level indicators for multiple future time windows, as well as the corresponding prediction standard deviation and confidence interval; the prediction standard deviation is not 0. Read real-time node-level indicators from the time series database, compare the real-time node-level indicators with the predicted values ​​and confidence intervals of the node-level indicators for the corresponding time window output by the time series prediction model, and calculate the anomaly score. Anomaly score = (Actual value of real-time node-level indicator - Predicted value of node-level indicator) / Prediction standard deviation; The actual value of the real-time node-level indicator is the specific value of the real-time node-level indicator stored in the time-series database. The abnormal score is compared with a pre-set abnormal threshold. If it is less than the abnormal threshold, no warning is triggered; otherwise, an abnormal warning is triggered. The timestamp corresponding to the real-time node-level indicator that triggers the anomaly warning is taken as the time of the anomaly occurrence. Historical node-level indicators before and after the time of the anomaly occurrence are extracted from the time series database to obtain the indicator changes of the same node-level indicator. The changes in the same real-time node-level indicator are used as input data for the attention mechanism. The attention mechanism assigns weighted scores to the changes in the real-time node-level indicator through preset weights, thereby obtaining the contribution weight of each real-time node-level indicator to the current anomaly. Sort the nodes by contribution weight from high to low, select the top n nodes with the highest contribution weight as the root cause candidate set, designate the node with the highest weight in the candidate set as the abnormal node, and the other nodes in the root cause candidate set as root cause candidates; n is a set positive integer. Thresholds for latency, throughput, and error rate are preset. When the abnormal score of any of the real-time node-level metrics, such as latency, throughput, and error rate, exceeds the corresponding threshold, the category corresponding to that metric is determined as an abnormal type. The abnormal types include latency abnormality, error rate abnormality, and throughput abnormality. The abnormality type, abnormal node, root cause candidate, abnormal occurrence time, and abnormal indicator value are encapsulated into early warning information, stored in the early warning history table, and pushed to the client for display and alarm in real time.

[0007] S5: Client-side data visualization, interaction, and display; The client obtains data such as node list, edge list, link access trajectory, and early warning information from the cloud through the interface. The visualization rendering engine generates link topology diagrams, time-series Gantt charts, single link tracking lists, and AI early warning panels. It supports node drill-down to view details, timeline filtering, uplink and downlink association display, and automatic location of abnormal nodes when clicking on early warnings, realizing multi-view linkage interaction and real-time alarm display.

[0008] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention generates a globally unique E2E-ID identifier when the link is first accessed and transmits it transparently in the message protocol header; when the cloud responds to uplink data, it inherits the E2E-ID and generates an associated ID to bind the uplink and downlink correspondence; the logs are aggregated based on the E2E-ID, and the bidirectional correlator automatically establishes the uplink and downlink link mapping relationship and the same source business link mapping relationship, forming a unified full-link access trajectory, realizing integrated uplink and downlink tracking, eliminating the need for manual association, and significantly improving the efficiency of fault diagnosis; Log collection probes are deployed on four types of nodes: terminals, gateways, parsing services, and storage systems. These probes capture data such as timestamps, node identifiers, status codes, and node latency in real time. Node and edge lists are generated by sorting by E2E-ID and timestamp to reconstruct the flow order, processing status, and latency of a single message across nodes. Clients can view these data through multiple views, including link topology diagrams, time-series Gantt charts, and single-link tracing lists. This supports node drill-down and anomaly localization, enabling end-to-end, node-by-node, fine-grained observability and precise location of specific nodes where data transmission failed or commands were dropped. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating the steps of the AI ​​real-time early warning method based on the JTT808 protocol for vehicle networking of the present invention. Detailed Implementation

[0010] To provide a further understanding of the purpose, structure, features, and functions of the present invention, detailed descriptions are provided below with reference to specific embodiments.

[0011] like Figure 1 As shown, the AI ​​real-time early warning method based on the JTT808 protocol for vehicle networking includes the following steps: S1: Log collection and E2E-ID extraction; Includes the following sub-steps: S11: Collect link logs; Log collection probes are deployed on various nodes of the link, including four types of nodes: terminal nodes, gateway nodes, parsing service nodes, and storage system nodes. The log collection probe captures uplink data transmission events or downlink command transmission events in real time by listening to the JTT808 protocol message processing interface and data transmission channel of the node, and extracts transmission event information in a synchronous manner. The transmission event information includes timestamp, node identifier, link transmission direction, data / command identifier, E2E-ID identifier, status code, node time consumption, metadata, etc. Specifically, the timestamp is the time when the transmission event occurred; The node identifier includes the node ID and the node type; The link transmission direction includes uplink and downlink; The data / instruction identifiers include the original message ID inherent in the JTT808 protocol message and the business ID used for business association on the platform side; The E2E-ID identifier is an end-to-end tracking identifier; The status code corresponds to the node processing result, including success, failure, timeout, etc. The node latency is the difference between the time it takes for a message to enter the node and the time it takes for the message to leave the node. The metadata includes data size, number of retries, error messages, etc. If the transmitted event information contains an E2E-ID identifier, then the E2E-ID identifier is extracted synchronously. S12: Generate and transmit the E2E-ID identifier; When data or instructions first enter the transmission link, that is, when the terminal initiates uplink data transmission or the cloud initiates downlink instruction transmission, the E2E-ID generator generates a globally unique end-to-end tracking identifier, namely the E2E-ID identifier. Furthermore, the E2E-ID generator generates E2E-ID identifiers based on E2E-ID identifier generation rules; the E2E-ID identifier generation rules are: {service type}-{timestamp}-{random number}-{node ID}; The timestamp is the current time obtained from the system clock when the E2E-ID generator generates the E2E-ID identifier; The random number is a random character generated by a random algorithm; The node ID is either the terminal node ID that initiates the uplink data transmission for the first time or the cloud node ID that initiates the downlink command transmission for the first time. After the E2E-ID identifier is generated, it is transmitted transparently between nodes through the message protocol header. The message protocol header includes the HTTP protocol message header and the MQTT protocol user-defined attributes. When using HTTP channel transmission, the E2E-ID identifier is written into the custom field X-E2E-ID in the HTTP Header. When using MQTT channel transmission, the E2E-ID identifier is written into the e2e_id field in the MQTT protocol User Property attribute. Specifically, when a node generates a local transmission event log, it extracts the E2E-ID identifier from the corresponding message protocol header and writes the extracted E2E-ID identifier as a log field into the log data, so that the logs generated by all nodes on a single link carry the same E2E-ID identifier, thereby achieving full-link log binding and association.

[0012] When the cloud sends downlink commands to respond to the terminal's uplink data request, it retrieves the E2E-ID identifier corresponding to the uplink data and uses this E2E-ID identifier in the downlink command message to achieve the inheritance of the E2E-ID identifier; at the same time, it generates a unique association ID, which is distributed and stored in the uplink log and downlink log to establish the corresponding association between downlink commands and uplink data requests. S2: Link aggregation and bidirectional association; Includes the following sub-steps: S21: Link aggregation based on E2E-ID identifier; The link aggregation analyzer collects all log records containing E2E-ID identifiers, uses the timestamp of each log record as the sorting basis to determine the order in which packets flow through each node, extracts relevant information from each node, and generates a complete link access trajectory. The link access trajectory includes E2E-ID identifier, link transmission direction, node sequence, total link time, and associated ID; The node sequence refers to the node order obtained by sorting all log records corresponding to the same E2E-ID according to timestamps; it includes node ID, entry time, departure time, node timeout, and status code; where the entry time is the time when the message arrives at the corresponding node, and the departure time is the time when the message completes processing and leaves the node; The total link time is the total duration between the entry time of the first node in the node sequence and the departure time of the last node. Meanwhile, using E2E-ID identifier as the dimension, all log records corresponding to the same E2E-ID identifier are aggregated, sorted according to the order of timestamps in the log records, and information such as node ID, node type, status code, and node time consumption of each log is extracted, deduplicated, and integrated according to the flow order to obtain the node list corresponding to the link access trajectory. According to the flow order of the nodes in the node list, the adjacent previous node is pointed to the next node in turn to build the transmission relationship between the nodes and form the edge list corresponding to the access trajectory of the link.

[0013] S22: Uplink and downlink bidirectional association; Based on the link transmission direction, the access trajectories of each link obtained by aggregation in step S21 are classified into uplink and downlink; a bidirectional correlator establishes the mapping relationship between uplink and downlink; Specifically, the bidirectional correlator traverses all uplinks and downlinks. If the request response of any downlink carries the E2E-ID identifier of the corresponding uplink, then the downlink and the corresponding uplink are determined to be associated links, an uplink-downlink mapping relationship is established, and the association time is generated synchronously. For uplink and downlink links that have not established an uplink-downlink mapping relationship, if the uplink and downlink links have the same service ID and the start time of the downlink link is later than the end time of the uplink link, then the two are determined to be the same source service links, and a same source link mapping relationship is established and an associated time is generated synchronously; the same source service links are associated links. After all links have been traversed, links that fail to establish uplink / downlink mapping relationships or fail to establish same-source link mapping relationships are determined to be unassociated links. All successfully matched uplink and downlink data are stored in the link association table; the relevant data includes the E2E-ID identifier, association time, and service type of the uplink and downlink. The service type corresponds to the link transmission direction. When it is uplink data transmission, the service type is "UP"; when it is downlink command transmission, the service type is "DOWN".

[0014] S3: Node metric storage and link metric aggregation analysis; Includes the following sub-steps: S31: Extract node-level metrics and save them to the time series database; Based on the associated and unassociated links obtained in step S22, the corresponding node IDs are extracted from the node sequences contained in the access trajectories of each link, and the corresponding node-level metrics are extracted from the log records based on the node IDs; the node-level metrics include latency, throughput, error rate, etc. Each node ID is used as a real-time node-level indicator and saved to a time-series database in the order of timestamps recorded in the logs; the time-series database also contains historical node-level indicators. S32: Aggregated link-level metrics; Pre-defined continuous and non-overlapping time windows are constructed, including a start time, an end time, and a duration specification; the duration specification includes 1 minute, 5 minutes, 1 hour, etc. The system retrieves real-time node-level metrics stored in the time-series database and compares the timestamps of the log records corresponding to the real-time node-level metrics with the start and end time ranges of each time window. If the timestamp of the log record falls between the start and end times of a certain time window, the real-time node-level metric is assigned to the corresponding time window. After completing the assignment matching of all real-time node-level metrics in sequence, the system performs data aggregation and statistics within each time window to obtain the link-level metrics for each time window, including the total number of links, transmission success rate, average latency, and P99 latency. Specifically, the total number of links is obtained by deduplicating the links corresponding to all node-level indicators within each time window. Transmission success rate: For each time window, iterate through all node-level indicators corresponding to each link it contains, and use the node status code as the basis for determining the transmission status. If all nodes in the link are in a successful state, the link is a normal and valid link; otherwise, it is an abnormal and invalid link. Count the number of normal and valid links in each time window. The transmission success rate is calculated as follows: (Number of normal and valid links / Total number of links in each time window) Average delay: For each time window, the average delay is obtained by taking the arithmetic average of all delays contained within the time window; P99 Delay: For each time window, sort all delays contained within the time window in ascending order of numerical value, and take the 99th percentile value, that is, the one that is ranked after the 99th position and only the 1% data is larger, which is the P99 delay. Simultaneously, statistics are performed based on node IDs, and the average processing time of nodes within each group is calculated to obtain the average processing time of each node. The error rates within each group are summarized, and the arithmetic mean is calculated to obtain the comprehensive error rate of each node. Furthermore, the various indicators of uplink and downlink within the same time window are compared and analyzed.

[0015] S4: Perform AI-based early warning analysis; Extract historical node-level indicators from the time series database, divide the historical node-level indicators according to a preset time window and perform standardization processing to construct a time series input sequence; A time series prediction model is built using an LSTM (Long Short-Term Memory) network or a Transformer structure. The time series input sequence is fed into the time series prediction model, and the time series prediction model outputs the predicted values ​​of node-level indicators for multiple future time windows, as well as the corresponding prediction standard deviation and confidence interval; the prediction standard deviation is not 0. Read real-time node-level indicators from the time series database, compare the real-time node-level indicators with the predicted values ​​and confidence intervals of the node-level indicators for the corresponding time window output by the time series prediction model, and calculate the anomaly score. Anomaly score = (Actual value of real-time node-level indicator - Predicted value of node-level indicator) / Prediction standard deviation; The actual value of the real-time node-level indicator is the specific value of the real-time node-level indicator stored in the time-series database. The abnormal score is compared with a pre-set abnormal threshold. If it is less than the abnormal threshold, no warning is triggered; otherwise, an abnormal warning is triggered. The timestamp corresponding to the real-time node-level indicator that triggers the anomaly warning is taken as the time of the anomaly occurrence. Historical node-level indicators before and after the time of the anomaly occurrence are extracted from the time series database to obtain the indicator changes of the same node-level indicator. The changes in the same real-time node-level indicator are used as input data for the attention mechanism. The attention mechanism assigns weighted scores to the changes in the real-time node-level indicator through preset weights, thereby obtaining the contribution weight of each real-time node-level indicator to the current anomaly. Sort the nodes by contribution weight from high to low, select the top n nodes with the highest contribution weight as the root cause candidate set, designate the node with the highest weight in the candidate set as the abnormal node, and the other nodes in the root cause candidate set as root cause candidates; n is a set positive integer. Thresholds for latency, throughput, and error rate are preset. When the abnormal score of any of the real-time node-level metrics, such as latency, throughput, and error rate, exceeds the corresponding threshold, the category corresponding to that metric is determined as an abnormal type. The abnormal types include latency abnormality, error rate abnormality, and throughput abnormality. The abnormality type, abnormal node, root cause candidate, abnormal occurrence time, and abnormal indicator value are encapsulated into early warning information, stored in the early warning history table, and pushed to the client for display and alarm in real time.

[0016] S5: Client-side data visualization, interaction, and display; The client obtains data such as node list, edge list, link access trajectory, and early warning information from the cloud through the interface. The visualization rendering engine generates link topology diagrams, time-series Gantt charts, single link tracking lists, and AI early warning panels. It supports node drill-down to view details, timeline filtering, uplink and downlink association display, and automatic location of abnormal nodes when clicking on early warnings, realizing multi-view linkage interaction and real-time alarm display. Link topology rendering: The client obtains the node list and edge list through the interface, uses a hierarchical layout algorithm to arrange the uplink and downlink respectively, and uses Canvas to draw the nodes and transmission links, supporting switching between global topology view and single link tracing view; End-to-end link tracing: Displays link information in list format, supports multi-dimensional filtering; generates time-series Gantt charts based on selected links, graphically presenting the time consumption and status of each node; matches and displays corresponding uplink and downlink links based on relationships, using lines to identify association attributes; AI Early Warning Display: Receives real-time early warning information from the cloud via a long connection and presents it in a list. Responding to the early warning by clicking on the warning will switch to the corresponding link view, highlighting abnormal nodes and displaying indicator comparison curves.

[0017] Interaction and linkage: Responding to node clicks pops up a details panel; Time-axis filtering enables multi-view data synchronization; Responding to root cause node clicks retrieves log information for the corresponding time period, achieving global linkage and rapid location.

[0018] This invention uses time-series analysis and prediction models to achieve dynamic threshold early warning, replacing traditional static threshold alarms. This can significantly reduce the false alarm rate and improve the accuracy of early warning. At the same time, it calculates the contribution weight of each node to the anomaly and outputs root cause recommendations, eliminating the need for manual investigation and shortening the root cause location time, thus significantly improving the efficiency of anomaly handling.

[0019] This invention enables multi-view interactive linkage through link topology diagrams, E2E link tracing tables, time-series Gantt charts, and AI early warning panels. It supports simple operations such as clicking and dragging, and allows for quick switching between global and single-link views, as well as normal and abnormal events. The average time for maintenance personnel to locate problems from opening the platform is shortened, significantly improving maintenance troubleshooting efficiency and ease of use.

[0020] The present invention has been described in the above-described embodiments; however, these embodiments are merely examples for implementing the present invention. It must be noted that the disclosed embodiments do not limit the scope of the present invention. Conversely, any modifications and refinements made without departing from the spirit and scope of the present invention are within the scope of patent protection of the present invention.

Claims

1. An AI real-time early warning method based on the JTT808 protocol for vehicle networking, characterized in that: Includes the following steps: S1: Log collection and E2E-ID extraction; S11: Collect transmission link logs; Deploy log collection probes on the nodes of the transmission link to capture uplink data transmission events or downlink command transmission events in real time, and extract transmission event information synchronously. S12: Generate and transmit the E2E-ID identifier; When data or instructions first enter the transmission link, that is, when the terminal initiates uplink data transmission or the cloud initiates downlink instruction transmission, the E2E-ID generator generates a globally unique E2E-ID identifier; and transmits it transparently between nodes through the message protocol header; S2: Link aggregation and bidirectional association; S21: Link aggregation based on E2E-ID identifier; The link aggregation analyzer uses E2E-ID identifiers as the grouping basis and collects the log records corresponding to each E2E-ID identifier. For the same E2E-ID identifier, it uses the timestamp of each log record as the sorting basis to determine the order in which the message flows through each node, extracts relevant information of each node, and generates a complete link access trajectory. S22: Uplink and downlink bidirectional association; S3: Node metric storage and link metric aggregation analysis; S31: Extract node-level metrics and save them to the time series database; The node-level metrics include latency, throughput, and error rate; S32: Aggregated link-level metrics; S4: Perform AI-based early warning analysis; The time series input sequence is constructed based on historical node-level indicators in the time series database. The predicted value, prediction standard deviation and confidence interval are output using LSTM or Transformer model. The anomaly score is obtained and compared with the threshold to determine whether an anomaly warning is triggered. If an alert is triggered, the corresponding alert information will be packaged and pushed to the client for display and notification. S5: Client-side data visualization, interaction, and display.

2. The AI ​​real-time early warning method based on the JTT808 protocol for vehicle networking as described in claim 1, characterized in that: The specific details of step S1 are as follows: S11: Collect transmission link logs; The system includes four node types: terminal nodes, gateway nodes, parsing service nodes, and storage system nodes; transmission event information includes timestamps, node identifiers, link transmission direction, data / instruction identifiers, status codes, and node latency; the data / instruction identifiers include service IDs; The link transmission direction includes uplink and downlink; the status code corresponds to the node processing result, including success, failure, and timeout; If the transmitted event information contains an E2E-ID identifier, then the E2E-ID identifier is extracted synchronously. S12: Generate and transmit the E2E-ID identifier; When processing a message request, each node extracts the E2E-ID identifier from the corresponding message protocol header and associates the E2E-ID identifier with the corresponding node's log record; the log record includes the corresponding timestamp, node ID, and node-level metrics; When the cloud sends downlink commands in response to the terminal's uplink data request, it retrieves the E2E-ID identifier corresponding to the uplink data and uses that E2E-ID identifier in the downlink command message. At the same time, it generates a unique association ID to identify the correspondence between the downlink command and the uplink data request.

3. The AI ​​real-time early warning method based on the JTT808 protocol for vehicle networking as described in claim 1, characterized in that: The specific details of step S2 are as follows: S21: Link aggregation based on E2E-ID identifier; The link access trajectory includes E2E-ID identifier, link transmission direction, node sequence, total link time, associated ID, service ID, link start time, and link end time; The node sequence refers to the node order obtained by sorting all log records corresponding to the same E2E-ID by timestamp; it includes node ID, entry time, exit time, node duration, and status code for each node; The total link time is the total duration between the entry time of the first node in the node sequence and the departure time of the last node. Meanwhile, using E2E-ID identifier as the dimension, all log records corresponding to the same E2E-ID identifier are aggregated, sorted according to the order of timestamps in the log records, and the node ID, node type, status code, and node time consumption information of each log are extracted, deduplicated, and integrated according to the flow order to obtain the node list corresponding to the link access trajectory. According to the flow order of the nodes in the node list, the adjacent previous node is pointed to the next node in turn to build the transmission relationship between the nodes and form the edge list corresponding to the access trajectory of the link. S22: Uplink and downlink bidirectional association; Based on the link transmission direction, the access trajectories of each link obtained by aggregation in step S21 are classified into uplink and downlink; a bidirectional correlator establishes the mapping relationship between uplink and downlink; The mapping relationships include uplink / downlink mapping relationships and same-source link mapping relationships; The relevant data of the uplink and downlink that establish the mapping relationship are stored in the link association table; the relevant data includes the E2E-ID identifier of the uplink and downlink, and the association time.

4. The AI ​​real-time early warning method based on the JTT808 protocol for vehicle networking as described in claim 1, characterized in that: The specific details of step S3 are as follows: S31: Extract node-level metrics and save them to the time series database; Based on the associated and unassociated links obtained in step S22, extract the corresponding node IDs from the node sequences contained in the access trajectories of each link, and extract the corresponding node-level metrics from the log records based on the node IDs. Each node ID is used as a real-time node-level indicator and saved to a time-series database in the order of timestamps recorded in the logs; the time-series database also contains historical node-level indicators. S32: Aggregated link-level metrics; Pre-divide continuous and non-overlapping time windows, wherein the time window includes a start time, an end time, and a duration specification; Retrieve real-time node-level metrics stored in the time series database, compare the timestamps of the log records corresponding to the real-time node-level metrics with the start and end time ranges of each time window, and if the timestamp of the log record falls between the start and end time of a certain time window, then classify the real-time node-level metrics into the corresponding time window. Once the attribution matching of all real-time node-level metrics is completed in sequence, data aggregation and statistics are performed within each time window to obtain the link-level metrics for each time window, including the total number of links, transmission success rate, average latency, and P99 latency. Simultaneously, statistics are grouped according to node ID, and the average processing time of nodes in each group is calculated to obtain the average processing time of each node. The error rates within each group are summarized, the arithmetic mean is calculated, and the overall error rate of each node is obtained.

5. The AI ​​real-time early warning method based on the JTT808 protocol for vehicle networking as described in claim 1, characterized in that: The specific details of step S4 are as follows: Extract historical node-level indicators from the time series database, divide the historical node-level indicators according to a preset time window and perform standardization processing to construct a time series input sequence; A time series prediction model is built using an LSTM (Long Short-Term Memory) network or a Transformer structure. The time series input sequence is fed into the time series prediction model, and the time series prediction model outputs the predicted values ​​of node-level indicators for multiple future time windows, as well as the corresponding prediction standard deviation and confidence interval; the prediction standard deviation is not 0. Read real-time node-level indicators from the time series database, compare the real-time node-level indicators with the predicted values ​​and confidence intervals of the node-level indicators for the corresponding time window output by the time series prediction model, and calculate the anomaly score. Anomaly score = (Actual value of real-time node-level indicator - Predicted value of node-level indicator) / Prediction standard deviation; The actual value of the real-time node-level indicator is the specific value of the real-time node-level indicator stored in the time-series database. The abnormal score is compared with a pre-set abnormal threshold. If it is less than the abnormal threshold, no warning is triggered; otherwise, an abnormal warning is triggered. The timestamp corresponding to the real-time node-level indicator that triggers the anomaly warning is taken as the time of the anomaly occurrence. Historical node-level indicators before and after the time of the anomaly occurrence are extracted from the time series database to obtain the indicator changes of the same node-level indicator. The changes in the same real-time node-level indicator are used as input data for the attention mechanism. The attention mechanism assigns weighted scores to the changes in the real-time node-level indicator through preset weights, thereby obtaining the contribution weight of each real-time node-level indicator to the current anomaly. Sort the nodes by contribution weight from high to low, select the top n nodes with the highest contribution weight as the root cause candidate set, designate the node with the highest weight in the candidate set as the abnormal node, and the other nodes in the root cause candidate set as root cause candidates; n is a set positive integer. Thresholds for latency, throughput, and error rate are preset. When the abnormal score of any of the real-time node-level metrics, such as latency, throughput, and error rate, exceeds the corresponding threshold, the category corresponding to that metric is determined as an abnormal type. The abnormal types include latency abnormality, error rate abnormality, and throughput abnormality. The abnormality type, abnormal node, root cause candidate, abnormal occurrence time, and abnormal indicator value are encapsulated into early warning information, stored in the early warning history table, and pushed to the client for display and alarm in real time.

6. The AI ​​real-time early warning method based on the JTT808 protocol for vehicle networking as described in claim 1, characterized in that: The client obtains node lists, edge lists, link access trajectories, and early warning information data from the cloud through an interface. The visualization rendering engine then generates link topology diagrams, time-series Gantt charts, single-link tracking lists, and AI early warning panels, enabling multi-view interactive linkage and real-time alarm display.

Images