Intelligent vehicle anomaly detection method and system based on LSTM and spatio-temporal feature fusion

Abstract

The application relates to the field of intelligent networked vehicle safety and communication technology, in particular to an intelligent vehicle anomaly detection method and system based on LSTM and space-time feature fusion, original message data of a vehicle-mounted network is collected and pretreated; individual time sequence feature vectors are extracted through an LSTM layer; a logical space topology graph is constructed based on communication correlation between messages, and a space neighborhood feature vector is extracted; similarity retrieval is carried out in a pre-constructed abnormal behavior knowledge base by taking real-time features as query vectors, and a knowledge-enhanced feature vector is extracted; three types of features are weighted and fused by adopting a multi-head attention mechanism, and a global space-time enhanced feature representation is generated; and an anomaly type recognition result is output by inputting a classification layer. By fusing time sequence features, space topology correlation and a historical knowledge base, the application significantly improves the detection accuracy, robustness and explainability of complex unknown intrusion behaviors, and is suitable for full-cycle real-time safety monitoring of intelligent vehicles.

Description

Technical Field

[0001] This invention relates to the field of intelligent connected vehicle safety and communication technology, and in particular to an intelligent vehicle anomaly detection method and system based on LSTM and spatiotemporal feature fusion. Background Technology

[0002] Against the backdrop of the automotive industry's rapid transformation towards intelligence and connectivity, intelligent connected vehicles (ICVs) have evolved into highly integrated, software-defined mobile intelligent terminals. The in-vehicle network, as the core link connecting sensors, electronic control units (ECUs), and actuators, carries critical data related to driving safety, autonomous driving decisions, and user privacy. Currently, Controller Area Networks (CAN) and its enhanced version (CAN-FD) still dominate the in-vehicle backbone network due to their superior real-time performance, determinism, and cost-effectiveness.

[0003] However, the CAN / CAN-FD protocol was initially designed primarily for real-time performance and robustness, with little consideration for network security. Due to the lack of source address verification, data encryption, and access control mechanisms, the vehicle bus is highly vulnerable to malicious attacks originating from interfaces such as OBD-II, T-Box, or in-vehicle infotainment systems (IVI). Attackers can inject forged messages, replay historical commands, or attempt to traverse the bus ID through fuzzing, potentially causing engine stalling, loss of steering control, or even brake failure, seriously threatening public transportation safety.

[0004] To address these security challenges, existing in-vehicle intrusion detection systems (IDS) have evolved from rule-based to machine learning-based, and then to deep learning. Recurrent neural networks, represented by Long Short-Term Memory (LSTM) networks, excel at capturing periodic shifts in message sequences, but they still face significant bottlenecks when dealing with highly dynamic and adversarial real-world in-vehicle scenarios: 1. Lack of topology correlation capabilities: The CAN bus is a typical broadcast multi-node network, with inherent logical coupling between different ECUs (e.g., the brake pedal signal and brake execution signal have a strong spatiotemporal correlation). Existing research mostly treats different ID messages as isolated entities, failing to model the spatial game relationships between nodes from a global perspective, resulting in weak identification capabilities for complex attacks across nodes and protocol layers. 2. The uninterpretability of "black box" models and the knowledge gap: Purely data-driven methods often fall into a judgment deadlock when facing unseen (zero-day) attack variants due to a lack of external prior knowledge. Meanwhile, deep models can only provide a "whether it is abnormal" label, and cannot inform safety operators whether there are similar patterns in the historical database, resulting in long response delays. 3. Limitations of long-term timing-dependent capture: Although LSTM has memory capabilities, in high-load bus environments, the message density is extremely high, and single timing modeling is easily affected by occasional noise, resulting in a high false alarm rate.

[0005] Therefore, there is an urgent need for a comprehensive detection architecture that can integrate vehicle temporal dynamics, logical space topology, and historical anomaly knowledge base (RAG) to cope with the increasingly complex vehicle-connected security environment. Summary of the Invention

[0006] In view of this, the purpose of this invention is to propose an intelligent vehicle anomaly detection method and system based on LSTM and spatiotemporal feature fusion, so as to solve the shortcomings of existing vehicle IDS such as insufficient spatial correlation characterization and poor robustness to unknown attacks.

[0007] To achieve the above objectives, this invention provides an intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion, comprising the following steps:

[0008] Step S1: Collect raw heterogeneous packet data from the vehicle network. The data includes at least an arbitration identifier, a packet data field, and timestamp information.

[0009] Step S2: Preprocess the collected raw heterogeneous message data to construct a time-series message sample sequence composed of continuous messages, and normalize the feature parameters of the messages in the sequence to obtain a standard time-series sample.

[0010] Step S3: Input the standard time series samples into the Long Short-Term Memory (LSTM) layer of the network, extract the nonlinear evolution features of a single node in the continuous time dimension, and generate an individual time series feature vector;

[0011] Step S4: Based on the message sequences between nodes with different arbitration identifiers, calculate the communication correlation between nodes, and construct a logical spatial topology map of the vehicle network based on the correlation; based on the logical spatial topology map, extract the dynamic interaction features between the current node and its logically associated neighboring nodes, and generate a spatial neighborhood feature vector.

[0012] Step S5: Use the real-time spatiotemporal fusion vector corresponding to the current sample as the query vector, perform similarity retrieval in the pre-built abnormal behavior knowledge base, obtain similar historical attack pattern fragments, and extract knowledge enhancement feature vectors based on the historical attack pattern fragments.

[0013] Step S6: Employ a multi-head attention mechanism to perform weighted fusion of the individual temporal feature vector, spatial neighborhood feature vector, and knowledge-enhanced feature vector to generate a global spatiotemporal enhanced feature representation;

[0014] Step S7: Input the global spatiotemporal enhanced feature representation into the classification layer, calculate the anomaly score, and output the anomaly type identification result.

[0015] Preferably, the original message stream is segmented using a sliding window algorithm to construct a fixed-length time-series message sample sequence;

[0016] The feature parameter is the arrival time interval of the message, and the normalization process includes: performing a logarithmic transformation on the original arrival time interval, and then performing standardization based on the statistical features of the training set.

[0017] Preferably, the LSTM layer extracts nonlinear evolution features through an internal gating mechanism, which includes an input gate and a forget gate, used to control the degree of forgetting of historical information and the degree of updating of new information, respectively.

[0018] Preferably, the communication correlation between computing nodes includes: calculating the mutual information between message sequences of nodes with different arbitration identifiers to quantitatively characterize the logical space coupling strength between nodes, and using the mutual information as the edge weight of the logical space topology graph.

[0019] Preferably, the construction process of the abnormal behavior knowledge base includes: collecting and storing historical normal communication benchmark data and feature vectors of known attack patterns to form a vector database.

[0020] Preferably, the similarity retrieval uses a cosine similarity measure.

[0021] Preferably, step S6 specifically includes: employing a multi-head cross-attention mechanism to perform deep interaction and alignment between the individual temporal feature vector, spatial neighborhood feature vector, and knowledge-enhanced feature vector.

[0022] Preferably, the classification layer is a fully connected network layer activated by the Softmax function, and its output is the probability distribution of the current sample belonging to different anomaly categories.

[0023] Preferably, this method runs in real time in an iterative manner, continuously monitors the entire operation cycle of the vehicle, and triggers a defense strategy by linking the vehicle gateway when an anomaly is identified. The defense strategy includes one or more of the following: issuing alarms, traffic scrubbing, or isolating malicious nodes.

[0024] This invention also provides an intelligent vehicle anomaly detection system based on LSTM and vehicle-to-everything (V2X) spatiotemporal feature fusion, comprising:

[0025] The data acquisition layer is used to collect raw heterogeneous packet data from the vehicle network in real time.

[0026] The preprocessing layer is used to preprocess the collected raw heterogeneous message data, construct time-series message sample sequences and normalize them to generate standard time-series samples.

[0027] The core extraction layer, with a built-in LSTM network, is used to receive the standard time-series samples, extract and output individual time-series feature vectors; and to construct a logical space topology graph based on the communication correlation between messages, and extract the spatial neighborhood feature vector of the current node.

[0028] The knowledge-enhanced retrieval layer has a built-in abnormal behavior knowledge base, which is used to perform similarity retrieval with the real-time spatiotemporal fusion vector corresponding to the current sample as the query vector, and outputs knowledge-enhanced feature vectors.

[0029] The feature fusion layer employs a multi-head attention mechanism to weightedly fuse the individual temporal feature vector, spatial neighborhood feature vector, and knowledge-enhanced feature vector to generate a global spatiotemporal enhanced feature representation.

[0030] The output decision layer is used to input the global spatiotemporal enhanced feature representation into the classifier, output the anomaly detection result, and trigger the corresponding defense strategy in conjunction with the vehicle gateway.

[0031] The beneficial effects of this invention are:

[0032] 1. Multidimensional feature complementarity: This invention achieves a comprehensive and three-dimensional characterization of vehicle communication behavior by using LSTM modeling in the "temporal domain" and logical topology modeling in the "spatial domain", thus identifying highly concealed composite attacks.

[0033] 2. Knowledge-based robustness: By introducing RAG technology, this invention enables the system to make decisions based on historical patterns when facing variant attacks, which greatly compensates for the shortcomings of pure deep learning models in small sample environments.

[0034] 3. Balancing real-time performance and accuracy: This invention employs an efficient vector retrieval and attention fusion mechanism, which reduces the false alarm rate by approximately 18% compared to existing single time-series models while ensuring microsecond-level detection response. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is an interactive diagram of the functional modules of the intelligent vehicle anomaly detection method and system based on LSTM and spatiotemporal feature fusion according to an embodiment of the present invention.

[0037] Figure 2 This is a schematic diagram of sliding window and logarithmic normalization processing in data preprocessing according to an embodiment of the present invention;

[0038] Figure 3 This is a mathematical model diagram of constructing logical topological space associations based on mutual information, according to an embodiment of the present invention.

[0039] Figure 4 This is a detailed architecture diagram of the enhanced real-time feature and vector knowledge base retrieval in the RAG framework of this invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments.

[0041] It should be noted that, unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0042] Please see Figures 1 to 4 The technical solution adopted in this invention is: an intelligent connected vehicle anomaly detection system and method based on LSTM and vehicle-to-everything (V2X) spatiotemporal feature fusion, comprising the following steps:

[0043] Step S1: Real-time acquisition of raw heterogeneous message data from the internal in-vehicle network of the intelligent connected vehicle. This data includes the Arbitration Identifier (AID), message data payload, and high-precision timestamp information. In actual deployment scenarios, data acquisition is performed by a monitoring unit integrated into the vehicle's central gateway or domain controller. This unit captures CAN / CAN-FD bus messages conforming to the ISO11898 standard in real time. For example, during vehicle operation, the monitoring unit continuously records each frame of raw message on the bus, extracting core metadata: the Arbitration Identifier (AID) to identify the sending node and message type, the message data payload carrying specific control commands or status feedback, and a high-precision microsecond-level timestamp reflecting the message arrival time. These data collectively constitute the raw heterogeneous dataset describing the real-time communication behavior of the in-vehicle network.

[0044] Step S2: Preprocess the collected raw heterogeneous message data, including constructing a fixed-length time-series message sample sequence using a sliding window algorithm, and normalizing and characterizing the arrival time interval of each message. For example... Figure 2 As shown, to facilitate subsequent timing modeling, this embodiment uses a sliding window mechanism to segment the original message stream. The window length is set to... (e.g., 128 frames of message), the sliding step size is For messages within a window, first calculate the time interval between adjacent messages. Considering the abnormal operating conditions such as flooding attacks, Extreme orders-of-magnitude differences can occur. To eliminate the influence of dimensions, [the following measures should be taken]. Perform logarithmic transformation:

[0045]

[0046] in To prevent abnormally small constants in numerical calculations, the mean obtained from the training phase was subsequently used. and standard deviation The transformed features are then standardized.

[0047]

[0048] This step converts the original discrete message information into a standard time-series sample sequence with uniform feature dimensions, preparing it for input to the LSTM network.

[0049] Step S3: Input the preprocessed sequence into a Long Short-Term Memory (LSTM) network layer to extract the nonlinear evolution features of individual nodes in the continuous time dimension, outputting an individual temporal feature vector. The server or vehicle-mounted computing platform feeds the standardized sequence into a stacked LSTM layer. For example... Figure 1 As shown, the LSTM unit automatically identifies and preserves long-range temporal dependencies in the message sequence through its internal gating mechanism (forget gate, input gate, output gate). Its cell state... The update formula is as follows:

[0050]

[0051] in, and The retention and update ratios of memories are determined based on the current input and the historical hidden state, respectively. Through this mechanism, the system can accurately identify the differences in the temporal evolution patterns between normal periodic messages and sudden abnormal messages, ultimately outputting an individual temporal feature vector representing the temporal behavior characteristics of a single node. .

[0052] Step S4: Construct the logical space topology graph of the vehicular network based on the mutual information correlation probability between messages, extract the dynamic interaction features between the current node and its logically associated neighboring nodes, and generate a logical space neighborhood feature vector. For example... Figure 3 As shown, this embodiment does not rely on a physical wiring diagram, but instead calculates the mutual information entropy between message sequences from different AID nodes. To quantitatively characterize the logical space coupling strength between nodes. Mutual information. The calculation formula is:

[0053]

[0054] A logical topological spatial association model is constructed based on the calculated mutual information matrix. When the vehicle performs a specific action (such as acceleration or steering), multiple related ECU nodes exhibit strong logical synchronization. The spatial feature extraction unit captures cross-node spatial anomalies by analyzing the dynamic interaction deviation between the current node and its logically related neighboring nodes, and generates spatial neighborhood feature vectors. .

[0055] Step S5: Utilize the RAG retrieval enhancement architecture to retrieve the real-time spatiotemporal fusion vector corresponding to the current sample as the query vector in the abnormal behavior knowledge base. This query vector can be the individual temporal feature vector generated in step S3. It can also be the spatial neighborhood feature vector generated in step S4. This could be a preliminary fusion of the two, depending on the actual deployment scenario. The top-K historical attack pattern fragments are obtained to extract knowledge-enhanced feature vectors. For example... Figure 4 As shown, to enhance defense against unknown attack variants, the system introduces a RAG architecture. First, a vector database containing feature representations of massive amounts of historical typical attacks (such as replay, blurring, and flooding) is established. The retrieval process uses cosine similarity to measure the current real-time feature vectors. Vectors within the knowledge base Distance:

[0056]

[0057] The system retrieves and extracts the top-K historical reference fragments (Context) with the highest scores to form a knowledge-enhanced feature vector. This step, by introducing an external expert knowledge base, provides additional background evidence to support real-time detection.

[0058] Step S6: A multi-head attention mechanism is employed to weightedly fuse individual temporal features, logical spatial neighborhood features, and knowledge-enhanced features to generate a global spatiotemporal enhanced feature representation. The system introduces a multi-head cross-attention mechanism to map three heterogeneous features from the temporal domain, spatial domain, and RAG knowledge base to the same high-dimensional semantic space. Attention weights are calculated... The importance of dynamically adjusting the characteristics of each branch:

[0059]

[0060] This fusion strategy aims to ensure that key features (such as sudden spatial topological anomalies or highly similar knowledge base matching results) dominate the final feature representation, thereby generating highly discriminative global spatiotemporal augmented features. .

[0061] Step S7: Input the global spatiotemporal augmentation feature representation into the classification layer, calculate the anomaly score, and output the recognition result. The recognition result includes the classification judgment of flooding attacks, fuzzing attacks, and replay attacks. Finally, ... The input is a classifier activated by the Softmax function. The classification layer calculates the probability distribution of the current window samples on normal and various known attack labels based on the input's deep features. When the probability score of an anomaly category exceeds the preset threshold for dynamic evolution, the system immediately outputs the judgment result and provides specific attack type identification and confidence score.

[0062] Step S8: Repeat steps 4 to 7 to achieve continuous real-time monitoring of the entire vehicle operation cycle and execute automated safety responses. The system operates in real-time in an iterative manner, and the detection results of each window cycle are directly connected to the vehicle alarm and defense module. If an attack is identified, the system can trigger defensive operations including traffic scrubbing, malicious node isolation, or sending alarms to the security control center. Simultaneously, the system continuously records key performance indicators such as detection time, resource consumption, and accuracy. Statistics show that, while ensuring detection accuracy, the system's single inference latency is in the microsecond range, fully meeting the stringent requirements of real-time monitoring of intelligent connected vehicle networks.

[0063] Example 2:

[0064] This embodiment provides an intelligent vehicle anomaly detection system based on LSTM and spatiotemporal feature fusion, used to implement the method of Embodiment 1, including the following hierarchical structure:

[0065] Data acquisition layer: Deployed on the vehicle's central gateway or domain controller, it monitors the CAN / CAN-FD bus in real time and collects raw message data, including arbitration identifier, message data field and timestamp information.

[0066] Preprocessing layer: Receives raw message data, segments the raw message stream using a sliding window algorithm, calculates the arrival time interval of each message within the window, performs logarithmic transformation and standardization on the segments, and generates standard time-series samples.

[0067] Core Extraction Layer: This layer contains two core functional units:

[0068] Temporal feature extraction unit: It has a built-in multi-layer stacked LSTM network, receives standard time series samples, extracts the temporal evolution features of a single node through the gating mechanism of the LSTM unit, and outputs the individual temporal feature vector.

[0069] Spatial Feature Extraction Unit: Receives message sequences from each AID node, calculates communication correlations (such as mutual information) between nodes, constructs a logical spatial topology graph, and extracts the spatial neighborhood feature vector of the current node.

[0070] Knowledge-enhanced retrieval layer: This layer incorporates an abnormal behavior knowledge base, which pre-stores feature vectors of historical normal communication benchmarks and known attack patterns. Using the real-time spatiotemporal fusion vector corresponding to the current sample (e.g., a concatenated vector of individual temporal feature vectors and spatial neighborhood feature vectors) as the query vector, this layer performs a retrieval in the knowledge base using cosine similarity, outputting a knowledge-enhanced feature vector.

[0071] Feature fusion layer: Employs a multi-head cross-attention mechanism to weight and fuse temporal feature vectors, spatial feature vectors, and knowledge-enhanced feature vectors to generate a global spatiotemporal enhanced feature representation.

[0072] Output Decision Layer: This layer incorporates a Softmax classifier to classify global features and output anomaly type identification results (including normal, flooding attack, fuzzy attack, replay attack, etc.). This layer works in conjunction with the vehicle gateway to trigger corresponding defense strategies based on detection results, such as issuing alarms, traffic scrubbing, or isolating malicious nodes.

[0073] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0074] In the embodiments provided in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0075] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0076] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0077] The implementation of all or part of the processes in the methods of the above embodiments can also be accomplished by a computer program product. When the computer program product is run on a terminal device, the terminal device can implement the steps in the various method embodiments described above.

[0078] The embodiments described above are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. An intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion, characterized in that, Includes the following steps: Step S1: Collect raw heterogeneous packet data from the vehicle network. The data includes at least an arbitration identifier, a packet data field, and timestamp information. Step S2: Preprocess the collected raw heterogeneous message data to construct a time-series message sample sequence composed of continuous messages, and normalize the feature parameters of the messages in the sequence to obtain a standard time-series sample. Step S3: Input the standard time series samples into the Long Short-Term Memory (LSTM) layer of the network, extract the nonlinear evolution features of a single node in the continuous time dimension, and generate an individual time series feature vector; Step S4: Calculate the communication correlation between nodes based on the message sequence between nodes with different arbitration identifiers, and construct the logical space topology of the vehicle network based on the correlation. Based on the logical space topology graph, the dynamic interaction features between the current node and its logically related neighboring nodes are extracted to generate a spatial neighborhood feature vector. Step S5: Use the real-time spatiotemporal fusion vector corresponding to the current sample as the query vector, perform similarity retrieval in the pre-built abnormal behavior knowledge base, obtain similar historical attack pattern fragments, and extract knowledge enhancement feature vectors based on the historical attack pattern fragments. Step S6: Employ a multi-head attention mechanism to perform weighted fusion of the individual temporal feature vector, spatial neighborhood feature vector, and knowledge-enhanced feature vector to generate a global spatiotemporal enhanced feature representation; Step S7: Input the global spatiotemporal enhancement feature representation into the classification layer, calculate the anomaly score, and output the anomaly type identification result.

2. The intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion according to claim 1, characterized in that, The original message stream is segmented using a sliding window algorithm to construct a fixed-length time-series message sample sequence. The feature parameter is the arrival time interval of the message, and the normalization process includes: performing a logarithmic transformation on the original arrival time interval, and then performing standardization based on the statistical features of the training set.

3. The intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion according to claim 1, characterized in that, The LSTM layer extracts nonlinear evolution features through an internal gating mechanism, which includes an input gate and a forget gate, used to control the degree of forgetting of historical information and the degree of updating of new information, respectively.

4. The intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion according to claim 1, characterized in that, The communication correlation between computing nodes includes: calculating the mutual information between message sequences of nodes with different arbitration identifiers to quantitatively characterize the logical space coupling strength between nodes, and using the mutual information as the edge weights of the logical space topology graph.

5. The intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion according to claim 1, characterized in that, The construction process of the abnormal behavior knowledge base includes: collecting and storing historical normal communication benchmark data and feature vectors of known attack patterns to form a vector database.

6. The intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion according to claim 1, characterized in that, The similarity retrieval uses cosine similarity as a metric.

7. The intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion according to claim 1, characterized in that, Step S6 specifically includes: employing a multi-head cross-attention mechanism to perform deep interaction and alignment between the individual temporal feature vector, spatial neighborhood feature vector, and knowledge-enhanced feature vector.

8. The intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion according to claim 1, characterized in that, The classification layer is a fully connected network layer activated by the Softmax function, and its output is the probability distribution of the current sample belonging to different anomaly categories.

9. The intelligent vehicle anomaly detection method based on LSTM and spatiotemporal feature fusion according to claim 1, characterized in that, The method operates in real time in an iterative manner, continuously monitoring the entire vehicle operation cycle, and triggering defense strategies by linking the vehicle gateway when an anomaly is detected. The defense strategies include one or more of the following: issuing alarms, traffic scrubbing, or isolating malicious nodes.

10. An intelligent vehicle anomaly detection system based on LSTM and vehicle-to-everything (V2X) spatiotemporal feature fusion, used to implement the method described in any one of claims 1 to 9, characterized in that, include: The data acquisition layer is used to collect raw heterogeneous packet data from the vehicle network in real time. The preprocessing layer is used to preprocess the collected raw heterogeneous message data, construct time-series message sample sequences and normalize them to generate standard time-series samples. The core extraction layer, with a built-in LSTM network, is used to receive the standard time-series samples, extract and output individual time-series feature vectors; and to construct a logical space topology graph based on the communication correlation between messages, and extract the spatial neighborhood feature vector of the current node. The knowledge-enhanced retrieval layer has a built-in abnormal behavior knowledge base, which is used to perform similarity retrieval with the real-time spatiotemporal fusion vector corresponding to the current sample as the query vector, and outputs knowledge-enhanced feature vectors. The feature fusion layer employs a multi-head attention mechanism to weightedly fuse the individual temporal feature vector, spatial neighborhood feature vector, and knowledge-enhanced feature vector to generate a global spatiotemporal enhanced feature representation. The output decision layer is used to input the global spatiotemporal enhanced feature representation into the classifier, output the anomaly detection result, and trigger the corresponding defense strategy in conjunction with the vehicle gateway.

Images