Anomaly detection method and related apparatus

Abstract

The application discloses an abnormality detection method and related device, which are applied to the technical field of vehicles. When a communication link is interrupted, an abnormality detection device acquires monitoring information of the communication link, and then determines an abnormal process based on the monitoring information of the communication link and a topology structure. The monitoring information reflects the transmission of messages between processes in the communication link, and the topology structure reflects an expected path of message transmission in the communication link. In this way, the abnormality detection device can simply and quickly determine the abnormal process.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and in particular to an anomaly detection method and related apparatus. Background Technology

[0002] With the continuous development of intelligent vehicle technology, more and more business functions are being developed, leading to an increasing number of business processes requiring communication within and between vehicle components. These processes transmit messages through communication links to implement the vehicle's business functions. As the vehicle's business functions become more complex, the number of processes on the communication links also increases. If an abnormal process occurs in the communication link, such as an interruption in message sending or receiving, the vehicle's business functions will be affected, consequently impacting the user experience.

[0003] If abnormal processes in the communication link can be detected in a timely manner, corresponding measures can be taken as soon as possible to ensure the normal operation of the vehicle's business functions. However, some existing solutions are not very efficient at detecting abnormal processes in the communication link. For example, some solutions often check problems one process at a time when detecting abnormal processes in the communication link, which not only consumes a lot of manpower, but also seriously affects the efficiency of detecting abnormal processes.

[0004] Therefore, how to improve the efficiency of detecting abnormal processes in communication links is a problem that urgently needs to be solved by those in this technical field. Summary of the Invention

[0005] This application provides an anomaly detection method and related apparatus, which detects abnormal processes in the communication link by using the topology and maintenance information of the communication link, thereby improving the efficiency of detecting abnormal processes in the communication link and helping to ensure user experience.

[0006] Firstly, this application provides an anomaly detection method, which can be executed by an anomaly detection device. This device can be a standalone device or a module within a standalone device, including software and / or hardware modules. For ease of description, the anomaly detection device will be used as the executing entity in the following description. Optionally, the anomaly detection device can be a computing device or included within a computing device, or the anomaly detection device can be used to detect abnormal processes within the computing device. In short, this method can also be applied to a computing device. Multiple processes run on the computing device, forming at least one communication link. Each communication link includes at least two processes, and the at least two processes within each communication link can transmit messages.

[0007] The anomaly detection method includes: when an anomaly detection device detects an interruption in a first communication link, it acquires first dimension measurement information and, based on the topology of the first communication link and the first dimension measurement information, identifies the abnormal process in the first communication link. The first communication link includes at least two processes, and these processes are capable of transmitting messages. The processes on the first communication link are run by a computing device. The first dimension measurement information indicates the attributes of messages transmitted between processes in the first communication link. These attributes include the identifier of the process associated with the message, the message identifier, and a message transmission status indication. The topology of the first communication link indicates the message transmission relationship between processes in the first communication link. An anomaly occurs in the message transmission associated with the abnormal process.

[0008] In the above scheme, the first dimension information indicates the attributes of messages transmitted between processes in the first communication link. Among the message attributes, the process associated with the message refers to the process that sent the message or the process that received the message. The message identifier includes one or more of the following: message name, identification (ID), number (such as sequence number), etc. The message transmission status indicator is used to indicate the transmission status of the message, such as sent or received. As can be seen from the foregoing, the first dimension information can simply and directly reflect the message transmission status in the first communication link. For example, message 1 is sent by process A, and message 2 is sent by process B.

[0009] The topology of the first communication link can indicate the flow of messages transmitted in the first communication link. For example, message 1 is sent by process A and received by process B.

[0010] Message transmission related to abnormal processes is abnormal. For example, message 1 should be sent by process A, but there is no record of message 1 being sent by process A in the first dimension information, so process A's transmission of message 1 is abnormal. As another example, message 2 should be received by process C, but there is no record of message 2 being received by process C in the first dimension information, so process C's transmission of message 2 is abnormal.

[0011] As mentioned above, the topology of the first communication link indicates the expected path for message transmission, and the first dimension measurement information records the actual transmission status of the message. When the first communication link is interrupted, the anomaly detection device only needs a small amount of information to determine the abnormal process. For example, if the first dimension measurement information records that message 1 was sent by process A, and the topology of the first communication link indicates that process B should receive the message from process A, but the first dimension measurement information does not record that message 1 was received by process B, it indicates that process B's transmission of message 1 is abnormal.

[0012] In this way, the anomaly detection device can quickly identify anomaly processes based solely on key characteristics. The method is simple, easy to implement, and less prone to errors. Compared to some solutions that require analyzing each process individually to determine anomalies, this approach significantly reduces the complexity and tediousness of anomaly detection methods, decreases the manpower and time spent on anomaly detection, and improves the efficiency of anomaly detection.

[0013] Furthermore, in practical applications, improving the efficiency of identifying abnormal processes facilitates timely remedial measures, thereby helping to ensure the normal operation of business functions and protect user experience.

[0014] In one possible implementation of the first aspect, the first communication link includes the target process. If the target process does not receive the target message within a first time, the first communication link is interrupted, and the target message is transmitted through the first communication link. The abnormal process is positioned before the target process in the first communication link, or the abnormal process is the target process.

[0015] In the above implementation, when a target process that should receive a target message on the link fails to receive the target message, it indicates that the first communication link is in an interrupted state. The failure to receive a message may include not receiving a message within a first time period. Optionally, the first time period is predefined.

[0016] It should be noted that the target process is not limited to the last process in the first communication link.

[0017] In another possible implementation of the first aspect, the first communication link includes adjacent first and second processes, with the first process sending a first message to the second process. When the first dimension information includes the first information but does not include the second information, the abnormal process includes the second process. The first information includes an identifier of the first process, an identifier of the first message, and a first sending indication, the first sending indication being a transmission status indication of the first message. The second information includes an identifier of the second process, an identifier of the first message, and a first receiving indication, the first receiving indication being a transmission status indication of the first message.

[0018] The above implementation provides a manifestation of message sending and receiving anomalies caused by communication interruption in maintenance information. If a message included in the maintenance information is sent by a process, but the downstream process corresponding to that process (the process receiving the message) does not receive the message, it indicates that the downstream process is receiving the message abnormally.

[0019] Furthermore, in some other solutions, the anomaly detection device can analyze the cause of the downstream process anomaly, determine the reason for the anomaly, and then take corresponding recovery measures. This helps to promptly repair the faulty communication link after an interruption, and further helps to restore the corresponding business functions to normal as soon as possible, ensuring user experience.

[0020] In another possible implementation of the first aspect, the first communication link includes an adjacent first process and a second process, wherein the first process is used to send a first message to the second process. When the first dimension information does not include the first information, the abnormal process includes the first process. The first information includes an identifier of the first process, an identifier of the first message, and a first sending indication, wherein the first sending indication is a transmission status indication of the first message.

[0021] The above implementation provides another manifestation of message sending and receiving anomalies caused by communication interruption in maintenance information. If a certain message included in the maintenance information is not sent by a certain process, it indicates that the process sent the message abnormally.

[0022] Furthermore, in some other solutions, the anomaly detection device can analyze the cause of the anomaly in the process, determine the reason for the anomaly in the downstream process, and then take corresponding recovery measures. This helps to repair the faulty communication link in a timely manner after the communication link is interrupted, and further helps to restore the corresponding business functions to normal as soon as possible, thus helping to ensure user experience.

[0023] In yet another possible implementation of the first aspect, the topology of the first communication link is also used to indicate the identifier of the message transmitted by the process in the first communication link and the message sending / receiving type.

[0024] In the above embodiments, the topology of the first communication link can indicate whether a process transmits a message and whether that process sends or receives the message during normal operation of the computing device. As previously mentioned, the first dimension information can also indicate the message identifier transmitted by a process during computing device operation and whether that message is sent or received. Therefore, when the first communication link is interrupted, the anomaly detection device, based on the topology of the first communication link and the first dimension information, can determine whether a process has sent or received a corresponding message, thereby identifying the abnormal process. In this way, the anomaly detection device can more easily and directly obtain the abnormal process, thus helping to improve the efficiency of detecting abnormal processes.

[0025] In another possible implementation of the first aspect, before obtaining the abnormal process in the first communication link based on the topology of the first communication link and the first dimension information, the anomaly detection method further includes: acquiring second dimension information and establishing a communication topology based on the second dimension information. The second dimension information is used to indicate the attributes of messages transmitted between processes running on the computing device, and the communication topology includes the topology of the first communication link.

[0026] The above implementation establishes a communication topology based on the attributes of messages transmitted between processes running on a computing device. These message attributes associate processes, ensuring that a message can only be received by a receiving process if it is sent by the sending process. For example, if a sensing process and a planning process are running on the computing device, and the sensing process sends sensing information to the planning process, the message transmission relationship between the sensing and planning processes can be determined: the sensing process is the sending process, and the planning process is the receiving process. In this way, the anomaly detection device can easily and accurately establish a communication topology.

[0027] In another possible implementation of the first aspect, the second dimension information includes multiple message records. Each message record includes attributes of a message transmitted by a process. The message record includes the identifier of the process associated with the message, the identifier of the message, a transmission status indicator, and a transmission time indicator. The anomaly detection method further includes: the anomaly detection device arranging the multiple message records in chronological order based on the transmission time corresponding to each message record. The anomaly detection device establishes a communication topology based on the second dimension information, including the following operation: the anomaly detection device establishes a communication topology based on the multiple message records arranged in chronological order.

[0028] In the above embodiment, the anomaly detection device establishes a communication topology by arranging multiple message records in the second dimension information in chronological order. In a communication link, signals are transmitted between various processes and interact in a predetermined order until the last process node in the communication link. Therefore, arranging the message records in the second dimension information in chronological order can determine the order in which messages are sent and received between communication nodes, which helps to improve the efficiency of establishing a communication topology.

[0029] In another possible implementation of the first aspect, before the anomaly detection device obtains the abnormal process in the first communication link based on the topology of the first communication link and the first dimension measurement information, the anomaly detection method further includes: the anomaly detection device acquiring a configuration file and establishing a communication topology based on the configuration file. The configuration file is used to indicate the sending process and receiving process of at least one message transmitted by at least one communication link, and the communication topology includes the topology of the first communication link.

[0030] In the above implementation, the configuration file accurately defines the message transmission relationships between processes. For example, the configuration file can instruct a process to receive a specific message and the process that sent the message. Therefore, based on the configuration file, the anomaly detection device can accurately establish the communication topology of the processes running in the computing device.

[0031] In another possible implementation of the first aspect, the configuration file includes structural information of the process in the first communication link. The structural information includes the process identifier, subscription information, and publication information. The subscription information includes the identifier of the message publishing process and the message publication name. The publication information includes the message publication name.

[0032] In the above embodiments, the configuration file can clearly indicate the communication relationships between processes in the computing device. This not only helps the anomaly detection device accurately establish the communication topology, but also improves the efficiency of the anomaly detection device in establishing the communication topology.

[0033] Furthermore, a process's subscription information can also include the name of a message that the process is subscribed to, as well as the message's send / receive type. A process's publish information can also include the message's send / receive type. This helps anomaly detection devices determine the message's flow, thereby aiding in establishing the communication topology.

[0034] In yet another possible implementation of the first aspect, the first dimension information further includes a time indication, which includes a timestamp and / or a sequence number of a message packet.

[0035] In the above implementation, timestamps and message packet sequence numbers provide precise time and sequence information for detecting abnormal processes. When a communication link is interrupted, each process can be analyzed systematically based on the time indication. Furthermore, the time indication helps determine the cause of the abnormal process. For example, if the difference between the message sending and receiving timestamps of a process is too long, the process may be blocked or stuck at some stage. Or, if a process receives message packets with incorrect sequence numbers or in the wrong order, the sending process associated with that message packet can be analyzed to locate the abnormal process.

[0036] In another possible implementation of the first aspect, multiple processes transmit information through a communication middleware to obtain first dimension information, including: obtaining first dimension information using a message recording module, wherein the message recording module is set in or connected to the message middleware, and the message recording module is used to record the attributes of messages transmitted by multiple processes.

[0037] In the above implementation, when processes in a computing device participate in communication, the message tracking module records the attributes of the messages transmitted by the participating processes. The recorded information is used to establish a communication topology or to detect abnormal processes when a communication link is interrupted. This approach not only helps establish the communication topology of processes running in the computing device but also facilitates the rapid identification of abnormal processes causing the interruption.

[0038] Secondly, this application provides an anomaly detection device, which includes a computing device on which multiple processes run, forming at least one communication link. Each communication link includes at least two processes, and the at least two processes within each communication link can transmit messages. The anomaly detection device includes an acquisition module and a processing module, wherein:

[0039] The acquisition module is used to acquire first dimension information when the first communication link is detected to be interrupted. The first dimension information is used to indicate the attributes of messages transmitted between processes in the first communication link. The attributes of the message include the identifier of the process associated with the message, the identifier of the message, and the transmission status indication of the message.

[0040] The processing module is used to obtain abnormal processes in the first communication link based on the topology of the first communication link and the first dimension measurement information. The topology of the first communication link is used to indicate the message transmission relationship between processes in the first communication link, and the message transmission related to the abnormal process is abnormal.

[0041] In one possible implementation of the second aspect, the first communication link includes the target process. If the target process does not receive the target message within a first time, the first communication link is interrupted, and the target message is transmitted through the first communication link. The abnormal process is positioned before the target process in the first communication link, or the abnormal process is the target process.

[0042] In another possible implementation of the second aspect, the first communication link includes an adjacent first process and a second process, wherein the first process is used to send a first message to the second process. The first information includes first information but does not include second information. The first information includes the identifier of the first process, the identifier of the first message, and a first sending indication, the first sending indication being a transmission status indication of the first message. The second information includes the identifier of the second process, the identifier of the first message, and a first receiving indication, the first receiving indication being a transmission status indication of the first message. Abnormal processes include the second process.

[0043] In another possible implementation of the second aspect, the first communication link includes an adjacent first process and a second process, wherein the first process is used to send a first message to the second process. The first measurement information does not include the first information, which includes the identifier of the first process, the identifier of the first message, and a first sending indication. The first sending indication is a transmission status indication of the first message, and the abnormal process includes the first process.

[0044] In another possible implementation of the second aspect, the topology of the first communication link is also used to indicate the identifier of the message transmitted by the process in the first communication link and the message sending and receiving type.

[0045] In another possible implementation of the second aspect, before obtaining the abnormal process in the first communication link based on the topology of the first communication link and the first dimension information, the acquisition module is further configured to acquire second dimension information, which indicates the attributes of messages transmitted between processes running on the computing device. The processing module is further configured to establish a communication topology based on the second dimension information, the communication topology including the topology of the first communication link.

[0046] In another possible implementation of the second aspect, the second dimension information includes multiple message records. Each message record includes attributes of a message transmitted by a process. The message record includes the identifier of the process associated with the message, the identifier of the message, a transmission status indicator, and a transmission time indicator. The processing module is further configured to: arrange the multiple message records in chronological order based on the transmission time corresponding to each message record. Based on the second dimension information, a communication topology is established, including: establishing the communication topology based on the chronologically arranged multiple message records.

[0047] In another possible implementation of the second aspect, before obtaining the abnormal process in the first communication link based on the topology of the first communication link and the first dimension measurement information, the acquisition module is further configured to acquire a configuration file, which indicates the sending process and receiving process of at least one message transmitted by at least one communication link. The processing module is further configured to establish a communication topology based on the configuration file, the communication topology including the topology of the first communication link.

[0048] In another possible implementation of the second aspect, the configuration file includes structural information of the process in the first communication link. The structural information includes the process identifier, subscription information, and publication information. The subscription information includes the identifier of the process that publishes the message and the publication name of the message. The publication information includes the publication name of the message.

[0049] In another possible implementation of the second aspect, the first dimension information further includes a time indication, which includes a timestamp and / or the sequence number of the message packet.

[0050] In another possible implementation of the second aspect, multiple processes transmit information through a communication middleware. The acquisition module is further configured to: acquire first dimension information using a message recording module. The message recording module is set in or connected to the message middleware. The message recording module is used to record the attributes of messages transmitted by multiple processes.

[0051] Thirdly, this application provides an anomaly detection device, which includes a processor and a memory. The memory stores a computer program, and the processor is used to call the computer program stored in the memory to implement the method of the first aspect.

[0052] Fourthly, this application provides a readable storage medium for storing a computer program, the computer program including the method for performing the first aspect.

[0053] Fifthly, this application provides a computer program product that, when executed by a processor, performs the method of the first aspect.

[0054] For the beneficial effects of the second to fifth aspects of this application, please refer to the beneficial effects of the corresponding parts of the first aspect mentioned above. Attached Figure Description

[0055] The accompanying drawings used in the description of the embodiments will be briefly introduced below.

[0056] Figure 1 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0057] Figure 2 This is a schematic diagram of the structure of another computing device provided in the embodiments of this application;

[0058] Figure 3 This is a flowchart illustrating an anomaly detection method provided in an embodiment of this application;

[0059] Figure 4 This is a schematic diagram of a communication link provided in an embodiment of this application;

[0060] Figure 5 This is a schematic diagram of yet another communication link provided in an embodiment of this application;

[0061] Figure 6A This is a schematic diagram of the structure information of a process provided in an embodiment of this application;

[0062] Figure 6BThis is a schematic diagram of a configuration file provided in an embodiment of this application;

[0063] Figure 7 This is a flowchart illustrating another anomaly detection method provided in the embodiments of this application;

[0064] Figure 8 This is a schematic diagram of another communication link topology provided in the embodiments of this application;

[0065] Figure 9 yes Figure 7 Another flowchart of the embodiment;

[0066] Figure 10 This is a flowchart illustrating another anomaly detection method provided in the embodiments of this application;

[0067] Figure 11 yes Figure 10 Another flowchart of the embodiment;

[0068] Figure 12 This is a schematic diagram of the structure of an anomaly detection device provided in an embodiment of this application;

[0069] Figure 13 This is a schematic diagram of the structure of an anomaly detection device provided in an embodiment of this application. Detailed Implementation

[0070] Before introducing the embodiments of this application, the terminology that may be used in the embodiments of this application will be introduced first.

[0071] 1. Process

[0072] A process is an execution of a program in a computer, and it is the basic unit for resource allocation and scheduling in a system. A communication link includes multiple processes. The first process in the communication link is the node that generates the signal. The signal is carried within the message and transmitted in the communication link to realize a specific business function. For example, in the scenario of autonomous driving, in order to improve the richness and practicality of the vehicle's business functions, multiple processes for communication are set up within and between various components of the vehicle. These processes can also be called business nodes. Each process undertakes a specific function, such as sensor data acquisition and power system control command transmission. As business functions become increasingly complex, the number of processes covered by a communication link gradually increases. Taking intelligent driving decision-making as an example, from the acquisition of environmental perception data to the calculation of decision algorithms, and then to the issuance of action commands by the actuators, multiple processes are involved in sequence. These processes are interconnected, causing the communication link to continuously extend.

[0073] 2. Maintenance and Testing Information

[0074] Maintenance information is used to indicate the attributes of messages transmitted by processes in a communication link, including but not limited to one or more of the following: message identifier, message name, message packet sequence number, message packet transmission / reception type, information of the process sending the message, information of the process receiving the message, timestamp of sending the message, timestamp of receiving the message, and message data size. Optionally, maintenance information can also indicate process-related information, such as process identifier and process status. In some schemes, maintenance information can also indicate communication link information, including but not limited to one or more of the following: signal transmission path, communication link status, communication protocol, and latency information.

[0075] It should be understood that the names of devices, modules, messages, information, signals, and parameters in the embodiments of this application are merely examples, and the names may be designed in other ways in specific implementations. For example, maintenance information can also be called tracking information. In some solutions, tracking information is used in a system or application to record or mark data of certain events or operations. The data recorded by tracking information includes, but is not limited to, one or more of the following: process name, process identifier, timestamp, message name, message packet sequence number, and message packet transmission / reception type.

[0076] 3. Communication Topology

[0077] Communication topology, or simply topology, refers to the connection and configuration of processes (or nodes) during communication, used to represent the message transmission relationships between processes. Common communication topologies include point-to-point communication, centralized communication, and many-to-many communication.

[0078] 4. Message middleware

[0079] Message middleware, also known as communication middleware, is a software component located between the operating system and applications. It is mainly used to enable communication and data interaction between different nodes and processes in a distributed system.

[0080] The system and business scenarios of the embodiments of this application are described below. It should be noted that the system architecture and business scenarios described in this application are for the purpose of making the technical solutions of this application clearer, and do not constitute a limitation on the technical solutions provided in this application. Those skilled in the art will know that with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided in this application are also applicable to similar technical problems.

[0081] Please see Figure 1 , Figure 1 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application.

[0082] In this system, computing device 10 runs multiple processes. These processes can transmit messages to each other, forming at least one communication link, and each communication link includes at least two processes. The first process in a communication link is the node that generates the signal. The signal is transmitted in the communication link in the form of a message, and at least two processes within each communication link can transmit messages to each other. In some schemes, processes may also have other names, such as service nodes or nodes.

[0083] In a communication link, communication between processes can realize corresponding business functions. For example, in an autonomous driving system, a communication link includes an environmental perception process, a data processing process, a decision-making process, and a control process. The environmental perception process transmits acquired environmental data (such as the shape and size of obstacles, the position and speed of surrounding vehicles, the direction of surrounding pedestrians, etc.) to the data processing process. The data processing process fuses and analyzes the environmental data to extract feature data (such as the relative position of surrounding objects, the relative speed of surrounding vehicles, etc.). The feature data can reflect the road traffic conditions. The data processing process transmits the feature data to the decision-making process. The decision-making process formulates driving strategies (such as whether to brake, driving speed, driving direction, etc.) based on the feature data. The control system receives and executes the driving strategy.

[0084] An anomaly detection device 101 is deployed in the computing device 10. The anomaly detection device 101 is used to detect abnormal processes in the computing device. Optionally, the above description uses the example of the anomaly detection device being installed inside the computing device 10 as an example. In some cases, the anomaly detection device can also be installed outside the computing device 10, that is, the two are independent. Furthermore, the anomaly detection device 101 is connected to the computing device 10.

[0085] The anomaly detection device 101 is a computing-capable device, which can be a standalone device or a module within a standalone device. Examples include, but are not limited to, one or more of the following: microcontroller unit (MCU), domain controller (DC), microprocessor unit (MPU), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), complex programmable logic device (CPLD), coprocessor (assisting the central processing unit in completing corresponding processing and applications), mobile data center (MDC), and / or electronic control unit (ECU). For example, when a communication link is interrupted, the anomaly detection device 101 can determine the abnormal process based on the topology of the communication link and the attributes of the messages transmitted during communication as recorded in the first dimension measurement information.

[0086] The computing device 10 includes at least one hardware module (not shown) that provides computing and data processing capabilities for the operation of the exception handling device 101 and processes within the computing device 10. Exemplarily, the hardware module includes, but is not limited to, one or more of a central processing unit (CPU), memory, a network interface card (NIC), and sensors. The CPU provides computing resources, the memory provides storage resources, the NIC provides communication resources, the sensors provide communication resources, and the acquisition module acquires monitoring information based on the memory. Further exemplarily, in an autonomous driving system, a communication link includes an environmental perception process, a data processing process, a decision-making process, and a control process. Sensors are used by the perception process to acquire road traffic conditions, memory is used to store the road traffic conditions acquired by the perception process and to provide road traffic conditions to the data processing process, the CPU provides data processing capabilities for the data processing process and the decision-making process, and the NIC provides communication resources for the interaction between these processes.

[0087] The computing device 10 also includes an operating system (OS) for providing hardware resources for the operation of the exception handling device 101 and the processes within the computing device 10. For example, it provides CPU resources for data processing processes. Furthermore, the OS provides CPU resources to the processing module of the exception detection device 101 to analyze abnormal processes and provides memory resources to the exception detection device 101 to obtain maintenance information.

[0088] Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of another computing device provided in an embodiment of this application. The computing device 20 is divided into a software part and a hardware part.

[0089] The software component comprises an OS layer, an application layer, and a middleware layer. The OS layer primarily provides hardware resources. The application layer includes at least one process (or business node) that can communicate with each other. The middleware layer includes communication middleware and a communication interruption analysis module; in some cases, it also includes a topology analysis module. Messages used for inter-process communication are forwarded by the communication middleware. The communication middleware deploys a message logging module, which records the attributes of messages transmitted between processes as maintenance information for use by the communication topology acquisition module and the communication interruption analysis module. The middleware's communication interruption analysis module can analyze abnormal processes based on the maintenance information and the communication topology. Optionally, the message logging module in the communication middleware is also used by the interruption analysis module to obtain the communication topology. Optionally, the communication topology analysis module obtains the communication relationships between business nodes from the message logging module to generate the communication topology.

[0090] The hardware components include, but are not limited to, resources such as CPU, memory, network card, and sensors.

[0091] With the continuous development of intelligent vehicle technology, more and more business functions are being developed, making it crucial to ensure the stability of the entire vehicle's business functions. Some solutions require maintenance personnel to analyze each process involved in the business function one by one to detect abnormal processes when they malfunction. As the communication links of the business functions become longer, this consumes a significant amount of manpower and time, resulting in low efficiency in detecting abnormal processes. Other solutions detect abnormal processes by setting up alarm reporting mechanisms in each process; however, this method requires each business node to have alarm reporting capabilities, and each time a new message type is added, code modifications are necessary, leading to a substantial workload. In short, these solutions are inefficient at detecting abnormal processes, easily affecting the normal operation of business functions and consequently impacting user experience.

[0092] In view of this, this application provides an anomaly detection method and related apparatus. When an anomaly occurs in a communication link, the anomaly detection apparatus can detect abnormal processes on the communication link based on the link's topology and maintenance information. This improves the efficiency of anomaly detection and thus helps to protect the user experience.

[0093] The methods provided in the embodiments of this application will be described below.

[0094] Please see Figure 3 , Figure 3 This is a flowchart illustrating an anomaly detection method provided in an embodiment of this application. Optionally, this method is applied to a computing device. For example, this method is applied to... Figure 1 The computing device 10 shown is implemented by the anomaly detection device 101. Alternatively, this method can be applied to... Figure 2 The computing device 20 is shown. In some embodiments, the above method can also be performed by a device or module with a name other than an anomaly detection device. For example, by... Figure 2 The message tracking module, communication interruption analysis module, and communication topology analysis module in the shown computing device 20 are executed together. For ease of understanding, the following explanation will focus on the anomaly detection device as the main execution entity.

[0095] like Figure 3 The anomaly detection method shown may include multiple steps in S301 to S302. It should be understood that, for ease of description, the embodiments of this application are described in the order of S301 to S302, and are not intended to limit the execution to this order. This application does not limit the order of the above one or more steps, the execution time, or the number of executions. S301 to S302 are as follows.

[0096] S301, when the first communication link is interrupted, the anomaly detection device acquires the first dimension measurement information.

[0097] An anomaly detection device is a computing-capable device that can be a standalone device or a module within a standalone device, such as a software module and / or a hardware module. Furthermore, the anomaly detection device is deployed within a computing device or connected to a computing device.

[0098] Specifically, multiple processes run within a computing device, forming at least one communication link. A communication link reflects the data transmission path between multiple processes; therefore, a communication link includes at least two processes. This is combined with... Figure 4 It can be seen that, Figure 4 This is a schematic diagram of a communication link provided in an embodiment of this application. Figure 4It is known that process A and D are running in the computing device, and process A and D form a communication link. Optionally, processes running in the computing device may form more than one communication link. For an example, please refer to [link to example]. Figure 5 , Figure 5 This is a schematic diagram of another communication link structure provided in an embodiment of this application. (Combined with...) Figure 5 The computing device is running processes AH, AD and EH form a communication link.

[0099] The first communication link is a communication link within a computing device. For example, in conjunction with... Figure 5 The communication link is either a link formed by processes A and D, or a link formed by processes E and H. Messages are exchanged between processes along the message transmission direction of the communication link. For example, process A sends a message to process B, process B receives a message from process A, and so on.

[0100] The first communication link interruption refers to the interruption of message transmission in the communication link. An abnormality in message transmission by a process in the first communication link causes messages to fail to be transmitted normally. For example, combined with... Figure 4 Under normal circumstances, process A should send message 1 to process B. However, in actual operation, process A does not send message 1 to process B, and the communication link formed by processes A and D will be interrupted.

[0101] In some possible implementations, when a target process on the link that should receive the target message fails to do so, it indicates that the first communication link is in an interrupted state. For example, not receiving the message may include not receiving the message within a first time period. Optionally, the first time period is predefined, for example, 4 minutes (min), 5 seconds (s), etc. For example, combined with... Figure 4 Under normal circumstances, process D should receive message 3. However, if process D does not receive message 3 within the first time interval, it indicates that... Figure 4 The communication link shown is interrupted.

[0102] In some solutions, mechanisms are included in some or all processes to detect when a communication link has been interrupted. For example, each process in the first communication link has a timeout mechanism. If a process does not receive a corresponding message within a predetermined time, the timeout mechanism is triggered, indicating that the first communication link has been interrupted. For instance, Figure 4 The processes A and D shown both have a timeout mechanism set (the duration is the first timeout). If process D does not receive a message from process C within the first timeout, it means... Figure 4 The communication link shown has been interrupted.

[0103] The first dimension information is used to indicate the attributes of messages transmitted between processes in the first communication link. The message attributes include the identifier of the process associated with the message, the message identifier, and the message transmission status. Optionally, the message attributes may also include more information (described below). The identifier may include one or more of the following: ID, name, etc. For example, please refer to Table 1, which lists one possible first dimension information.

[0104] Table 1 First Dimension Measurement Information

[0105] Process A Message001 send Process B Message001 take over Process B Message002 send Process C Message002 take over Process C Message003 send

[0106] In other possible implementations, the recording format of the first dimension information includes, but is not limited to, one or more of the following: tables, text, JavaScript object notation (JSON) files, and Extensible markup language (XML) files.

[0107] In some other possible implementations, the first dimension information also includes a time indicator, which is used to indicate the time or order of message transmission. The time indicator is used to ensure that messages are processed in sequence, avoiding out-of-order processing or loss. For example, the time indicator includes a timestamp and / or a message packet sequence number. The timestamp indicates the point in time when a process sends or receives a message, and the message packet sequence number identifies the message's position within a series of messages. Please refer to Table 2, which provides another type of first dimension information according to embodiments of this application.

[0108] Table 2 First Dimension Measurement Information

[0109]

[0110] In the preceding text, the first dimension information is used to indicate the attributes of messages transmitted between processes in the first communication link. In specific implementations, the first dimension information may also indicate the attributes of messages transmitted between processes in other communication links besides the first communication link.

[0111] For example, the first dimension information is used to indicate the attributes of messages transmitted between processes in a communication link within a computing device, the communication link in the computing device including a first communication link and other communication links, such as a second communication link. For instance, combined with... Figure 5The first dimension measurement information includes the attributes of messages in the communication link formed by process AD, and also includes the attributes of messages in the communication link formed by process EH. For example, please refer to Table 3, which is another type of first dimension measurement information provided in this application embodiment. In Table 3, the first dimension measurement information includes the attributes of messages in the communication link formed by process AD, and also includes the attributes of messages in the communication link formed by process EH.

[0112] Table 3 First Dimension Measurement Information

[0113]

[0114] In some cases, computing devices include a module for recording runtime monitoring information of processes running on the device. Optionally, this module can be a hardware module or a software module.

[0115] For example, the computing device includes a message logging module that is connected to or deployed within communication middleware. See, for instance, [link to relevant documentation]. Figure 2 , Figure 2 The computing device 20 shown deploys a communication middleware, which includes a message logging module. The message logging module records the attributes of messages transmitted by processes within the computing device during communication, such as the identifier of the process associated with the message, the message identifier, and the message sending / receiving status. When an anomaly detection device needs to obtain maintenance information, it can utilize this message logging module to acquire the required maintenance information. For example, when the first communication link is interrupted, the anomaly detection device uses the message logging module to obtain the first maintenance information.

[0116] S302, the anomaly detection device obtains the abnormal process in the first communication link based on the topology of the first communication link and the first dimension measurement information.

[0117] The topology of the first communication link is used to indicate the message transmission relationships between processes in the first communication link. For example, please refer to... Figure 4 , Figure 4 It can be viewed as a communication topology. (By...) Figure 4 The message transmission relationship between processes A and B can be clearly defined. For example, for messages transmitted between processes A and B, process A is the sender of the message, and process B is the receiver. It should be noted that in actual implementation, the topology of the communication link can be represented in various forms, including but not limited to one or more of the following: diagrams, tables, and text.

[0118] In some possible implementations, the topology of the communication link can also indicate the identifiers of messages transmitted in the first communication link and the message sending / receiving types, which helps the anomaly detection device detect abnormal processes. For example, please refer to Table 4, which is another example of a communication link topology.

[0119] Table 4. Topology of Communication Links

[0120]

[0121] Message transmission on an abnormal process is abnormal. For example, referring to the communication link shown in Table 4, under normal circumstances, process A should transmit message 1 to process B. However, in reality, the function of process A sending message 1 to process B is abnormal; in this case, process A is an abnormal process. Similarly, if process A sends message 1 to process B, but process B's function of receiving message 1 is abnormal, then process B is an abnormal process. Optionally, there may be more than one abnormal process in a communication link; an abnormal process may be the first process in a communication link or it may be the last process.

[0122] When the first communication link is interrupted, the anomaly detection device detects abnormal processes based on the topology and first dimension information of the first communication link. For example, please refer to Tables 2 and 4, assuming that the processes and messages involved in Tables 2 and 4 belong to the same communication link. Table 2 shows that message transmission between process A and process B is normal, and process C received message 2 from process B. Table 4 shows that process C is not the last process node in this communication link; normally, process C would also send message 3 to process D. However, the first dimension information shown in Table 2 does not record process C sending message 3. Therefore, it can be concluded that process C is an abnormal process.

[0123] Furthermore, the anomaly detection device can determine whether an abnormal process failed to send or receive messages based on the message sending and receiving types recorded in the first dimension measurement information. For example, if process 1 and process 2 are two adjacent process nodes, and both process 1 and process 2 jointly transmit message 1, the anomaly detection device determines that the abnormal process is process 1. Since there is no record of process 1 sending message 1 in the first dimension measurement information, it indicates that process 1's message sending function is abnormal. As another example, if process 2 is determined to be an abnormal process, and there is no record of process 2 receiving message 1 in the first dimension measurement information, it indicates that process 2's message receiving function is abnormal.

[0124] In other possible implementations, the anomaly detection device establishes a communication topology based on second-dimensional information. This second-dimensional information indicates the attributes of messages transmitted between processes running on the computing device; for example, message attributes include the identifier of the process associated with the message, the message identifier, and the message sending / receiving type. Furthermore, the second-dimensional information can reflect the message transmission relationships among the processes in the computing device. The anomaly detection device can use this second-dimensional information to associate processes on a communication link to establish a communication topology.

[0125] A communication topology is used to indicate the message transmission relationships between processes on a computing device, and includes at least the topology of a first communication link. For example, in conjunction with... Figure 5 Assuming the computing device includes processes A and H, processes A and D form a communication link, and process E and H form a communication link, the communication topology of the computing device can be configured as follows: Figure 5 What it represents.

[0126] In some cases, establishing a communication topology using the above implementation method depends on at least one normal operation of the computing device. That is, the second-dimensional information includes the attributes of messages transmitted between processes when the computing device first operates normally. In this way, the anomaly detection device can establish a correct communication topology.

[0127] In some other possible implementations, the second dimension information includes multiple message records, each message record containing one message attribute. The message attributes include at least the identifier of the process associated with the message, the message identifier, a message transmission status indicator, and a transmission time indicator. The message time indicator is used to arrange the message records included in the second dimension information in chronological order, thus establishing a communication topology.

[0128] For example, please refer to Table 5, which lists one possible scenario for second-dimensional measurement information.

[0129] Table 5 Examples of Second Dimensional Information

[0130]

[0131] Optionally, a process may send a message multiple times at different times. For example, see Table 5, where process A sends message 1 at three different times. For these duplicate transmissions, the anomaly detection device can perform deduplication, retaining only one transmission record. For instance, the anomaly detection device can deduplicate the second dimension information based on the index of "process name & process ID & message ID & message transmission indication," as shown in Table 6.

[0132] Table 6 shows examples of the second dimension measurement information after deduplication.

[0133] Process A Process001 Message001 send Process B Process002 Message001 take over Process B Process002 Message002 send Process C Process003 Message002 take over Process C Process003 Message003 send Process D Process004 Message003 take over Process E Process005 Message004 send Process F Process006 Message004 take over Process F Process006 Message005 send Process G Process007 Message005 take over Process G Process007 Message006 send Process H Process008 Message006 take over

[0134] Based on Table 6, the anomaly detection device can determine the communication relationships of the processes included in the second-dimensional measurement information, and thus establish a communication topology. Specifically, the anomaly detection device can determine that the processes included in the second-dimensional measurement information form two communication links: Link 1, A→B→C→D; Link 2, E→F→G→H. For example, please refer to... Figure 5 The processes included in the second dimension of the measurement information in Table 6 can be formed as follows: Figure 5 The communication topology shown is shown.

[0135] In some other possible implementations, the anomaly detection device updates the communication topology at regular intervals after the computing device is started.

[0136] In other possible implementations, the anomaly detection device establishes a communication topology based on a process configuration file. This configuration file includes processes for message subscription and publishing, and can be used to indicate the sending and receiving processes of at least one message transmitted via the communication link in the computing device. The message subscription process is the process receiving the message, and the message publishing process is the process sending the message. For example, the configuration file indicates that process A sends message 1 and process B receives message 1. Therefore, on the communication link transmitting message 1, processes A and B are adjacent, with process A preceding process B.

[0137] In some schemes, the configuration file includes structural information about the processes in the computing device. This structural information includes at least the process identifier, subscription information, and publication information. Specifically, the process subscription information includes information about the processes sending messages to that process and the message information, while the process publication information refers to the information about the messages sent by that process. For an example, please refer to [link to example]. Figure 6A , Figure 6A This is a schematic diagram of the structure information of a process provided in an embodiment of this application.

[0138] In this context, the process name that publishes the message refers to the process that sends the message, the message name that publishes the message refers to the message published by the process that publishes the message, and the message name that subscribes to refers to the message that the process receives. In some cases, for the same subscribed process, the message name and the message name that subscribes to can be the same.

[0139] Optionally, in some schemes, the process name is represented by ProcessName, the subscription information by SubTopic, the process name publishing the message by PubProcessName, the name of the published message by PubTopicName, the name of the subscribed message by SubTopicName, and the message type by MsgType. Alternatively, the published information is represented by PubTopic, the name of the published message by TopicName, and the message type by MsgType.

[0140] The following is a specific example based on the process structure information described above. Please refer to [link / reference]. Figure 6B , Figure 6B This is a schematic diagram of a configuration file provided in an embodiment of this application.

[0141] From the above example, we can conclude that process A sends message 1, process B subscribes to message 1 from process A and message 3 from process D, process B sends message 2, and process C subscribes to message 2 from process B. The anomaly detection device is based on... Figure 6B The structural information of the processes shown indicates that processes A, B, and C form a communication link, thus establishing a communication topology.

[0142] As described above, the information included in the configuration file represents the send-receive relationship between two adjacent processes in a communication link. The exception handling device can directly establish a communication topology based on the send-receive relationship of the processes included in the configuration file. This approach not only improves the efficiency of establishing the communication topology but also helps to quickly identify the abnormal process causing the interruption when the communication link is interrupted. Furthermore, it helps to quickly find the cause of the abnormal process failure, so as to repair the communication link in a timely manner, ensuring the normal operation of business functions and protecting user experience.

[0143] Figure 3 The illustrated embodiment introduces an anomaly detection method. This method detects abnormal processes in the first communication link by using the topology and first dimension information of the first communication link. This method can improve the efficiency of detecting abnormal processes in the communication link and helps to ensure user experience.

[0144] The aforementioned combination Figure 3 This paper introduces several possible implementation methods for anomaly detection methods. The following section combines... Figure 7 A specific implementation method is described. It should be understood that... Figure 7 For some of the concepts and logic in the text, please refer to Figure 3 Description of the illustrated embodiments.

[0145] Please see Figure 7 , Figure 7This is a flowchart illustrating another anomaly detection method provided in this application. Optionally, this method is applied to a computing device. For example, this method is applied to... Figure 1 The computing device 10 shown is implemented by the anomaly detection device 101. Alternatively, this method can be applied to... Figure 2 The computing device 20 shown is described below. For ease of understanding, the execution entity will be described using the anomaly detection device as an example.

[0146] Figure 7 The anomaly detection device shown in the embodiment includes a message logging module, a communication interruption analysis module, and a communication topology analysis module. The message logging module is mainly used to record the attributes of messages transmitted by processes participating in communication within the computing device; the communication interruption analysis module is used to analyze abnormal processes that cause communication link interruptions; and the communication topology analysis module is used to establish the communication topology.

[0147] like Figure 7 The anomaly detection method shown may include multiple steps in S701 to S703. It should be understood that, for ease of description, the embodiments of this application are described in the order of S701 to S703, and are not intended to limit the execution to this order. This application does not limit the order of the above one or more steps, the execution time, or the number of executions. S701 to S703 are as follows.

[0148] S701, the anomaly detection device establishes a communication topology based on the second dimension measurement information.

[0149] In some cases, establishing a communication topology depends on the initial normal operation of the computing device. This is because, when the computing device is running normally, the second-dimensional information can include the correct message attributes of the processes running on the computing device, such as the identifier of the process associated with the message, the message identifier, and the message sending / receiving type. Thus, the communication topology analysis module can establish the correct communication topology.

[0150] In communication, a message (information transmitted between processes) can only be received by the receiving process if the sending process sends it first. Therefore, the order in which processes send and receive messages can be determined by the chronological order of the tracking information. Optionally, the anomaly detection device will initially calculate the tracking information during normal operation of the device and arrange it in chronological order to establish a communication topology. For example, please refer to Table 6, which is an example of message records arranged in chronological order.

[0151] Table 7 shows an example of message records arranged in chronological order.

[0152] 10:00:01 Process A Process001 Message 1 send 0 10:00:02 Process B Process002 Message 1 take over 1 10:00:03 Process B Process002 Message 1 take over 2 10:00:04 Process B Process002 Message 2 send 3 10:00:05 Process C Process003 Message 2 take over 4 10:00:06 Process C Process003 Message 2 take over 5

[0153] Because messages are sent at a certain frequency during communication between two processes, the same "node name (process name) & process ID & message name & message packet type" (hereinafter referred to as the index) will appear many times in the log entries (only the timestamp and message packet sequence number are different). Therefore, when establishing the communication topology, it is necessary to deduplicate the log entries based on the index, retaining only one log entry with the same index. For example, please refer to Table 8, which lists an example of deduplicated log entries. The data in Table 8 is based on Table 7.

[0154] Table 8 shows an example of point information arranged in chronological order.

[0155] Process A Process001 Message 1 send Process B Process002 Message 1 take over Process B Process002 Message 2 send Process C Process003 Message 2 take over

[0156] Next, the communication topology analysis module uses the deduplicated message information to establish communication topology by associating processes based on message name and message packet type, thus creating a communication topology. Specifically, the module connects processes with the same message name and message packet type in the sending and receiving direction, thereby obtaining the connection relationships between process nodes, i.e., the communication topology, for use by the subsequent communication interruption analysis module. For example, as shown in Table 8, process A sends message 1 to process B, process B sends message 2 to process C, and process C sends message 3 to process D. Therefore, based on Table 8, the communication topology can be determined as follows: Figure 8 As shown, Figure 8 This is a schematic diagram of another communication topology provided in the embodiments of this application.

[0157] S702, when the first communication link is interrupted, the anomaly detection device acquires the first dimension measurement information.

[0158] The first dimension information includes message records of the processes in the first communication link during communication, used to indicate the attributes of messages transmitted by the processes participating in the communication in the first communication link. For example, please refer to Table 9, which lists... Figure 8 This is another example of the first dimension measurement information of the communication link shown.

[0159] Table 9 First Dimension Measurement Information

[0160] 18:00:01 Process A Process001 Message 1 send 0 18:00:02 Process A Process001 Message 1 send 1 18:00:03 Process B Process002 Message 1 take over 2 18:00:04 Process B Process002 Message 2 send 3 18:00:05 Process B Process002 Message 2 send 4 18:00:06 Process B Process002 Message 2 send 5

[0161] S703, the anomaly detection device obtains the anomaly process based on the topology of the first communication link and the first dimension measurement information.

[0162] Specifically, the anomaly detection device compares the topology of the first communication link with the first dimension measurement information. If it finds that there is no message record for a certain process of the first communication link in the first dimension measurement information, it indicates that the process node was the first to be interrupted. For example, see Table 9 below. Figure 8 Please provide an explanation.

[0163] Depend on Figure 8 It can be seen that processes A and C form a communication link, and the order is process A → process B → process C. Table 9 shows that process A successfully sent message 1, process B successfully received message 1 from process A, and process B successfully sent message 2. However, in the first dimension of the information shown in Table 9, there is no record of process C receiving message 2, indicating that the message transmission was interrupted in process C, and process C is an abnormal process.

[0164] Please see Figure 9 , Figure 9 yes Figure 7 Another flowchart of the embodiment. Figure 9 Showing Figure 7 The main ideas for establishing the communication topology and detecting abnormal processes in the implementation example.

[0165] Figure 7 The illustrated embodiment presents a specific anomaly detection method. This method acquires tracking information during the initial normal operation of the computing device and establishes the communication topology of the processes running on the computing device. Thus, the anomaly detection device can establish an accurate communication topology. When the first communication link is interrupted, abnormal processes in the first communication link are detected based on the topology of the first communication link and the first dimension measurement information. Therefore, this application can improve the efficiency of detecting abnormal processes in the communication link, helping to ensure a better user experience.

[0166] The aforementioned combination Figure 7 This application introduces a specific anomaly detection method provided by an embodiment. The following section combines... Figure 10 This application introduces yet another specific anomaly detection method provided in its embodiments. It should be understood that... Figure 10 For some of the concepts and logic in the text, please refer to Figure 3 and Figure 7 Description of the illustrated embodiments.

[0167] Please see Figure 10 , Figure 10 This is a flowchart illustrating another anomaly detection method provided in this application. Optionally, this method is applied to a computing device. For example, this method is applied to... Figure 1 The computing device 10 shown is implemented by the anomaly detection device 101. Alternatively, this method can be applied to... Figure 2 The computing device 20 shown is described below. For ease of understanding, the execution entity will be described using the anomaly detection device as an example.

[0168] Figure 10The anomaly detection device shown in the embodiment includes a message logging module, a communication interruption analysis module, and a communication topology analysis module. The message logging module is mainly used to record the attributes of messages transmitted by processes participating in communication within the computing device; the communication interruption analysis module is used to analyze abnormal processes that cause communication link interruptions; and the communication topology analysis module is used to establish the communication topology.

[0169] like Figure 10 The anomaly detection method shown may include multiple steps in S1001 to S1003. It should be understood that, for ease of description, the embodiments of this application are described in the order of S1001 to S1003, and are not intended to limit the execution to this order. This application does not limit the order of the above one or more steps, the execution time, or the number of executions. S1001 to S1003 are as follows.

[0170] S1001, the anomaly detection device obtains the configuration file.

[0171] The configuration file includes structural information about processes in the computing device, which at least includes the process identifier, subscription information, and publication information. The process subscription information includes information about the processes sending messages to that process and the message information. The process publication information refers to the information about the messages sent by that process. For an example, please refer to [link to example]. Figure 6A and Figure 6B , Figure 6A This provides an example of a structure that displays the structural information of a process. Figure 6B based on Figure 6A This is an example that lists the structural information of processes A, B, and C.

[0172] In some solutions, the configuration file is stored in the storage unit of the computing device. Alternatively, the anomaly detection device uses a message logging module to retrieve the configuration file.

[0173] S1002, the anomaly detection device establishes a communication topology based on a configuration file.

[0174] From the above example, we can conclude that process A sends message 1, process B subscribes to message 1 from process A and message 3 from process D, process B sends message 2, and process C subscribes to message 2 from process B. The anomaly detection device is based on... Figure 6B The structural information of the processes shown indicates that processes A, B, and C form a communication link, thus establishing a communication topology.

[0175] As described above, the information included in the configuration file represents the send-receive relationship between two adjacent processes in a communication link. The exception handling device can directly establish a communication topology based on the send-receive relationship of the processes included in the configuration file. This approach not only improves the efficiency of establishing the communication topology but also helps to quickly identify the abnormal process causing the interruption when the communication link is interrupted. Furthermore, it helps to quickly find the cause of the abnormal process failure, so as to repair the communication link in a timely manner, ensuring the normal operation of business functions and protecting user experience.

[0176] S1003, when the first communication link is interrupted, the anomaly detection device acquires the first dimension measurement information.

[0177] Step S1004: The anomaly detection device obtains the anomaly process based on the topology of the first communication link and the first dimension measurement information.

[0178] Figure 10 Step S1003 and in the illustrated embodiment Figure 7 Step S702 in the illustrated embodiment is the same. Figure 10 Step S1004 and in the illustrated embodiment Figure 7 Step S703 in the illustrated embodiment is the same, therefore regarding Figure 10 Please refer to the foregoing for steps S1003 and S1004 in the embodiment. Figure 7 The descriptions of steps S702 and S703 in the embodiments will not be repeated here.

[0179] Please see Figure 11 , Figure 11 yes Figure 10 Another flowchart of the embodiment. Figure 11 Showing Figure 10 The main ideas for establishing the communication topology and detecting abnormal processes in the implementation example.

[0180] Figure 10 The illustrated embodiment presents another specific anomaly detection method. This method establishes a communication topology structure of processes running on a computing device based on a configuration file. Thus, the anomaly detection device can easily and accurately establish the communication topology structure. When the first communication link is interrupted, abnormal processes in the first communication link are detected based on the topology structure and first dimension information of the first communication link. Therefore, this application can improve the efficiency of detecting abnormal processes in the communication link, helping to ensure user experience.

[0181] The methods of the embodiments of this application have been described in detail above. The apparatus of the embodiments of this application is provided below. It should be understood that the module division of the apparatus provided in this application is merely an exemplary illustration of one way to divide the structure of the apparatus. In practical applications, the structure of the apparatus can also be divided in other ways. This application is equally applicable to apparatuses with other division methods but the same function. Furthermore, the apparatus name provided in this application is an exemplary name and can be replaced in specific implementations.

[0182] Please see Figure 12 , Figure 12 This is a schematic diagram of the structure of an anomaly detection device provided in an embodiment of this application. The anomaly detection device 120 can be a standalone device (e.g., as shown in the image). Figure 1 The computing device 10 shown, or Figure 2 The computing device 20 shown can also be a module within a standalone device, including hardware and / or software modules. The anomaly detection device 120 is used to implement the aforementioned anomaly detection method, for example... Figure 3 , Figure 7 , Figure 10 The anomaly detection method shown.

[0183] The anomaly detection device 120 includes an acquisition unit 1201 and a processing unit 1202. The acquisition unit 1201 performs acquisition operations, such as step S301. The processing unit 1202 performs operations such as obtaining, creating, and arranging, such as step S302.

[0184] In one possible implementation, the acquisition unit 1201 is used to acquire first dimension measurement information when the first communication link is detected to be interrupted, and the processing unit 1202 is used to obtain abnormal processes in the first communication link based on the topology of the first communication link and the first dimension measurement information.

[0185] In another possible implementation, the acquisition unit 1201 is further configured to acquire second dimension information, and the processing unit 1202 is further configured to establish a communication topology based on the second dimension information.

[0186] In another possible implementation, the processing unit 1202 is further configured to arrange the multiple message records in chronological order based on the transmission time of each message record in the multiple message records, and to establish a communication topology based on the multiple message records arranged in chronological order.

[0187] In another possible implementation, the acquisition unit 1201 is further configured to acquire a configuration file, and the processing unit 1202 is further configured to establish a communication topology based on the configuration file.

[0188] Please see Figure 13 , Figure 13This is a schematic diagram of an anomaly detection device provided in an embodiment of this application. The anomaly detection device 130 includes: a processor 1301, a communication interface 1302, a memory 1303, and a connection line 1304. The processor 1301, the communication interface 1302, and the memory 1303 communicate with each other via the connection line 1304. The anomaly detection device 130 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the anomaly detection device 130.

[0189] Processor 1301 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0190] The communication interface 1302 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the anomaly detection device 130 and other devices or communication networks.

[0191] The memory 1303 may include volatile memory, such as random access memory (RAM). The processor 1301 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0192] The memory 1303 stores executable program code, and the processor 1301 executes the executable program code to implement the function of the anomaly detection device, thereby implementing the anomaly detection method described above. That is, the memory 1303 stores instructions for executing the anomaly detection method.

[0193] The connection line 1304 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 13The bus is represented by a single line, but this does not mean that there is only one bus or one type of bus. The connection line 1304 may include a path for transmitting information between the various components of the anomaly detection device 130 (e.g., processor 1301, memory 1303, and communication interface 1302).

[0194] This application also provides a computer program product. This computer program product may be a software or program product containing instructions that can run on a computing device or be stored on any available medium. When the computer program product is run on a computing device, it causes the computing device to perform the anomaly detection method described above.

[0195] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of being stored by a computing device, or a data storage device such as a data center containing one or more available media. The aforementioned available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives). The computer-readable storage medium includes instructions that instruct the computing device to perform the anomaly detection method described above.

[0196] In addition, a few additional points need to be made regarding this application:

[0197] I. The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of this application.

[0198] 2. Unless otherwise stated, “multiple” means two or more.

[0199] 3. Unless otherwise specified or in case of logical conflict, the terms and / or descriptions in different embodiments of this application are consistent and can be referenced by each other. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0200] IV. The various numerical designations used in this application are merely for descriptive convenience and are not intended to limit the scope of protection of this application. The magnitude of the serial numbers used in this application does not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic. For example, the terms "first," "second," "third," "fourth," and other various terminology (if present) in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. Such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein.

[0201] Furthermore, any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner for ease of understanding.

[0202] V. The terms “comprising” and “having” and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules that are expressly listed, but may include other steps or modules that are not expressly listed or that are inherent to such process, method, product or device.

[0203] VI. In this application, "for indicating" can be understood as "enabling". "Enabling" can include direct enabling and indirect enabling. When describing information for enabling A, it can include whether the information directly enables A or indirectly enables A, but does not necessarily mean that the information carries A.

[0204] The information that enables the information is called the information to be enabled. In the specific implementation process, there are many ways to enable the information to be enabled, such as, but not limited to, directly enabling the information to be enabled, such as the information to be enabled itself or its index. It can also be indirectly enabled by enabling other information, where there is a relationship between the other information and the information to be enabled. It can also enable only a part of the information to be enabled, while the other parts are known or pre-agreed upon. For example, enabling specific information can be achieved by using a pre-agreed (e.g., protocol-defined) arrangement of various pieces of information, thereby reducing enabling overhead to some extent. Simultaneously, common parts of various pieces of information can be identified and enabled uniformly to reduce the enabling overhead caused by individually enabling the same information.

[0205] VII. In this application, "predefined" may include preconfiguration. For example, predefining certain information means that the information is calculated or received in advance before performing an action that uses the information. The "predefined" can be implemented by pre-storing corresponding codes, tables, or other means that can be used to indicate relevant information in the device (e.g., controller or vehicle). This application does not limit the specific implementation method.

[0206] 8. The term "storage" or "preservation" in this application can refer to storage in one or more memory devices. These memory devices can be separately configured or integrated into an encoder, decoder, processor, or communication device. Alternatively, some memory devices can be separately configured, while others can be integrated into a decoder, processor, or communication device. The type of memory can be any form of storage medium, and this is not limited.

Claims

1. An anomaly detection method, characterized in that, Applied to a computing device, wherein multiple processes run on the computing device, the multiple processes form at least one communication link, each communication link includes at least two processes, and the at least two processes within each communication link can transmit messages, the method includes: When a first communication link is detected to be interrupted, first dimension measurement information is obtained. The first communication link includes at least two processes, and the processes within the first communication link are able to transmit messages. The processes on the first communication link are run by the computing device. The first dimension measurement information is used to indicate the attributes of messages transmitted between the processes in the first communication link. The attributes of the messages include the identifier of the process associated with the message, the identifier of the message, and the transmission status indication of the message. Based on the topology of the first communication link and the first dimension measurement information, abnormal processes in the first communication link are obtained. The topology of the first communication link is used to indicate the message transmission relationship between processes in the first communication link, and the message transmission related to the abnormal process is abnormal.

2. The method according to claim 1, characterized in that, The first communication link includes the target process. If the target process does not receive the target message within a first time, the first communication link is in an interrupted state, and the target message is transmitted through the first communication link. The abnormal process is located before the target process in the first communication link, or the abnormal process is the target process.

3. The method according to claim 1 or 2, characterized in that, The first communication link includes an adjacent first process and a second process, wherein the first process is used to send a first message to the second process; The first dimension measurement information includes first information but does not include second information. The first information includes the identifier of the first process, the identifier of the first message, and a first sending indication, wherein the first sending indication is a transmission status indication of the first message. The second information includes the identifier of the second process, the identifier of the first message, and a first receiving indication, wherein the first receiving indication is a transmission status indication of the first message. The abnormal process includes the second process.

4. The method according to claim 1 or 2, characterized in that, The first communication link includes an adjacent first process and a second process, wherein the first process is used to send a first message to the second process; The first dimension measurement information does not include the first information. The first information includes the identifier of the first process, the identifier of the first message, and the first sending indication. The first sending indication is a transmission status indication of the first message. The abnormal process includes the first process.

5. The method according to any one of claims 1-4, characterized in that, The topology of the first communication link is also used to indicate the identifier of the message transmitted by the process in the first communication link and the message sending and receiving type.

6. The method according to any one of claims 1-5, characterized in that, Before obtaining the abnormal process in the first communication link based on the topology of the first communication link and the first dimension measurement information, the method further includes: Obtain second dimension information, which is used to indicate the attributes of messages transmitted between processes running on the computing device; Based on the second dimension measurement information, a communication topology is established, which includes the topology of the first communication link.

7. The method according to claim 6, characterized in that, The second dimension measurement information includes multiple message records. Each message record includes attributes of a message transmitted by a process. The message record includes the identifier of the process associated with the message, the identifier of the message, a transmission status indicator, and a transmission time indicator. The method further includes: Based on the transmission time of each message record in the plurality of message records, the plurality of message records are arranged in chronological order; The establishment of the communication topology based on the second dimension measurement information includes: The communication topology is established based on the multiple message records arranged in chronological order.

8. The method according to any one of claims 1-5, characterized in that, Before obtaining the abnormal process in the first communication link based on the topology of the first communication link and the first dimension measurement information, the method further includes: Obtain a configuration file, which is used to indicate the sending process and receiving process of at least one message transmitted by the at least one communication link; Based on the configuration file, a communication topology is established, which includes the topology of the first communication link.

9. The method according to claim 8, characterized in that, The configuration file includes the structural information of the processes in the first communication link. The structural information includes the process identifier, subscription information, and publication information. The subscription information includes the identifier of the process publishing the message and the publication name of the message. The publication information includes the publication name of the message.

10. The method according to any one of claims 1-9, characterized in that, The first dimension measurement information also includes a time indication, which includes a timestamp and / or the sequence number of the message packet.

11. The method according to any one of claims 1-10, characterized in that, The multiple processes transmit information through a communication middleware, and obtaining the first dimension measurement information includes: The first dimension measurement information is obtained using a message recording module, which is set in or connected to the message middleware and is used to record the attributes of messages transmitted by the multiple processes.

12. An anomaly detection device, characterized in that, The anomaly detection device is included in a computing device, on which multiple processes run, forming at least one communication link. Each communication link includes at least two processes, and the at least two processes in each communication link can transmit messages. The anomaly detection device includes an acquisition module and a processing module; The acquisition module is used for When the first communication link is detected to be interrupted, first dimension measurement information is obtained. The first dimension measurement information is used to indicate the attributes of messages transmitted between processes in the first communication link. The attributes of the message include the identifier of the process associated with the message, the identifier of the message, and the transmission status indication of the message. The processing module is used for Based on the topology of the first communication link and the first dimension measurement information, abnormal processes in the first communication link are obtained. The topology of the first communication link is used to indicate the message transmission relationship between processes in the first communication link, and the message transmission related to the abnormal process is abnormal.

13. The anomaly detection device according to claim 12, wherein the first communication link includes a target process, and if the target process does not receive a target message within a first time, the first communication link is in an interrupted state, and the target message is transmitted through the first communication link; The abnormal process is located before the target process in the first communication link, or the abnormal process is the target process.

14. The anomaly detection device according to claim 12 or 13, characterized in that, The first communication link includes an adjacent first process and a second process, wherein the first process is used to send a first message to the second process; The first dimension measurement information includes first information but does not include second information. The first information includes the identifier of the first process, the identifier of the first message, and a first sending indication, wherein the first sending indication is a transmission status indication of the first message. The second information includes the identifier of the second process, the identifier of the first message, and a first receiving indication, wherein the first receiving indication is a transmission status indication of the first message. The abnormal process includes the second process.

15. The anomaly detection device according to claim 12 or 13, characterized in that, The first communication link includes an adjacent first process and a second process, wherein the first process is used to send a first message to the second process; The first dimension measurement information does not include the first information. The first information includes the identifier of the first process, the identifier of the first message, and the first sending indication. The first sending indication is a transmission status indication of the first message. The abnormal process includes the first process.

16. The anomaly detection device according to any one of claims 12-15, characterized in that, The topology of the first communication link is also used to indicate the identifier of the message transmitted by the process in the first communication link and the message sending and receiving type.

17. The anomaly detection device according to any one of claims 12-16, characterized in that, Before obtaining the abnormal process in the first communication link based on the topology of the first communication link and the first dimension measurement information, The acquisition module is also used to acquire second dimension information, which is used to indicate the attributes of messages transmitted between processes running on the computing device; The processing module is further configured to establish a communication topology based on the second dimension measurement information, wherein the communication topology includes the topology of the first communication link.

18. The anomaly detection device according to claim 17, characterized in that, The second dimension measurement information includes multiple message records. Each message record includes attributes of a message transmitted by a process. The message record includes the identifier of the process associated with the message, the message identifier, the message transmission status indicator, and the message transmission time indicator. The processing module is further configured to: Based on the transmission time of each message record in the plurality of message records, the plurality of message records are arranged in chronological order; The establishment of the communication topology based on the second dimension measurement information includes: The communication topology is established based on the multiple message records arranged in chronological order.

19. The anomaly detection device according to any one of claims 12-16, characterized in that, Before obtaining the abnormal process in the first communication link based on the topology of the first communication link and the first dimension measurement information, The acquisition module is also used to acquire a configuration file, which is used to indicate the sending process and receiving process of at least one message transmitted by the at least one communication link; The processing module is also used to establish a communication topology based on the configuration file, the communication topology including the topology of the first communication link.

20. The anomaly detection device according to claim 19, characterized in that, The configuration file includes the structural information of the processes in the first communication link. The structural information includes the process identifier, subscription information, and publication information. The subscription information includes the identifier of the process publishing the message and the publication name of the message. The publication information includes the publication name of the message.

21. The anomaly detection device according to any one of claims 12-20, characterized in that, The first dimension measurement information also includes a time indication, which includes a timestamp and / or the sequence number of the message packet.

22. The anomaly detection device according to any one of claims 12-21, characterized in that, The multiple processes transmit information through a communication middleware, and the acquisition module is further configured to: The first dimension measurement information is obtained using a message recording module, which is set in or connected to the message middleware and is used to record the attributes of messages transmitted by the multiple processes.

23. An anomaly detection device, characterized in that, The anomaly detection device includes a processor and a memory, the memory storing a computer program, and the processor being used to call the computer program stored in the memory to implement the method according to any one of claims 1-11.

24. A readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program, the computer program comprising methods for performing any one of claims 1-11.

25. A computer program product, characterized in that, When the computer program product is executed by a processor, the method described in any one of claims 1-11 is performed.

Images