A vehicle networking distributed anomaly detection method and system

Abstract

The application discloses a vehicle networking distributed anomaly detection method and system. By obtaining vehicle operation data corresponding to at least two vehicle anomaly detection tasks and a current processing link, associating abnormal changes with a processing path to form a local abnormal state, and forming a shared processing dependency based on common distributed processing nodes in each current processing link, the local abnormal state is synchronously collected. From the synchronized abnormal set, determine the common abnormal features and the abnormal propagation starting point, establish the abnormal propagation relationship, distinguish the common cause abnormal component and the vehicle residual abnormal state, and adjust the original abnormal detection result output state. The two types of abnormalities are reviewed through alternative processing link review to form the corresponding vehicle anomaly confirmation result, thereby improving the accuracy of abnormal source identification and vehicle anomaly confirmation in the vehicle networking distributed environment.

Description

Technical Field

[0001] This application relates to the field of vehicle network data processing and anomaly detection technology, and in particular to a distributed anomaly detection method and system based on vehicle network. Background Technology

[0002] As vehicle-to-everything (V2X) platforms continuously integrate vehicle operation data, vehicle status monitoring, fault identification, and operational risk analysis are gradually evolving from local processing on a single vehicle basis to a distributed processing approach that integrates vehicle, edge, and platform components. Before generating anomaly detection results, vehicle operation data typically undergoes multiple processing stages, including data access, protocol parsing, data conversion, feature processing, and anomaly detection. Anomaly detection tasks for different vehicles may also share some distributed processing nodes. With the continuous increase in the number of vehicles and the scale of detection tasks, timely identification of the true source of anomalies corresponding to anomaly detection results is crucial for improving the accuracy of vehicle operation status assessment and the anomaly handling capabilities of V2X platforms.

[0003] Currently, vehicle anomaly detection in the Internet of Vehicles (IoV) typically uses vehicle operation data corresponding to each anomaly detection task as the detection object. It identifies abnormal changes in vehicle operation data through threshold judgment, rule detection, statistical analysis, or anomaly detection models, and determines the vehicle's operating status based on the resulting anomaly detection results. When multiple vehicles experience anomalies at similar times, correlation analysis is usually performed based on the similarity between the anomaly detection results, anomaly occurrence time, anomaly type, or anomaly characteristics. This is combined with platform operation logs, node alarm information, or service operation status to investigate related anomalies and determine whether there are any anomalies in the anomaly detection task or vehicle operating status.

[0004] The aforementioned processing methods primarily focus on judging the anomaly detection results already generated by each vehicle anomaly detection task, failing to adequately utilize the actual distributed processing procedures that vehicle operation data undergoes and the shared processing relationships between multiple vehicle anomaly detection tasks. When multiple vehicle anomaly detection tasks jointly pass through the same distributed processing node and generate related anomalies due to the shared distributed processing process, it is difficult to determine the actual propagation source of the common anomaly in the distributed processing chain based solely on the anomaly detection results and the time of anomaly occurrence. Furthermore, it is difficult to determine which anomalies in each vehicle are introduced by shared processing reasons and which are still vehicle-specific anomalies. Therefore, when multiple vehicle anomaly detection tasks generate related anomalies due to the shared distributed processing process, it is difficult to determine the actual propagation source of the common anomaly and to distinguish between anomalies introduced by shared processing reasons and vehicle-specific anomalies. Summary of the Invention

[0005] In view of the above-mentioned actual situation, this application proposes a distributed anomaly detection method and system based on vehicle networking to solve the problem that when multiple vehicle anomaly detection tasks are affected by the shared distributed processing process and generate related anomalies in the existing distributed anomaly detection process of vehicle networking, it is difficult to determine the actual propagation source of the common anomaly and to distinguish between anomalies introduced by the shared processing and anomalies of the vehicle itself.

[0006] A distributed anomaly detection method based on vehicle-to-everything (V2X) networks includes:

[0007] The system acquires vehicle operation data corresponding to at least two vehicle anomaly detection tasks and the current processing link formed by the sequential passing of each vehicle operation data through distributed processing nodes. It performs anomaly detection on the vehicle operation data to obtain abnormal changes and associates the abnormal changes with the corresponding current processing link to form a local anomaly state.

[0008] Based on the current processing links associated with each local abnormal state, the distributed processing nodes that each current processing link passes through are determined to form a shared processing dependency. Based on the shared processing dependency, each local abnormal state is synchronously collected to form a synchronous abnormal set corresponding to the shared processing dependency.

[0009] A common anomaly feature is determined from the set of synchronous anomalies. The anomaly propagation starting point is determined based on the existence and state changes of the common anomaly feature in each current processing link associated with the shared processing dependency. An anomaly propagation relationship is formed by the common anomaly feature and the anomaly propagation starting point, which are associated with each local anomaly state in the set of synchronous anomalies and the corresponding vehicle anomaly detection task.

[0010] Based on the aforementioned abnormal propagation relationship, common cause abnormal components are determined from each associated local abnormal state, and the abnormal changes in each local abnormal state that are not attributed to the corresponding common cause abnormal components are respectively used to form the corresponding vehicle residual abnormal state.

[0011] Based on the aforementioned anomaly propagation relationship and each common cause anomaly component, the output state of the anomaly detection results formed by the vehicle anomaly detection task associated with the anomaly propagation relationship through the current processing link is adjusted respectively. The alternative processing link is re-examined for each of the aforementioned vehicle anomaly detection tasks. Based on the re-examination results, each common cause anomaly component and the corresponding vehicle residual anomaly state are reviewed respectively. The output state of the corresponding anomaly detection results is updated and the corresponding vehicle anomaly confirmation result is formed.

[0012] The proposed method and system for distributed anomaly detection based on vehicle-to-everything (V2X) networks enable the tracking of the common processing source of multiple vehicle anomaly detection tasks and the location of the common anomaly propagation starting point. It can also distinguish between common-cause anomalies and residual vehicle anomalies under the constraint of anomaly propagation relationships, and perform post-confirmation of anomaly attribution through alternative processing link re-examination, thereby improving the accuracy of anomaly source identification and vehicle anomaly confirmation in the distributed environment of V2X networks. Attached Figure Description

[0013] Figure 1 A flowchart illustrating a distributed anomaly detection method based on vehicle networking provided in this application embodiment;

[0014] Figure 2 This is a schematic diagram illustrating the synchronization and aggregation of local anomalies under shared processing dependency constraints provided in an embodiment of this application.

[0015] Figure 3 A schematic diagram illustrating the re-attribution of local abnormal states under the constraint of abnormal propagation relationship provided in an embodiment of this application;

[0016] Figure 4 This is a schematic diagram of the alternative processing link re-examination under the constraint of same source of upstream input data provided in the embodiments of this application;

[0017] Figure 5 This is a schematic diagram illustrating the item-by-item verification of residual abnormal states of a vehicle provided in an embodiment of this application;

[0018] Figure 6 This is a schematic diagram of a distributed anomaly detection system based on the Internet of Vehicles provided in an embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and technical effects of this application clearer, the embodiments of this application will be further described in detail below with reference to the accompanying drawings.

[0020] It should be noted that the vehicle operation data, vehicle anomaly detection task execution data, distributed processing node data, and processing records corresponding to the vehicle anomaly detection task execution process involved in this embodiment are all generated during the data acquisition and distributed data processing process of the vehicle network system. During the execution of the corresponding vehicle anomaly detection task, the vehicle operation data sequentially enters the relevant distributed processing nodes. Each distributed processing node completes the corresponding data processing according to the data processing relationship of the vehicle anomaly detection task, ensuring a correspondence between the vehicle operation data, the task execution process, and the node processing process.

[0021] In implementation scenarios where vehicle-side, edge-side, and platform-side collaborative processing is used, each processing end maintains the identity of the vehicle anomaly detection task, the identity of the vehicle operation data, and the identity of the processing path according to the data flow relationship of the vehicle anomaly detection task. Anomaly changes can thus be mapped to their actual distributed processing process. Subsequent analysis of shared processing sources, establishment of anomaly propagation relationships, and re-examination of alternative processing links all use this mapping relationship as the basis for task-level processing.

[0022] In this embodiment, a distributed anomaly detection method based on vehicle-to-everything (V2X) is applied to a distributed data processing scenario in V2X where vehicle operation data undergoes data processing and anomaly detection via multiple distributed processing nodes.

[0023] The vehicle anomaly detection task is a computer-executed task that takes the corresponding vehicle operation data as the processing object, performs vehicle operation status processing and anomaly detection according to the set data processing relationship, and generates anomaly detection results.

[0024] Vehicle operation data refers to the vehicle operation-related data processed by the corresponding vehicle anomaly detection task. The vehicle operation data maintains its correspondence with the specific vehicle anomaly detection task during task execution.

[0025] Distributed processing nodes are processing units that participate in the data processing of vehicle anomaly detection tasks and undertake corresponding data processing functions.

[0026] The current processing link is the data processing relationship formed by the vehicle operation data passing through the distributed processing nodes in the actual execution of the corresponding vehicle anomaly detection task. It maintains the data processing order and data transmission relationship of the relevant distributed processing nodes.

[0027] In this embodiment, after an anomaly is detected in a vehicle anomaly detection task, the anomaly changes are correlated with the actual current processing link during the time period related to the anomaly occurrence. Then, based on the shared distributed processing relationship between multiple vehicle anomaly detection tasks, a common anomaly source is determined. Under the propagation constraints formed by the common anomaly source, the attribution of each anomaly change is determined, and a re-inspection result is formed through an alternative processing link, ultimately forming the corresponding vehicle anomaly confirmation result.

[0028] The current processing link corresponds to the actual vehicle anomaly detection task execution process during the period related to the anomaly occurrence. The vehicle anomaly detection task identity, vehicle operation data identity, and the current processing link together constitute the processing basis for subsequent local anomaly states, shared processing dependencies, anomaly propagation relationships, and alternative processing link re-inspections.

[0029] like Figure 1 As shown, this embodiment provides a distributed anomaly detection method based on vehicle networking, which includes:

[0030] S101: Obtain vehicle operation data corresponding to at least two vehicle anomaly detection tasks and the current processing link formed by each vehicle operation data passing through distributed processing nodes in sequence; perform anomaly detection on the vehicle operation data to obtain abnormal changes; and associate the abnormal changes with the corresponding current processing link to form a local abnormal state.

[0031] S102, based on the current processing links associated with each of the local abnormal states, determine the distributed processing nodes that each of the current processing links passes through in common, form a shared processing dependency, and synchronously collect each local abnormal state based on the shared processing dependency to form a synchronous abnormal set corresponding to the shared processing dependency.

[0032] S103, determine common abnormal features from the set of synchronous abnormalities, determine the abnormal propagation starting point based on the existence and state changes of the common abnormal features in each current processing link associated with the shared processing dependency, and form an abnormal propagation relationship between the common abnormal features and the abnormal propagation starting point that associates each local abnormal state in the set of synchronous abnormalities with the corresponding vehicle abnormality detection task.

[0033] S104, based on the aforementioned abnormal propagation relationship, common cause abnormal components are determined from each associated local abnormal state, and the abnormal changes in each local abnormal state that are not attributed to the corresponding common cause abnormal components are respectively used to form the corresponding vehicle residual abnormal state.

[0034] S105, based on the abnormal propagation relationship and each common cause abnormal component, adjust the output state of the abnormal detection result formed by the vehicle abnormal detection task associated with the abnormal propagation relationship through the current processing link, perform alternative processing link re-examination on each of the vehicle abnormal detection tasks, review each common cause abnormal component and the corresponding vehicle residual abnormal state according to the re-examination result, update the corresponding abnormal detection result output state and form the corresponding vehicle abnormal confirmation result.

[0035] Figure 1 The above-mentioned first-level processing procedure is represented in the processing order of S101 to S105. The local abnormal state formed in S101 enters S102; the synchronous abnormal set formed in S102 enters S103; the abnormal propagation relationship formed in S103 continues to serve as the basis for S104 to perform abnormal re-attribution and S105 to implement result output state adjustment and alternative processing link re-examination; the common cause abnormal component and vehicle residual abnormal state formed in S104 enter S105; S105 completes the corresponding abnormal attribution verification based on the re-examination results and forms the vehicle abnormality confirmation result.

[0036] The above processing procedure will be explained below with reference to S101 to S105.

[0037] S101 forms a local abnormal state associated with the current processing link. In S101, vehicle operation data and corresponding current processing links corresponding to at least two vehicle anomaly detection tasks are obtained. Anomaly detection is performed on the vehicle operation data to obtain abnormal changes, and the abnormal changes are associated with the corresponding current processing links to form a local abnormal state.

[0038] Anomaly detection results are the output generated by the vehicle anomaly detection task after performing anomaly detection on the corresponding vehicle operation data.

[0039] An abnormal change is an abnormal change identified from the corresponding vehicle operation data based on the anomaly detection results, and it has a data identity consistent with the corresponding vehicle anomaly detection task.

[0040] Local anomaly state is a phased state formed by establishing a correlation between abnormal changes, abnormal time sequence information and abnormal change characteristics and the current processing link of the corresponding vehicle operation data. It retains the identity of the abnormal content, the identity of the abnormal time sequence, the identity of the vehicle anomaly detection task, and the identity of the processing path.

[0041] Figure 1 S101 in the process is represented by "forming a local anomaly state associated with the current processing link". After the local anomaly state is formed, the process proceeds to S102, which serves as the processing object for shared processing source analysis between different vehicle anomaly detection tasks.

[0042] S102 forms a shared processing dependency and a set of synchronous anomalies. In S102, based on the current processing links associated with each local anomaly state, the distributed processing nodes that each current processing link passes through are determined and a shared processing dependency is formed. Then, based on the shared processing dependency, each local anomaly state is synchronously collected to form a set of synchronous anomalies corresponding to the shared processing dependency.

[0043] Shared processing dependencies are relational objects used to maintain the relationship between shared distributed processing nodes and their corresponding processing locations among multiple current processing links.

[0044] The synchronization anomaly set is a phased set formed by aggregating multiple local anomaly states with corresponding synchronization anomaly relationships under the shared processing dependency constraints. The synchronization anomaly set maintains its correspondence with the shared processing dependency, and each local anomaly state continues to retain its respective vehicle anomaly detection task identity and current processing link identity.

[0045] Figure 1 S102 in the process takes over the local abnormal states formed in S101, and forms a shared processing dependency and synchronization abnormal set by the current processing links associated with each local abnormal state. The synchronization abnormal set then enters S103, which is used to form common abnormal characteristics and abnormal propagation relationships.

[0046] S103 determines the starting point of anomaly propagation and forms anomaly propagation relationship. In S103, common anomaly characteristics are determined from the set of synchronous anomalies. The starting point of anomaly propagation is determined based on the existence and state changes of the common anomaly characteristics in each current processing link of the shared processing dependency association. An anomaly propagation relationship is formed by the common anomaly characteristics and the starting point of anomaly propagation.

[0047] Common anomaly features are anomaly features used to represent the correspondence between multiple local anomaly states participating in the current common anomaly analysis.

[0048] The existence state is a state information used to characterize whether common abnormal features have corresponding abnormal manifestations in the data at the corresponding processing position of the current processing link.

[0049] The origin of anomaly propagation is the location where a common anomaly is formed, determined by the changes in the state of common anomaly characteristics in a shared processing relationship.

[0050] Anomaly propagation relationships are formed by common anomaly features and anomaly propagation starting points, and maintain the propagation association between common anomaly features, anomaly propagation starting points, corresponding local anomaly states, and corresponding vehicle anomaly detection tasks.

[0051] Figure 1 S103 inherits the set of synchronous anomalies formed in S102 and forms an anomaly propagation relationship for subsequent processing. The anomaly propagation relationship enters S104 for re-attribution of anomaly changes in each local anomaly state, and continues into S105 to determine the corresponding vehicle anomaly detection task and its re-inspection processing relationship.

[0052] S104 forms common cause abnormal components and vehicle residual abnormal states. In S104, based on the abnormal propagation relationship, common cause abnormal components are determined from each local abnormal state associated with the abnormal propagation relationship, and the abnormal changes in each local abnormal state that are not attributed to the corresponding common cause abnormal components form the corresponding vehicle residual abnormal states.

[0053] Common-cause anomaly components are anomalous changes determined from the corresponding local anomalous state and explained by the anomalous propagation relationship under the current anomalous propagation relationship constraints.

[0054] The vehicle residual abnormal state is formed by abnormal changes in the corresponding local abnormal state that are not classified into the corresponding common cause abnormal component, and it maintains a phased state that is associated with the original local abnormal state and the corresponding vehicle abnormality detection task.

[0055] Each vehicle anomaly detection task generates a common-cause anomaly component and a residual vehicle anomaly state corresponding to its own local anomaly state. Figure 1S104 consumes the abnormal propagation relationship formed by S103, and continues to provide the common cause abnormal component and vehicle residual abnormal state to S105 for verification processing.

[0056] S105 adjusts the output state of the anomaly detection result and forms the vehicle anomaly confirmation result. In S105, based on the anomaly propagation relationship and each common cause anomaly component, the output state of the anomaly detection result formed by the corresponding vehicle anomaly detection task through the current processing link is adjusted. The alternative processing link is re-examined for each vehicle anomaly detection task. Based on the re-examination result, the common cause anomaly component and the corresponding vehicle residual anomaly state are reviewed respectively. The output state of the corresponding anomaly detection result is updated and the vehicle anomaly confirmation result is formed.

[0057] The anomaly detection result output status is the output control status associated with the anomaly detection result formed by the vehicle anomaly detection task through the current processing link, and is used to characterize the output eligibility of the anomaly detection result in the current processing stage.

[0058] The restricted output state is a processing state among the output states of anomaly detection results. The anomaly detection result enters the subsequent review and processing path under this state.

[0059] The alternative processing link is a processing link used to perform alternative data processing on vehicle anomaly detection tasks associated with anomaly propagation relationships and generate corresponding detection results.

[0060] The alternative detection result is the result generated after the corresponding vehicle anomaly detection task is re-inspected through the alternative processing link.

[0061] The re-inspection result is formed after the corresponding vehicle anomaly detection task is re-inspected through the alternative processing link, and is used to verify the common cause anomaly components and the vehicle's residual anomaly state; in this embodiment, the re-inspection result is carried by the corresponding alternative detection result.

[0062] The vehicle anomaly confirmation result is formed based on the common cause anomaly components and the vehicle's residual anomaly state after re-inspection, and is associated with the corresponding vehicle anomaly detection task as the vehicle's own anomaly confirmation output.

[0063] Figure 1 S105 in the process receives the anomaly propagation relationship, common-cause anomaly components, and residual vehicle anomaly status. After the anomaly detection result output status adjustment and replacement processing link is reviewed, the corresponding anomaly attribution is verified, and a vehicle anomaly confirmation result is generated. For residual vehicle anomaly statuses that retain their own anomaly content after verification, the vehicle anomaly confirmation result records the corresponding vehicle anomaly. For cases where the residual vehicle anomaly status is empty after verification, the vehicle anomaly confirmation result records the vehicle's own anomaly confirmation status for the corresponding vehicle anomaly detection task.

[0064] In a distributed vehicle-to-everything (V2X) environment, the data processing of the same vehicle anomaly detection task typically involves continuous processing through the vehicle-side processing unit, edge processing unit, and platform-side processing service. Task scheduling, service instance switching, message distribution, and data routing relationships create corresponding data processing paths for different task execution processes. Anomaly detection results primarily reflect the anomaly judgments formed by vehicle operation data during the detection phase. Subsequent anomaly source analysis requires obtaining the actual distributed processing process experienced by the anomaly-related source data and ensuring that the anomaly content corresponds to the processing process. Based on this processing relationship, this embodiment obtains the current processing link in the execution process of anomaly-related tasks and associates anomaly changes, anomaly timing information, and anomaly change characteristics with the current processing link to form a local anomaly state.

[0065] Specifically, the formation of the current processing link and local abnormal state includes:

[0066] As vehicle operation data passes through each distributed processing node in sequence, each distributed processing node receives node input data, processes the node input data, and forms node output data.

[0067] According to the data processing order of vehicle operation data and the data transmission relationship between the node output data of each distributed processing node and the node input data of the subsequent distributed processing nodes, the distributed processing nodes through which the vehicle operation data passes in sequence are associated to form the current processing link.

[0068] Anomaly detection is performed on vehicle operation data, and based on the anomaly detection results, the abnormal time sequence information corresponding to the abnormal changes is determined. The abnormal change features corresponding to the abnormal time sequence information are then extracted from the vehicle operation data.

[0069] The abnormal changes, abnormal timing information, and the characteristics of the abnormal changes are associated with the current processing link corresponding to the vehicle operation data to form a local abnormal state.

[0070] The following section further explains the data processing relationships of distributed processing nodes, the relationship between vehicle operation data and task identity, the formation of the current processing link, and the formation of local abnormal states.

[0071] Distributed processing nodes are processing units that undertake specific data processing functions in the distributed data processing process of vehicle-to-everything (V2X) networks. When vehicle operation data enters the corresponding distributed processing node, it forms the node's input data; the distributed processing node processes the node input data according to its own processing functions and forms the node output data; the node output data continues to participate in the subsequent data processing of the corresponding vehicle anomaly detection task.

[0072] In one implementation, the distributed processing nodes are implemented using vehicle-side computing units, edge processing units, platform service instances, containerized processing services, or logical processing units. Each distributed processing node maintains its corresponding node identity in the task execution record, enabling the node input data, node output data, and node processing procedures to establish a correspondence based on the node identity.

[0073] For scenarios where the same logical processing function has multiple running instances, the granularity of node identity is determined based on the processing level of the anomaly source analysis. When dealing with a specific running instance, the node identity is represented by the service instance identifier; when dealing with logical processing functions, the node identity is represented by the logical service identifier; when dealing with differences in processing versions, software version or model version information is further associated on top of the logical service identifier. A unified node identity granularity is used for the same anomaly source processing, enabling a consistent basis for identity comparison among processing nodes in different vehicle anomaly detection tasks.

[0074] During the processing of vehicle operation data by distributed processing nodes, each node processing record is associated with at least the vehicle anomaly detection task identity, task execution identity, source data identity, node identity, and node processing time. Node input data and node output data are linked to corresponding processing records along these identity relationships, ensuring that the input, processing, and output of a particular node during a specific vehicle anomaly detection task execution have a defined data attribution.

[0075] For distributed processing scenarios that use asynchronous message passing, the node processing record further maintains the message identity or message association information corresponding to the source data identity, thereby connecting the upstream node output record and the subsequent node input record to the same vehicle anomaly detection task execution process.

[0076] Vehicle operation data originates from vehicle-side data generated during vehicle operation and data processed by the vehicle-to-everything (V2X) system before being entered into the corresponding vehicle anomaly detection task. The vehicle operation data is determined based on the processing object of the vehicle anomaly detection task and includes vehicle bus data, vehicle sensor operation data, status monitoring data, and existing processed data from the platform side.

[0077] When vehicle operation data enters the vehicle anomaly detection task, a correspondence is established between the vehicle identity, the vehicle anomaly detection task identity, the task execution identity, and the source data identity. The vehicle anomaly detection task identity is used to distinguish different anomaly detection processing tasks; the task execution identity is used to distinguish different execution processes of the same anomaly detection task; and the source data identity is used to maintain data continuity when vehicle operation data flows between multiple distributed processing nodes.

[0078] In one implementation, vehicle identity is represented by a vehicle identifier, vehicle anomaly detection task identity is represented by a task identifier, task execution identity is represented by the current task execution identifier, and source data identity is represented by a source data sequence identifier. When source data is collected continuously over time, the source data sequence identifier is further associated with the data sampling time or data frame number.

[0079] When a single vehicle carries multiple vehicle anomaly detection tasks, each anomaly detection task maintains its corresponding task identifier and task execution record. When multiple vehicles execute the same type of vehicle anomaly detection task, each task maintains an independent data processing relationship through vehicle identity and task execution identity. After this processing, subsequent anomaly changes, anomaly timing information, anomaly change characteristics, and the current processing chain can all be traced back to the corresponding vehicle operation data along the task identity and source data identity.

[0080] Vehicle-side data is accessed via the vehicle bus interface, CAN, CAN FD, in-vehicle Ethernet, or vehicle data service interface; edge and platform-side data flows according to the existing message or service interfaces of the vehicle networking system. Each data access method can proceed to subsequent processing as long as it maintains the aforementioned task identity and source data identity.

[0081] During the execution of the vehicle anomaly detection task, vehicle operation data flows between multiple distributed processing nodes according to the task data processing relationship. Each node processing generates a corresponding node processing record, which is associated with the vehicle anomaly detection task identity, task execution identity, source data identity, node identity, node processing time, and data transmission information corresponding to the preceding and following nodes.

[0082] After an abnormal change occurs, the relevant source data range is determined based on the abnormal timing information corresponding to the abnormal change. Then, the task execution identity and source data identity corresponding to the source data range are used to read the node processing records. This allows us to obtain the distributed processing nodes that the corresponding vehicle operation data actually passed through during the execution of this task, as well as the pre- and post-processing relationships between each node, forming the current processing chain corresponding to the abnormal change.

[0083] The current processing link described here uses the actual task execution records of anomaly-related source data as the link source. For different execution processes of the same vehicle anomaly detection task, each task execution forms a corresponding current processing link; for execution processes where service scheduling causes changes in the running instance, the current processing link is recorded according to the node instance or corresponding logical node identity actually called in this task execution.

[0084] In one implementation, the current processing chain is formed by a distributed call chain record. After an upstream node completes processing, it associates the task execution identity and source data identity with the node's output record; when subsequent nodes receive corresponding data, they associate the same identity information with the node's input record; the processing order between nodes is established based on the node's processing time and the correspondence between preceding and subsequent data. When the task execution log, message chain record, or processing snapshot uses the same identity association method, the actual processing chain corresponding to the source data related to the occurrence of the anomaly is also formed.

[0085] In scenarios where processing branches arise during task execution, when source data forms multiple subsequent data streams at the preceding distributed processing node, each subsequent branch maintains its corresponding source data identity and branch processing record. When a vehicle anomaly detection result corresponds to one of the data transmission paths, the corresponding current processing link is formed along the processing record that has a data correspondence with that anomaly detection result. When multiple processing branches converge at subsequent nodes, the corresponding data source is restored by associating the identity of the input data at the converging node with the output data of each preceding node.

[0086] For repeated node calls caused by message resending or task retrying, the task execution record, combined with the call time, source data identity, and subsequent data records actually received by the node, determines the node call that participated in the formation of the anomaly detection result, so that the current processing link remains consistent with the data processing process that actually participated in the formation of the anomaly.

[0087] like Figure 2 As shown, vehicle anomaly detection task ① and vehicle anomaly detection task ② each have their own corresponding current processing link. The two links use different numbers of nodes and processing position relationships to represent the data processing paths formed by different vehicle anomaly detection tasks according to their respective actual task execution processes. The link structure in the figure corresponds to the actual node processing order and data transmission relationship in the task execution record.

[0088] For the same vehicle anomaly detection task, distributed processing nodes are associated along the data processing direction of the vehicle operation data based on the source data identity and task execution identity. The output data of the previous distributed processing node enters the corresponding distributed processing node to form the corresponding node input data, and the processing connection between adjacent nodes is established through the data correspondence between the two.

[0089] The current processing chain consists of distributed processing nodes and the data transmission relationships between them. The order of the nodes in the chain comes from the actual processing order of the vehicle operation data, and the node connections come from the data continuation relationship between the output data of a node and the input data of subsequent nodes.

[0090] When the output data of one distributed processing node directly enters the next, a data succession relationship is established through the source data identity, task execution identity, and processing sequence. When there is protocol parsing, field conversion, data encapsulation, or feature processing between nodes, the correspondence between the data before and after processing is maintained through data association identifiers or conversion records. Thus, even when the data representation changes, the current processing chain still maintains a complete data source relationship.

[0091] In one implementation, each node's processing record stores the identifier of the predecessor processing record and the identifier of the current processing record. Subsequent nodes read the corresponding predecessor processing record identifier and then establish a connection between the two processing nodes. For message middleware-driven processing, the input-output relationship between adjacent nodes is maintained using message identifiers and consumption records. For platform-internal synchronous service call processes, the processing relationship between preceding and following nodes is maintained using call chain identifiers.

[0092] The node input and output data corresponding to the anomaly timing information are saved along with the current processing chain. The saved objects at least cover the data fragments formed by the anomaly-related source data on the input and output sides of each distributed processing node, and retain the corresponding vehicle anomaly detection task identity, source data identity, node identity, and processing time. After this processing, when reading a distributed processing node along the current processing chain, the node input and output data corresponding to the anomaly change can be obtained.

[0093] The node input and output data retained here belong to the node-level data foundation of the current processing chain. Subsequent common anomaly feature tracing along the source of the processing chain directly uses the node-level data.

[0094] Vehicle operation data is processed by the corresponding vehicle anomaly detection task to generate anomaly detection results. The anomaly detection results maintain a correspondence with the vehicle anomaly detection task identity, task execution identity, and source data identity.

[0095] Anomalies are identified from vehicle operation data based on anomaly detection results and represent abnormal deviations in vehicle operation data within a relevant time frame. Anomalies are the actual data changes to be processed, retaining either the vehicle operation data content corresponding to the time the anomaly occurred or establishing a data association with that content.

[0096] The abnormal timing information is formed by the time location, time range, and duration of the abnormal change. In one embodiment, when the vehicle operation data meets the corresponding abnormality judgment conditions, the starting position of the abnormality and the data range continuously corresponding to the abnormality are recorded, and the abnormal timing information is formed by the position and data range.

[0097] Anomaly change features are extracted from the vehicle operation data range corresponding to the anomaly time series information, and are used to describe the technical manifestation of the anomaly changes in a unified data representation. A source correspondence is maintained between the anomaly change features and the anomaly changes themselves; that is, each anomaly change feature is associated with its source anomaly change and its corresponding anomaly time series information.

[0098] For numerical vehicle operation data, abnormal changes are manifested as changes in the corresponding data relative to the reference state, and the abnormal change feature records the changes in the corresponding indicators; for state-based vehicle operation data, abnormal changes are manifested as state transitions, and the abnormal change feature records the corresponding state transition content; for data formed through feature processing, the abnormal change feature records the corresponding feature components and their changes.

[0099] In one implementation, the anomaly detection process uses preset normal ranges, historical statistical states, rule-based detection conditions, or a trained anomaly detection model to generate anomaly detection results. The anomaly detection process used here performs anomaly identification, and the resulting anomaly detection results further transmit task identity and source data identity to anomaly changes, anomaly time-series information, and anomaly change features.

[0100] The roles of anomalous changes and anomalous change features in data processing are clearly defined: anomalous changes represent the identified anomalous changes in vehicle operation data, while anomalous change features represent the characteristic descriptions extracted from the data corresponding to the anomalous changes and used for subsequent comparison of anomalous content. When a local anomalous state subsequently forms, both are simultaneously associated with the current processing link.

[0101] The abnormal changes, abnormal timing information, and abnormal change characteristics are associated with the current processing link of the corresponding vehicle operation data to form a local abnormal state.

[0102] The association uses the vehicle anomaly detection task identity, task execution identity, and source data identity as the task-level connection basis, so that the data content, anomaly timing information, and anomaly change characteristics corresponding to the anomaly change are kept in the same source and correspond to the actual processing chain that generated the anomaly change.

[0103] In one implementation, local abnormal states are stored using structured state records, the associated content of which includes at least the abnormal change, abnormal timing information, abnormal change characteristics, vehicle abnormality detection task identity, task execution identity, source data identity, and current processing link identity. The current processing link identity further points to the corresponding node processing record, as well as the node input data and node output data corresponding to the abnormal timing information.

[0104] Therefore, when reading a local anomaly state, two sets of subsequent processing information can be obtained along that local anomaly state: one set is the anomaly change and its anomaly timing information and anomaly change characteristics, used to describe the anomaly content; the other set is the corresponding current processing link and its node processing records, used to describe the actual data processing process that the anomaly content underwent when it was formed. The two sets of information are kept consistent through the identity of the same vehicle anomaly detection task, the task execution identity, and the source data identity.

[0105] like Figure 2 As shown, vehicle anomaly detection task ① and vehicle anomaly detection task ② each form a corresponding local anomaly state along their respective current processing links. The two local anomaly states in the figure are represented by the same type of state graph, which indicates that they have the same stage-specific technical identity, and each maintains independent data ownership through its corresponding vehicle anomaly detection task and current processing link.

[0106] Figure 2 The two current processing links have different numbers of nodes and node processing position relationships. This graphical relationship corresponds to the structural differences between the actual execution paths of different vehicle anomaly detection tasks. When a local anomaly state is formed, its respective processing path identity is preserved, so that subsequent processing can directly read its corresponding current processing link based on the local anomaly state and continue to analyze the processing source relationship between multiple local anomaly states.

[0107] In this embodiment, after a local abnormal state is formed, the abnormal changes, abnormal timing information, abnormal change characteristics, vehicle abnormal detection task identity, source data identity, and the actual current processing link form a continuous data association relationship. Subsequent processing obtains the corresponding abnormal content and distributed processing path along the association relationship.

[0108] Once multiple local anomaly states are formed, each local anomaly state possesses its own anomaly content, anomaly temporal identity, and the actual current processing link. The anomaly occurrence sequence is used to characterize the temporal correlation between multiple vehicle anomaly detection tasks, while the current processing link is used to characterize the distributed processing relationship actually experienced by each vehicle's operational data. Based on these two types of information, this embodiment first forms a shared processing dependency from the current processing link, and then synchronously aggregates the local anomaly states with this shared processing dependency at the anomaly initiation time, so that the local anomaly states entering the same common anomaly source analysis simultaneously have a shared processing structure foundation and a time synchronization foundation.

[0109] Specifically, the formation of the shared processing dependencies and synchronization exception set includes:

[0110] By comparing the current processing links associated with each local abnormal state, the distributed processing nodes that each current processing link passes through and the processing positions of the distributed processing nodes in each current processing link are determined, and a shared processing dependency is formed based on the distributed processing nodes and their processing positions.

[0111] For each of the aforementioned local abnormal states, abnormal timing information is determined based on the abnormal changes in the local abnormal state, and the abnormal start time is determined from the abnormal timing information.

[0112] The local abnormal states that start at the same preset synchronization time window and correspond to the current processing link containing each distributed processing node in the shared processing dependency are synchronously collected to form a synchronization abnormal set corresponding to the shared processing dependency.

[0113] The following combination Figure 2 The formation process of shared processing dependencies and synchronization exception sets is further explained.

[0114] For at least two local abnormal states to be compared, the current processing link associated with each local abnormal state is read, and the identity of the distributed processing nodes in each current processing link is compared according to the node identity granularity used when forming the current processing link.

[0115] When multiple distributed processing nodes in the current processing chain have the same node identity, they are identified as distributed processing nodes that are commonly traversed by the corresponding current processing chain. When processing using service instance identity, the common node relationship is established between the same service instance; when processing using logical service identity, the common node relationship is established between the same logical processing function; when node identity is associated with software version, model version, or processing configuration, the common node relationship continues to maintain the corresponding version and processing configuration information.

[0116] Each shared distributed processing node maintains its processing position in each current processing link. The processing position is determined according to the data processing order of the current processing link and is used to characterize the relative position of the shared distributed processing node in the actual processing path of the corresponding vehicle anomaly detection task.

[0117] By associating common distributed processing nodes, the processing positions of each common distributed processing node in each current processing link participating in the current comparison, and the corresponding vehicle anomaly detection task identity, a shared processing dependency is formed. Thus, a shared processing dependency simultaneously maintains the common node identity and the common node's positional relationship in each vehicle anomaly detection task's current processing link.

[0118] When a shared processing dependency includes a common distributed processing node, the common distributed processing node and its processing position in each current processing link constitute the corresponding shared processing relationship.

[0119] When shared processing involves multiple shared distributed processing nodes, the relative processing order among these nodes is further determined based on their processing positions within each current processing link. Taking shared node A and shared node B as an example, if shared node A is upstream of shared node B in all current processing links involved in the current analysis, then shared node A and shared node B are arranged in the A-to-B processing direction. The remaining shared nodes form a consistent shared node processing sequence across the current processing links in the same manner.

[0120] When common nodes in the current processing chain exhibit multiple relative position combinations, corresponding shared processing sub-relationships are formed according to a consistent relative processing order. Each shared processing sub-relationship maintains a definite processing direction for common nodes and then proceeds to the subsequent tracing of common anomaly sources. Thus, when tracing common anomaly features along shared processing dependencies at the node level, there is a clear upstream-to-downstream processing order.

[0121] like Figure 2 As shown, vehicle anomaly detection task ① and vehicle anomaly detection task ② correspond to their respective current processing chains. Each current processing chain has its own number of nodes and node processing positions, with some distributed processing nodes sharing a common processing identity. The cross-chain node correspondence in the diagram represents the shared processing identity and its shared processing dependencies. Vehicle operation data is still processed along the current processing chain corresponding to each vehicle anomaly detection task.

[0122] Figure 2 The positional relationship of common nodes on the two current processing chains originates from the actual task execution records of each vehicle anomaly detection task. Shared processing dependencies are formed by these common nodes and their processing positions, and serve as the structural basis for subsequent synchronous anomaly set formation and common anomaly propagation source tracing.

[0123] Each local anomaly state retains its anomaly changes and their anomaly timing identity. When multiple vehicle anomaly detection tasks run at the vehicle end, edge end, and platform end, the time records generated by each processing end correspond according to a unified time benchmark, so that the anomaly start position of each local anomaly state is at the same time scale.

[0124] In one implementation, the unified reception time of the vehicle-to-everything (V2X) platform is used as the time base to convert abnormal timing information generated at the vehicle and edge terminals to the platform time. In deployment scenarios using a unified system clock, the time base is directly formed based on the synchronized task processing time. When the device side has a fixed clock offset, time correction is performed on the abnormal timing information according to the clock offset.

[0125] For each local abnormal state, the abnormal changes and their associated time positions are read, and the abnormal timing information is determined based on the time range of the abnormal changes. If the corresponding abnormal timing information for a local abnormal state has already been saved, the abnormal timing information is obtained directly along the correlation between the abnormal changes and the abnormal timing information.

[0126] The anomaly start time is taken from the time position in the anomaly time sequence information where the corresponding anomaly change begins to take effect, and then converted to the above-mentioned unified time reference.

[0127] The preset synchronization time window is used to limit the time range within which multiple local abnormal states enter the same synchronization aggregation. The width of the preset synchronization time window is set based on the vehicle operation data sampling cycle, the vehicle anomaly detection task refresh cycle, and the normal processing delay of the corresponding distributed processing chain.

[0128] In one implementation, local abnormal states with the same shared processing dependency are sorted according to their abnormal start time. The earliest abnormal start time is used as the starting position of the current synchronization window, and a corresponding time range is formed according to a preset synchronization time window width. Local abnormal states within the time range form the current time synchronization group. Equivalently, for abnormal start times to be assigned to the same time synchronization group, the earliest and latest time positions are taken. If the time interval between the two falls within the preset synchronization time window width, the corresponding local abnormal state is assigned to the same time synchronization group.

[0129] Subsequently, the current processing links associated with each local abnormal state are read, and the coverage relationship between the corresponding current processing link and the current shared processing dependency is determined. When the abnormal start time corresponding to a local abnormal state belongs to the same preset synchronization time window, and its current processing link includes each distributed processing node in the current shared processing dependency, the local abnormal state is synchronously aggregated into the synchronization abnormal set corresponding to the shared processing dependency.

[0130] like Figure 2 As shown, vehicle anomaly detection task ① and vehicle anomaly detection task ② each form a corresponding local anomaly state, and each local anomaly state has its own anomaly start time. The two anomaly start times in the figure are located at different time positions on a unified time base and fall within the same preset synchronization time window; simultaneously, both current processing chains have the shared processing dependency shown in the figure. Based on the aforementioned structural and temporal relationships, the two local anomaly states enter the same synchronized anomaly set.

[0131] Once the synchronized anomaly set is formed, each local anomaly state retains its original vehicle anomaly detection task identity, task execution identity, source data identity, anomaly timing identity, and current processing link identity. The synchronized aggregation establishes a common source analysis scope; the local anomaly states within the set still correspond to their respective vehicle operation data and task execution processes.

[0132] Figure 2 The set of synchronous anomalies is used as the endpoint for graph processing. The anomaly content and common anomaly features in the set of synchronous anomalies, along with the formation location of shared processing dependencies, are further determined through subsequent processing.

[0133] Once the set of synchronized anomalies is determined, the analysis of common anomaly sources now has clearly defined participants and a shared processing structure. Next, anomaly changes with the same technical semantics are identified from the set of synchronized anomalies, and the resulting common anomaly features are projected along the shared processing dependencies to the node input and output data, thereby determining the formation location of the common anomaly features in the distributed processing chain.

[0134] Furthermore, the determination of the common abnormal features and the origin of abnormal propagation includes:

[0135] For each local abnormal state in the synchronization abnormal set, abnormal change features are extracted from the abnormal changes in each local abnormal state. The feature dimensions and change directions of each abnormal change feature are compared to determine the abnormal changes that are in the same feature dimension and have the same change direction. The feature dimensions and change directions of the abnormal changes form a common abnormal feature.

[0136] Along the data processing order of each current processing link associated with the shared processing dependency, feature changes in the feature dimension corresponding to the common anomaly feature are extracted from the node input data and node output data of each distributed processing node in the shared processing dependency. The direction of change of the feature changes is compared with the direction of change of the common anomaly feature, and the existence state of the common anomaly feature in the node input data and node output data is determined according to the comparison result.

[0137] Based on the aforementioned existence state, the distributed processing node that first satisfies the common anomaly feature existence state of 0 in the node input data and the common anomaly feature existence state of 1 in the node output data along the data processing order in the shared processing dependency is determined as the anomaly propagation starting point.

[0138] The following section further explains the formation of common anomaly features, node-level reference states, cross-node feature semantics, existence states, and anomaly propagation starting points.

[0139] For each local abnormal state in the synchronous abnormal set, the corresponding abnormal changes and abnormal change features are read. When abnormal change features have been saved in the local abnormal state, the corresponding features are obtained along the correspondence between the abnormal changes and the abnormal change features. When the abnormal change features are extracted in real time from the data range corresponding to the abnormal changes, the corresponding vehicle operation data is read along the previously established vehicle abnormality detection task identity, task execution identity, and source data identity, and abnormal change features are formed according to the same feature extraction method.

[0140] Feature dimensions are used to represent the specific technical semantics corresponding to abnormal changes. These feature dimensions are represented by monitoring indicator identities, signal channel identities, parameter category identities, state variable identities, or feature component identities formed through feature processing. Feature dimensions participating in the comparison of common anomalies adopt a unified technical semantics.

[0141] The direction of change is used to represent the trend of abnormal changes relative to the reference state of the corresponding vehicle anomaly detection task. Continuous numerical features determine the direction of change according to the direction of increase or decrease relative to the reference state; discrete state features determine the direction of change according to the state transition relationship; feature components formed after feature processing determine the direction of change according to the trend of change of the corresponding feature component relative to the reference state.

[0142] When performing comparisons across vehicle anomaly detection tasks, each task determines the direction of anomaly change based on its corresponding reference state and maps this direction to common feature semantics. For example, if vehicle anomaly detection task ① and vehicle anomaly detection task ② have their own operating benchmarks for the same monitoring indicator, they determine the direction of change of that indicator relative to their respective operating benchmarks and then match the two directions. Thus, the formation of common anomaly features is based on the relationship of change and technical semantics, while the absolute value of each vehicle's operating data remains within its corresponding vehicle anomaly detection task.

[0143] The abnormal change features in the synchronous anomaly set are matched according to feature dimension and change direction. Abnormal changes with the same feature dimension and the same change direction form a common anomaly pattern, and the corresponding feature dimension and change direction form a common anomaly feature.

[0144] Each common anomaly feature is simultaneously associated with the local anomaly states that participate in the formation of that common anomaly feature. The participating local anomaly states serve as the task scope for subsequent propagation and tracking of the current common anomaly feature. When multiple common anomaly patterns exist in a synchronous anomaly set, participating local anomaly state groups are established according to the common anomaly features, and each common anomaly feature performs node input and node output state tracking along the current processing chain of the corresponding vehicle anomaly detection task.

[0145] Through the above processing, the common anomaly feature has three corresponding technical identities: common feature dimension, common direction of change, and the local anomaly state group participating in the analysis of the common anomaly feature. The number of vehicle anomaly detection tasks in the subsequent shared anomaly cross-section forming amount is based on the participating local anomaly state group associated with the current common anomaly feature.

[0146] When tracing the source of common anomalies along shared processing dependencies, it is necessary to determine the changes in the corresponding feature dimensions on the input and output sides of each shared distributed processing node.

[0147] For each vehicle anomaly detection task associated with the current common anomaly features, data fragments related to the current anomaly are obtained from the node input data and node output data that are saved along with the current processing link, based on the vehicle anomaly detection task identity, task execution identity, source data identity, and anomaly timing information.

[0148] For each shared distributed processing node, an input-side reference feature state corresponding to a common anomaly feature is established within its node input data representation space, and a corresponding output-side reference feature state is established within its node output data representation space. The input-side and output-side reference feature states adopt the same data representation format as the node input and output data, respectively.

[0149] In one implementation, data with the same task, node processing location, and feature dimensions are obtained from the stable runtime phase before the anomaly occurs in the corresponding vehicle anomaly detection task, forming a reference feature state for the corresponding node. The data in the stable runtime phase is processed according to the same node processing configuration and feature expression method as the anomaly-related data, so that the reference feature state has consistent data semantics with the current node input data or node output data.

[0150] When the basic anomaly detection process has maintained a normal reference state and its node-side feature representation, the corresponding reference feature state is obtained by associating the vehicle anomaly detection task identity and feature dimension.

[0151] For nodes that have undergone protocol parsing, unit conversion, feature construction, or model processing, the input-side reference feature state and the output-side reference feature state are formed according to the data transformation relationship of the corresponding nodes. In this way, the node input side and the node output side determine the feature changes within their own data representation space, and then compare the corresponding change directions based on the unified technical semantics.

[0152] The distributed processing nodes in the shared processing dependency have different data processing functions. The same vehicle operation information is presented as raw fields, parsed fields, standardized parameters, derived features, or model feature components after passing through each node. In order to track common abnormal features along the current processing chain, semantic relationships of corresponding feature dimensions are established between each distributed processing node.

[0153] The semantic relationships are established based on field identity, feature number, input / output data pattern, unit and dimension conversion relationship, node data conversion record and feature construction relationship.

[0154] For nodes where fields are directly passed, the node input fields and node output fields are associated with the same feature dimension; for nodes where field names, encoding methods, or units are converted, the field correspondence and unit conversion relationship before and after the conversion are recorded according to the node processing configuration; for nodes where derived features are formed from input fields, the relevant input fields and derived feature identities are associated with the corresponding technical feature dimensions according to the feature construction relationship.

[0155] When multiple input fields together form an output feature component, the semantic correspondence between the set of input fields and the output feature component is determined according to the feature construction relationship recorded by the node; when an input field is processed to form multiple output feature components, a correspondence is established according to the processing definition of each output feature component.

[0156] When common anomaly features propagate along the current processing chain, the target data position in the node input data and node output data of each shared distributed processing node is determined based on the above semantic relationship, and the node-side feature changes are mapped to the unified feature dimension of the common anomaly features.

[0157] All feature dimensions involved in propagation tracing have clear semantic correspondences between node inputs and outputs. Therefore, when the data performance of the original fields, standardized parameters, and derived features changes, common anomalous features are still continuously traced along the current processing chain according to the same technical meaning.

[0158] For each vehicle anomaly detection task associated with the current common anomaly features, the node input data and node output data corresponding to each shared distributed processing node are read according to the node processing order in the shared processing dependency.

[0159] The node input data and node output data are established to correspond to each other through the vehicle anomaly detection task identity, task execution identity, source data identity, node processing location, and anomaly timing information, so that the input side state and the output side state originate from the same vehicle anomaly detection task, the same anomaly-related source data range, and the same shared processing node call process.

[0160] On the unified feature dimension corresponding to the common abnormal features, the changes in the feature changes on the node input side and the node output side relative to their respective reference feature states are determined, and the corresponding change directions are compared with the change directions of the common abnormal features.

[0161] When the feature changes in the target data reach the corresponding anomaly judgment condition, and the direction of change is consistent with the direction of change of the common anomaly feature, the existence state of the common anomaly feature in the target data is recorded as 1; other state combinations are encoded as 0.

[0162] The existence state is thus used to characterize whether the common anomaly features are valid in the data of the corresponding node. The field storage location serves to locate the target data, and the anomaly conditions and the direction of change jointly determine the corresponding existence state.

[0163] In one implementation, the existence state adopts the anomaly threshold and effective change conditions already used in the vehicle anomaly detection task. For vehicle operation data with continuous sampling characteristics, the state determination is further formed by combining the continuous sampling period; for filtered data, the state is formed by the corresponding filtered feature changes; for data with data quality identifiers, the existence state determination is performed according to the data segment corresponding to the effective quality state.

[0164] After the above processing, the i-th vehicle anomaly detection task forms an input-side existence state and an output-side existence state on the k-th shared distributed processing node. These states continue to maintain the correspondence with common anomaly features, the vehicle anomaly detection task's identity, and the processing position of the shared node.

[0165] The anomaly propagation origin is used to characterize the first shared distributed processing node whose current common anomaly characteristics change from input-side state 0 to output-side state 1 along the shared processing dependency.

[0166] In this embodiment, for the participating local abnormal state groups associated with the current common abnormal features, the shared abnormal cross-section shaping amount is used to uniformly judge the input-side and output-side state combinations of each shared distributed processing node.

[0167] Suppose that the current common anomaly feature is associated with n local anomaly states, and each of the n local anomaly states corresponds to a vehicle anomaly detection task participating in the current common anomaly propagation analysis. The k-th shared distributed processing node in the shared processing dependency has a corresponding processing position in the current processing chain of the i-th vehicle anomaly detection task.

[0168] The common anomaly feature of the i-th vehicle anomaly detection task at the input side of the k-th shared distributed processing node exists in the state denoted as follows: The common anomaly characteristics existing on the output side of this shared distributed processing node are denoted as: ,in: For the k-th shared distributed processing node, construct the shared abnormal cross-section shaping quantity: In the formula This represents the shared anomaly profile forming state corresponding to the current common anomaly feature of the k-th shared distributed processing node.

[0169] When the existence state of each vehicle anomaly detection task participating in the current common anomaly propagation analysis is 0 on the input side of the k-th shared distributed processing node, and the existence state of each task is 1 on the output side of the same shared distributed processing node, then... This state indicates that vehicles with the same common anomaly characteristics are all in state 0 before the anomaly detection tasks reach the shared distributed processing node, and then transition to state 1 after the corresponding data is processed by the shared distributed processing node.

[0170] The shared distributed processing nodes are calculated sequentially according to the aforementioned shared node processing order. The first one that satisfies the processing order The shared distributed processing node is determined as the starting point for anomaly propagation corresponding to the current common anomaly characteristics.

[0171] When subsequent shared nodes in the same shared processing dependency satisfy the condition again... At present, the common anomaly propagation analysis still uses the node at the beginning of the processing order as the starting point of anomaly propagation, and the state of subsequent nodes continues to serve as the data basis for the common anomaly propagation range analysis.

[0172] When a shared processing relation is divided into multiple shared processing sub-relationships with a consistent processing order, each shared processing sub-relationship forms a corresponding processing order according to the order of its internal nodes. Sequence. Each anomaly propagation origin maintains its association with the corresponding common anomaly features, participating local anomaly state groups, shared processing dependencies, and task-level processing positions in each vehicle anomaly detection task.

[0173] Therefore, the starting point of anomaly propagation not only has the identity of a shared logical node, but also remains at the corresponding processing position in the current processing chain of each vehicle anomaly detection task, providing a node-level positioning basis for subsequently establishing anomaly propagation relationships along common anomaly features.

[0174] When abnormal changes in a synchronous anomaly set have multiple feature dimensions or multiple change directions, common anomaly patterns are formed according to the feature dimensions and change directions, and corresponding local anomaly state groups are established for each. Each common anomaly pattern independently forms a common anomaly feature, and state tracking exists along the input and output sides of the corresponding shared processing dependency execution node.

[0175] When the common anomaly features are already in state 1 on the input side of the upstream shared node that the current shared processing depends on, the source tracing extends further upstream along the same vehicle anomaly detection task identity, source data identity, and feature semantics, and continues to read the corresponding node input data and node output data.

[0176] When no shared distributed processing node has been formed within the current shared processing range that transitions from node input state 0 to node output state 1, the corresponding existence state of each node and its association with common anomaly features are retained, and the shared processing range to be tracked is redefined based on the actual existence segment of the common anomaly features in each current processing link. When the common anomaly features are already in state 1 at the input side of the upstream shared node that the current shared processing depends on, the source location is extended upstream along the same vehicle anomaly detection task identity, source data identity, and feature semantics. When the task execution record currently saved by the system covers the predetermined upstream boundary, the currently obtained node state record is used as the processing record for this common anomaly source tracking.

[0177] When multiple shared processing sub-relationships with a consistent processing order form anomaly propagation starting points, each anomaly propagation starting point retains its corresponding shared processing dependency, common anomaly characteristics, and identity as a participating local anomaly state group. Subsequent anomaly propagation relationships are established according to the corresponding task-level data processing paths.

[0178] Once the anomaly propagation starting point is determined, the common anomaly features already have corresponding shared processing locations. In order to maintain the propagation range of the common anomaly features along the actual processing paths of each vehicle anomaly detection task, and to establish a unified data relationship for anomaly attribution, result output status adjustment, and subsequent re-inspection, this embodiment traces the common anomaly features downstream along each current processing chain starting from the anomaly propagation starting point, and establishes an association between the common anomaly features, the anomaly propagation starting point, continuous propagation nodes, corresponding local anomaly states, and vehicle anomaly detection tasks to form an anomaly propagation relationship.

[0179] Specifically, the formation of the abnormal propagation relationship includes:

[0180] Starting from the point of abnormal propagation, the existence status of the common abnormal features in the node output data of each distributed processing node is determined sequentially downstream along the data processing order of each current processing link that is associated with shared processing dependencies.

[0181] Based on the existence status, a distributed processing node with the common abnormal characteristics is determined to exist continuously downstream from the abnormal propagation starting point along the data processing order.

[0182] According to the data processing order of each current processing link, the common abnormal features, the abnormal propagation starting point, the distributed processing nodes that continuously contain the common abnormal features are associated with the corresponding local abnormal states and corresponding vehicle abnormal detection tasks in the synchronous abnormal set to form an abnormal propagation relationship.

[0183] The following explains the downstream propagation range of common anomaly features, the task-level formation of anomaly propagation relationships, and the anomaly reattribution under the constraints of anomaly propagation relationships.

[0184] For each vehicle anomaly detection task associated with the current common anomaly features, the starting position of the anomaly propagation origin corresponding to the current common anomaly feature is taken as the task-level processing position in the current processing chain of the vehicle anomaly detection task. The node output data of each downstream distributed processing node is obtained sequentially according to the data processing direction of the corresponding current processing chain.

[0185] The output data of each node continues to be mapped using the vehicle anomaly detection task identity, task execution identity, source data identity, node identity, and anomaly timing information. Based on the unified feature semantics established above, the feature dimension corresponding to the current common anomaly feature is obtained from the node output data, and the existence state of the common anomaly feature in the output data of each node is determined according to the established anomaly judgment conditions and change direction.

[0186] The node output side of the anomaly propagation starting point has already formed a state 1 of the current common anomaly characteristics. Therefore, the anomaly propagation starting point is taken as the first node of the current propagation node sequence. When traversing downstream along the current processing chain, if the node output side of adjacent distributed processing nodes continuously forms a state 1, then the corresponding distributed processing nodes are added to the propagation node sequence corresponding to the vehicle anomaly detection task in sequence.

[0187] When the output side of a downstream distributed processing node reaches state 0, its nearest upstream node in state 1 is taken as the end node of the current continuous propagation range. When a further downstream processing location re-reaches state 1, that processing location is registered as a new candidate location for anomaly formation, and node state records are maintained for both the current continuous propagation range and the aforementioned location.

[0188] In some implementations, for example, after the anomaly propagation starting point P, distributed processing nodes A, B, and C are connected sequentially according to the data processing order. The output sides of nodes P, A, and B all form a common anomaly feature existence state 1, while the output side of node C forms a state 0. Then P, A, and B constitute a continuous propagation node sequence of the current common anomaly feature in the vehicle anomaly detection task.

[0189] For the current processing chain with a branching structure, the actual data transmission relationship after the anomaly propagation starting point is used to enter the corresponding downstream branches. Each branch forms a propagation node sequence according to its own node processing order. When branches converge later, the correspondence between each propagation branch and the original task execution path is maintained through the source data identity, task execution identity, and the input source of the convergence node.

[0190] In some implementations, different vehicle anomaly detection tasks form a propagation node sequence along their respective current processing chains. The number, type, and propagation length of downstream nodes corresponding to vehicle anomaly detection task ① and vehicle anomaly detection task ② are formed according to their respective actual task execution paths, while common anomaly features and anomaly propagation starting points maintain the common source association between these task-level propagation node sequences.

[0191] When the abnormal propagation starting point is located at the end of the corresponding current processing chain, the abnormal propagation starting point is taken as the propagation node range corresponding to the vehicle abnormality detection task, and the abnormal propagation relationship formation process continues.

[0192] After completing the downstream propagation range tracking of each vehicle anomaly detection task, the common anomaly features, the anomaly propagation starting point, the propagation node sequence corresponding to each vehicle anomaly detection task, the corresponding local anomaly state in the synchronous anomaly set, and the corresponding vehicle anomaly detection task are associated to form an anomaly propagation relationship.

[0193] The abnormal propagation relationship maintains both the shared logical processing identity and the task-level execution identity.

[0194] The shared logic processing identity is used to represent the identity of the anomaly propagation starting point node common to multiple vehicle anomaly detection tasks. The task-level execution identity is used to represent the specific processing position of the shared logic node in the actual current processing chain of each vehicle anomaly detection task and the corresponding node invocation.

[0195] In some implementations, for example, a shared logical node P is determined as the starting point for the anomaly propagation of the current common anomaly feature. The corresponding processing position in vehicle anomaly detection task ① is denoted as P1, and the corresponding processing position in vehicle anomaly detection task ② is denoted as P2. The anomaly propagation relationship maintains the correspondence between logical nodes P and P1 and P2, where P1 is associated with the node input data, node output data, and processing time during the current execution of task ①, and P2 is associated with the node input data, node output data, and processing time during the current execution of task ②.

[0196] Each vehicle anomaly detection task forms a corresponding task-level relation item in the anomaly propagation relationship. The task-level relation item is associated with at least the vehicle anomaly detection task identity, the corresponding local anomaly state, the task-level anomaly propagation starting point processing position, and the propagation node sequence formed from that processing position.

[0197] For the current processing chain of a branch, the corresponding task-level relation item is further associated with the data transmission branch to which the propagation node sequence belongs, so that the order of propagation nodes is consistent with the actual processing path of vehicle operation data.

[0198] In one implementation, the anomaly propagation relationships are stored using structured relation records. These records include a common anomaly feature identifier, a shared anomaly propagation starting point identifier, a vehicle anomaly detection task identifier, a task execution identifier, a task-level propagation starting point processing location, a local anomaly state identifier, a source data identifier, and a propagation node sequence index. When a graph relational data structure is used, the aforementioned identity information forms the corresponding nodes and relation edges.

[0199] The subsequent re-inspection process reads the corresponding task-level propagation starting point processing position based on the vehicle anomaly detection task identity, and further locates the corresponding node input data from that position. In this way, the same shared logical anomaly propagation starting point always maintains its own task execution context in different vehicle anomaly detection tasks.

[0200] Once an anomaly propagation relationship is formed, information related to the common anomaly source is transmitted to subsequent processing through the anomaly propagation relationship.

[0201] When performing local anomaly reattribution, the current common anomaly features and the local anomaly states associated with the relationship are obtained from the anomaly propagation relationship; when performing anomaly detection result output status processing, the corresponding vehicle anomaly detection task is read according to the anomaly propagation relationship; when performing subsequent re-inspection, the corresponding task-level anomaly propagation start point processing position is read from the anomaly propagation relationship according to the vehicle anomaly detection task identity.

[0202] The anomaly propagation relationship thus organizes common anomaly characteristics, propagation locations, vehicle anomaly detection tasks, and local anomaly states into the same data relationship, enabling different processing stages to continue execution along the same task identity and anomaly identity.

[0203] like Figure 3 As shown in the figure, the "anomaly propagation relationship" represents the relational input of the local anomaly reattribution process. Common anomaly features and their associated corresponding local anomaly states are obtained from the anomaly propagation relationship.

[0204] Figure 3 Local abnormal states are represented using a state disk, where multiple abnormal elements represent various abnormal changes within that local abnormal state. The state disk corresponds to local abnormal states with associated abnormal propagation relationships, and the abnormal changes within it are stored according to the previously established abnormal change identities, abnormal timing information, and abnormal change characteristics.

[0205] After obtaining the common abnormal features and the corresponding local abnormal states, the feature dimensions of the common abnormal features are mapped to the abnormal change features within the local abnormal state, thereby determining the corresponding feature dimensions of the common abnormal features in the local abnormal state. Figure 3 The phrase "obtain common abnormal features and determine the corresponding feature dimensions" refers to the above reading and positioning process.

[0206] After completing the local feature dimension localization, the abnormal changes in the local abnormal state are compared item by item to form the common cause abnormal component and the vehicle residual abnormal state.

[0207] Once the anomaly propagation relationship is established, multiple anomalous changes within a local anomalous state each possess corresponding anomalous content and source attributes. To maintain the task-level distinction between shared processing source anomalies and vehicle-specific anomaly candidates, this embodiment performs re-attribution on the anomalous changes in each local anomalous state according to the anomaly propagation relationship.

[0208] Furthermore, the formation of the common-cause anomaly components and the vehicle residual anomaly state includes:

[0209] From the abnormal propagation relationship, obtain the common abnormal features and the corresponding local abnormal states, determine the feature dimension and change direction of the common abnormal features, and determine the corresponding feature dimension of the common abnormal features in each of the local abnormal states.

[0210] The change direction of the abnormal change in the corresponding feature dimension in each local abnormal state is compared with the change direction of the common abnormal feature to determine the abnormal changes with the same change direction in each local abnormal state, and the abnormal changes are respectively used to form common cause abnormal components associated with the corresponding local abnormal state.

[0211] After the common cause anomaly component is formed, the abnormal changes in each of the local anomaly states that are not attributed to the corresponding common cause anomaly component are used to form the vehicle residual anomaly state associated with the corresponding local anomaly state.

[0212] The following combination Figure 3 The reattribution process will be described below.

[0213] For each local abnormal state associated with the abnormal propagation relationship, read the common abnormal features in the current abnormal propagation relationship, and obtain the feature dimension and change direction of the common abnormal features.

[0214] The feature dimensions of common anomaly features adopt the unified feature semantic representation that has been established previously. For each local anomaly state, based on the anomaly change features stored therein, the unified feature dimensions of common anomaly features are mapped to the data representation used by the corresponding anomaly change, thereby determining the corresponding feature dimensions in the current local anomaly state.

[0215] For example, common anomaly features are identified using a unified feature identifier. This indicates the corresponding monitoring field in the local abnormal state of vehicle anomaly detection task ①. In the local abnormal state of vehicle anomaly detection task ②, the corresponding feature components Based on the semantic correspondence established above, then... and All are mapped to common feature identifiers Then, obtain the corresponding abnormal changes in the local abnormal states of Task ① and Task ② respectively.

[0216] For the current local anomaly state, read the anomaly changes item by item within the data range corresponding to its anomaly time sequence information. Anomaly changes that are in the feature dimension corresponding to common anomaly features are then compared in terms of change direction.

[0217] The direction of anomalous changes follows the directional semantics used when forming common anomalous features. Continuous numerical anomalous changes are represented by the direction of increase or decrease relative to the corresponding reference state; state-type anomalous changes are represented by the direction of corresponding state transition; feature components are represented by their direction of change relative to the reference feature state.

[0218] When the feature dimension of the abnormal change corresponds to the common abnormal feature, and the direction of the abnormal change is consistent with the direction of the common abnormal feature, the abnormal change is classified into the common cause abnormal component corresponding to the current local abnormal state.

[0219] Common-cause anomaly components are represented by sets of anomalies or structured records with propagation relationship identifiers. Each anomaly retains its original anomaly identity, anomaly time sequence identity, anomaly characteristics, vehicle anomaly detection task identity, and current anomaly propagation relationship identifier. The term "component" here reflects the source attribution of the anomaly, while the data content of each anomaly itself remains unchanged.

[0220] After attributing the common causes corresponding to the current anomaly propagation relationship, the remaining anomaly changes in the local anomaly state are organized according to the original task identity to form the vehicle residual anomaly state. The vehicle residual anomaly state continues to be associated with the original local anomaly state, the vehicle anomaly detection task, the source data identity, and the corresponding anomaly timing information.

[0221] Different vehicle anomaly detection tasks perform the above processing respectively. The local anomaly state of Task ① forms the common cause anomaly component and vehicle residual anomaly state corresponding to Task ①. Task ② forms the corresponding result according to its own local anomaly state. The tasks maintain a common source connection through anomaly propagation relationship, while retaining the data attribution of their respective anomaly changes.

[0222] When the same local abnormal state is associated with multiple abnormal propagation relationships, the corresponding common abnormal features are obtained according to each abnormal propagation relationship, and feature dimension positioning and change direction comparison are performed one by one.

[0223] When an anomalous change satisfies the attribution condition of an anomalous propagation relationship, the anomalous propagation relationship identifier is stored in the common cause anomalous component corresponding to the anomalous change. When the same anomalous change satisfies the attribution conditions of multiple anomalous propagation relationships simultaneously, multiple corresponding propagation relationship identifiers are associated in its anomalous change record, while maintaining a copy of the anomalous change ontology. After processing each anomalous propagation relationship associated with the current local anomalous state, the remaining anomalous changes form the corresponding vehicle residual anomalous state.

[0224] To represent the attribution state of abnormal changes under the above propagation constraints, let the unified feature dimension corresponding to the r-th abnormal change in the i-th local abnormal state be . The direction of change is The common anomalous features in the current anomalous propagation relationships correspond to a unified feature dimension of: The direction of change is .

[0225] When the i-th local anomaly state and its vehicle anomaly detection task are associated with the current anomaly propagation relationship, the propagation relationship constraint state is denoted as: The remaining states are denoted as .

[0226] Propagation constraint attribution label Represented as: In the formula This represents the attribution state of the r-th anomalous change in the i-th local anomalous state under the current anomalous propagation relationship.

[0227] when When the corresponding abnormal change simultaneously satisfies the propagation relationship association condition, the corresponding feature dimension condition, and the common change direction condition, the abnormal change is classified into the corresponding common cause abnormal component.

[0228] Calculate the corresponding values ​​for each anomalous change in a local anomalous state. ,Depend on The abnormal changes constitute the common cause abnormal component corresponding to the current abnormal propagation relationship. After completing the attribution processing of the relevant abnormal propagation relationship, the remaining abnormal changes constitute the corresponding vehicle residual abnormal state.

[0229] like Figure 3 As shown, the anomaly propagation relationship provides the processing with common anomaly features and corresponding local anomaly states. Each anomaly change within the local anomaly state panel, after being located by its corresponding feature dimension, enters the processing node that "compares the direction of change of each anomaly change with the common anomaly feature." Anomaly changes whose directional relationship matches the current common anomaly feature enter the common cause anomaly component, while other anomaly changes enter the vehicle residual anomaly state.

[0230] Once a common-cause anomaly component is formed, each anomaly change within it retains its original vehicle anomaly detection task identity, task execution identity, source data identity, anomaly timing identity, and current anomaly propagation relationship identifier. Subsequent processing determines the corresponding vehicle anomaly detection task based on the anomaly propagation relationship and the common-cause anomaly component, and performs output status processing on the anomaly detection results formed by the vehicle anomaly detection task through the current processing link.

[0231] After a vehicle's residual abnormal state is formed, each abnormal change within it retains its original abnormal change identity, abnormal change characteristics, abnormal timing information, vehicle abnormality detection task identity, and source data identity. This identity information is used to establish a task-level and data-level correspondence between the vehicle's residual abnormal changes and the corresponding re-inspection results after subsequent replacement detection results are generated.

[0232] Common-cause anomaly components serve as the common source attribution result supporting the anomaly propagation relationship in the current processing stage and are subsequently reviewed in the alternative processing chain. Vehicle residual anomaly states, as candidate anomaly states for the corresponding vehicle anomaly detection task, are also reviewed in the subsequent review process. The common-cause anomaly components and vehicle residual anomaly states of each vehicle anomaly detection task retain their respective task identities and data sources.

[0233] Once a common-cause anomaly component is formed, the anomaly detection results generated by the corresponding vehicle anomaly detection task through the current processing link already have a common processing source explanation. This common-cause anomaly component assumes a stage-specific anomaly attribution role at the current stage, and the alternative processing link continues to verify this attribution at the task level. Based on this processing relationship, before the alternative detection results are formed, the corresponding anomaly detection results are transferred to a restricted output state, causing the original anomaly detection results to enter the pending review processing path.

[0234] Specifically, the adjustment of the output state of the anomaly detection result includes:

[0235] Based on the aforementioned anomaly propagation relationship, determine the vehicle anomaly detection task corresponding to each of the aforementioned common cause anomaly components;

[0236] The output state of the anomaly detection results generated by each of the vehicle anomaly detection tasks through the current processing link is adjusted to a restricted output state, and the anomaly detection results are restricted from being directly output as vehicle anomaly confirmation results.

[0237] The output restriction state is executed in the following manner.

[0238] For each common cause anomaly component formed above, the corresponding vehicle anomaly detection task identity is read along the anomaly propagation relationship associated with the common cause anomaly component. Furthermore, based on the vehicle anomaly detection task identity, task execution identity, and original local anomaly state identity, the anomaly detection result formed by the vehicle anomaly detection task through the current processing link is located.

[0239] When an anomaly detection result is generated, an output qualification identifier is associated with it. This output qualification identifier is used to control whether the anomaly detection result enters the processing path for vehicle anomaly confirmation. Once a corresponding common-cause anomaly component is generated, the output qualification identifier of the anomaly detection result is adjusted to a restricted output state, and a re-inspection association is established between the anomaly detection result and the corresponding anomaly propagation relationship.

[0240] In one implementation, the anomaly detection result record stores at least the vehicle anomaly detection task identifier, task execution identifier, original anomaly detection result identifier, output qualification identifier, and re-inspection relationship identifier. When the output qualification identifier is in a restricted output state, the result scheduling module sends the anomaly detection result to the re-inspection task queue, and the vehicle anomaly confirmation interface subsequently receives the updated result status after re-inspection.

[0241] The abnormal changes, timing information, current processing link identity, and corresponding anomaly propagation relationships of the original anomaly detection results are retained in the result record. Subsequent alternative processing link re-examinations re-obtain the corresponding processing data based on the same task execution identity and source data identity, ensuring that the original anomaly detection results and alternative detection results maintain task-level correspondence.

[0242] When an anomaly detection result is associated with multiple common-cause anomaly components, re-examination items are registered separately according to the anomaly propagation relationship corresponding to each common-cause anomaly component. Before each re-examination item enters the subsequent review process, the output eligibility identifier of the anomaly detection result remains in a restricted output state. When the processing interval and the re-examination input have the same task-level identity, the corresponding re-examination items share the same alternative processing result, and the result index corresponding to each anomaly propagation relationship is saved separately.

[0243] In specific software processing, limiting the output state thus manifests as the gating state of the anomaly detection result output path. The original anomaly detection result still exists as the result record of the original current processing chain, while the re-inspection process creates a corresponding task-level verification process around the anomaly propagation relationship.

[0244] After the original anomaly detection result enters the restricted output state, the re-inspection process needs to maintain the same anomaly-related input basis as the original processing process, and concentrate the processing changes in the data processing range at the anomaly propagation starting point. This forms a substitute processing relationship under the condition of the same source input.

[0245] Furthermore, the alternative processing link re-check includes:

[0246] For each vehicle anomaly detection task associated with an anomaly propagation relationship, the anomaly propagation starting point is obtained from the anomaly propagation relationship, and the node input data of the anomaly propagation starting point in the current processing link corresponding to each vehicle anomaly detection task is obtained as the corresponding upstream input data.

[0247] For each of the vehicle anomaly detection tasks, an alternative processing link is determined that uses the corresponding upstream input data as the re-inspection input, bypasses the anomaly propagation starting point, and is used to replace the data processing performed at the anomaly propagation starting point and continue to execute the subsequent processing of the vehicle anomaly detection task.

[0248] Each upstream input data is connected to the corresponding alternative processing link for re-inspection, forming the corresponding alternative detection result, and the alternative detection result is used as the re-inspection result of the corresponding vehicle anomaly detection task.

[0249] The following combination Figure 4 The process of forming upstream input data, alternative processing links, and alternative detection results will be further explained.

[0250] For each vehicle anomaly detection task associated with the anomaly propagation relationship, the task-level anomaly propagation start point processing position corresponding to that vehicle anomaly detection task is read from the anomaly propagation relationship.

[0251] When establishing the aforementioned anomaly propagation relationship, a task-level correspondence has been established between the shared logical anomaly propagation starting point and the specific processing location in each vehicle anomaly detection task. Therefore, the re-inspection task locates the actual anomaly propagation starting point call during the current execution of the task based on the vehicle anomaly detection task identity and task execution identity, and reads the node input data that enters the node call.

[0252] The upstream input data mentioned here refers to the data content that actually enters the task-level anomaly propagation starting point during the execution of anomaly-related tasks in the original vehicle anomaly detection task, rather than another batch of input data reconstructed according to data type.

[0253] Let the starting point of shared logic exception propagation be processing node P. Vehicle anomaly detection task ① corresponds to task-level processing position P1, and vehicle anomaly detection task ② corresponds to task-level processing position P2. When creating a re-inspection task for task ①, the node input data is obtained from the current node processing record of P1; when creating a re-inspection task for task ②, the node input data is obtained from the current node processing record of P2. Each vehicle anomaly detection task uses the node input data formed during its actual task execution.

[0254] When the number of vehicle anomaly detection tasks associated with the anomaly propagation relationship is greater than two, a mapping relationship between the shared logical anomaly propagation starting point and the corresponding task-level processing position is established according to the identity of each vehicle anomaly detection task, and the corresponding node input data is obtained from each task-level processing position. Vehicle anomaly detection task ① and vehicle anomaly detection task ② represent the task-level processing relationship of two vehicle anomaly detection tasks, and the remaining vehicle anomaly detection tasks form the corresponding task-level anomaly propagation starting point processing position and upstream input data in the same way.

[0255] The upstream input data retains the vehicle anomaly detection task identity, task execution identity, source data identity, data time identity, anomaly sequence identity, and the task-level anomaly propagation starting point processing location. This identity information maintains the source relationship between the original processing input and the re-inspection input.

[0256] For streaming vehicle operation data, the data segment at the input side of the anomaly propagation starting point is obtained based on the anomaly timing information corresponding to the original anomaly change, and the data order is maintained according to the continuous data window used in the original processing of that node. For batch data, the actual data batch received at the original anomaly propagation starting point is obtained based on the current task execution identifier and the source data batch identity.

[0257] When the origin of an anomaly has multiple input ports, the input data group participating in the current processing is obtained based on the node call record, and the port identity, source data identity, and time identity corresponding to each input data are retained. The main vehicle operation data assumes the source data identity related to the anomaly, and the auxiliary input data maintains its input relationship with the current node processing according to the original task execution record.

[0258] When using message-driven processing, the actual message content consumed at the anomaly propagation starting point is obtained based on the message identifier, consumption record, and task execution identity. When using call chain processing, the corresponding call parameters are obtained based on the task-level node call record. When using node-based snapshot processing, the input snapshot corresponding to this processing is obtained based on the task execution identity and the processing position of the propagation starting point.

[0259] like Figure 4As shown, the stacked data slices represent the upstream input data for the corresponding vehicle anomaly detection task. This upstream input data connects both the processing interval where the original anomaly propagation originates and the re-inspection interval where the alternative processing link is located, and its data identity originates from the same vehicle anomaly detection task execution process.

[0260] After obtaining the corresponding upstream input data, an alternative processing link is determined for the corresponding vehicle anomaly detection task.

[0261] The alternative processing link receives the upstream input data, undertakes the data processing function corresponding to the anomaly propagation starting point, and re-integrates the resulting processing output into the subsequent processing of the vehicle anomaly detection task. Its processing relationship is established around four aspects: input reception, processing function, processing source, and output connection.

[0262] The input interface of the alternative processing link maintains a semantic correspondence with the input side of the anomaly propagation starting point. For field-type inputs, the technical meaning and data format of the corresponding fields are preserved; for feature-type inputs, the corresponding feature dimensions and data order are preserved; for multiple input nodes, the corresponding input data groups are provided to the alternative processing link according to the port relationships called by the original nodes.

[0263] The alternative processing link undertakes the data processing functions corresponding to the anomaly propagation starting point. When the anomaly propagation starting point undertakes protocol parsing, the alternative processing link generates a parsing result that is semantically consistent with subsequent processing; when the anomaly propagation starting point undertakes data correction, the alternative processing link completes the corresponding correction processing; when the anomaly propagation starting point undertakes feature construction, the alternative processing link generates the corresponding features required for subsequent tasks; when the anomaly propagation starting point undertakes model inference, the alternative processing link generates the model processing result according to the semantics required for the vehicle anomaly detection task.

[0264] The alternative processing chain further adopts a processing source that is separate from the current anomaly propagation origin. The separation level of the processing source corresponds to the node identity granularity used when forming the shared processing dependency.

[0265] For example, when the origin of an anomaly propagation forms a shared processing source based on the identity of a specific service instance, the alternative processing link uses an independent service instance to undertake the corresponding processing function; when the origin of an anomaly propagation forms a shared processing source based on logical services and processing versions, the alternative processing link uses a processing implementation or effective processing version that is separate from the shared processing identity; when the origin of an anomaly propagation forms a shared processing source based on the identity of a model processing instance, the alternative processing link uses a model processing instance with the same task output semantics and a separate source.

[0266] This separation of processing sources ensures that the processing changes during re-inspection correspond to the locations of the previously identified shared anomalies, and that the alternative processing process completes the data processing functions required for the same task from another processing source.

[0267] The output of the alternative processing link establishes an interface with the subsequent processing of the vehicle anomaly detection task. Its output data is formed according to the field structure, feature dimensions, unit relationships, encoding methods, and data timing required by the subsequent processing. When the alternative implementation uses another internal data representation, the data representation required for subsequent processing is formed through field mapping, unit conversion, or feature semantic mapping.

[0268] In one implementation, a mapping relationship between processing functions and backup processing resources is pre-stored in the vehicle anomaly detection system. When a re-inspection task is created, the corresponding alternative processing resource is read according to the identity of the processing function at the anomaly propagation starting point, and the upstream input interface, processing function semantics, processing source identity, and downstream output interface are verified in sequence to form an alternative processing link with resources that meet the corresponding processing relationship.

[0269] Once the alternative processing resources are ready, the re-inspection task will connect the corresponding upstream input data to this processing link. During the preparation of the alternative processing resources, the original anomaly detection results will continue to be restricted from output.

[0270] The data processing results of some distributed processing nodes depend on both the current node's input data and the task execution context. For such anomaly propagation origins, in addition to the upstream input data, the task context required to complete the corresponding processing function is obtained and provided to the alternative processing link.

[0271] The task context includes vehicle anomaly detection task configuration, historical data window, session identity, normal operation status, model processing configuration, and parameter status related to the execution of this task.

[0272] Task contexts are categorized into task semantic context and runtime context based on their technical function. The task semantic context maintains consistency between the processing objectives of the alternative processing and the original vehicle anomaly detection task, including task configuration, input feature definitions, output feature definitions, and parameters required for anomaly detection. The runtime context maintains the historical relationships required for continuous data processing, including historical time windows, session states, and processing baseline states.

[0273] For processing nodes that rely on continuous historical windows, the corresponding historical data fragments are obtained from the stable processing records before the anomaly propagation point, and combined with the current upstream input data in the original time order to form a continuous input context for the alternative processing link.

[0274] For model processing nodes, the alternative model processing source is determined based on the identity granularity of the shared processing source at the anomaly propagation starting point. When the shared processing source falls at the runtime instance level, the alternative processing link uses an independent model runtime instance and maintains the task output semantics; when the shared processing source falls at the model version level, the alternative processing link uses an effective model processing configuration with separate sources and provides corresponding outputs to subsequent vehicle anomaly detection tasks according to unified feature semantics.

[0275] For service nodes with internal operating states, the alternative processing unit restores the corresponding processing state by adopting its own valid operating state or by relying on the stable task records before the anomaly occurred, so that the alternative processing process has the context basis required to execute the current task.

[0276] This maintains the processing semantics and stable task context required for the vehicle anomaly detection task to continue execution. Upstream input data provides the current anomaly-related data conditions, and the task context provides the state conditions required for the processing function to run. Together, they form the task-level re-inspection input environment for the alternative processing chain.

[0277] The origin of anomaly propagation is identified as a shared processing location formed by common anomaly characteristics, and a corresponding anomaly propagation relationship has been formed downstream from this location. Therefore, the alternative re-inspection constructs a controlled comparison between the original processing path and the alternative processing path around the data processing interval undertaken by the origin of anomaly propagation.

[0278] like Figure 4 As shown, the anomaly propagation starting point in the current processing chain is located between two processing boundaries. The left processing boundary corresponds to the position where upstream input data enters the anomaly propagation starting point, and the right processing boundary corresponds to the position where the processing result of the anomaly propagation starting point enters the subsequent processing of the vehicle anomaly detection task.

[0279] Figure 4 The two processing boundaries shown define the data processing range undertaken by the anomaly propagation origin in the current processing link, and the corresponding data processing range taken over by the alternative processing link. The technical identity of each processing boundary is the input and output connection location of the processing range. The distributed processing nodes in the diagram are identified by the anomaly propagation origin and the corresponding processing units in the alternative processing links.

[0280] Figure 4 In the current processing link, the upper processing section receives upstream input data from the same source from the anomaly propagation starting point and forms the original processing output; Figure 4 The alternative processing link represents the re-inspection path, where the alternative processing link receives upstream input data at the same task level and completes the corresponding functional processing. Both processing paths enter the same vehicle anomaly detection task's subsequent processing semantics after the right-hand processing boundary.

[0281] This creates a re-inspection relationship of "fixing both ends and replacing the middle".

[0282] The input side is fixed with the upstream input data and corresponding task context actually received by the original anomaly propagation starting point; the output side is fixed with the data semantics, processing objectives and anomaly detection logic required for subsequent processing of the vehicle anomaly detection task; the intermediate changes are concentrated in the processing range undertaken by the anomaly propagation starting point, and are taken over by the alternative processing link with the processing source separated.

[0283] The original processing path was executed according to the following relationship: upstream input data → anomaly propagation starting point → subsequent processing of vehicle anomaly detection task → original anomaly detection result.

[0284] The alternative re-inspection path is executed according to the following relationship: upstream input data from the same source → alternative processing link → subsequent processing of vehicle anomaly detection task → alternative detection result.

[0285] The subsequent processing of the vehicle anomaly detection task continues to employ the same techniques as the original task in terms of target processing, anomaly detection semantics, and result output semantics. In actual operation, subsequent processing is undertaken by the processing instance within the corresponding task execution environment, while maintaining the vehicle anomaly detection task identity, task execution identity, and source data identity.

[0286] Through the above processing, the core processing differences between the original processing path and the alternative re-inspection path lie in the data processing undertaken at the anomaly propagation starting point. The alternative detection results thus form a comparative data basis for addressing the processing impact at this shared processing location.

[0287] For vehicle anomaly detection tasks with multiple downstream processing nodes after the anomaly propagation starting point, the output of the alternative processing link continues to enter the subsequent processing relationship corresponding to the original task in sequence. The downstream continuous propagation nodes in the aforementioned anomaly propagation relationship remain within the scope of subsequent processing, and their processing semantics maintain the task relationship of the original vehicle anomaly detection task.

[0288] For each vehicle anomaly detection task, the corresponding upstream input data and task context are connected to the alternative processing link. After completing the data processing at the anomaly propagation starting point, the alternative processing link outputs its data through... Figure 4 Handle the follow-up processing of the vehicle anomaly detection task at the boundary access point.

[0289] The vehicle anomaly detection task continues to perform subsequent data processing according to the original anomaly detection semantics, and generates a substitute detection result corresponding to the current re-inspection task. The substitute detection result serves as the re-inspection result for this vehicle anomaly detection task.

[0290] The alternative detection results should at least retain the vehicle anomaly detection task identity, re-inspection task identity, source data identity, corresponding anomaly propagation relationship identity, and anomaly timing identity, and record the anomaly changes formed after re-inspection according to the same anomaly semantics as the original anomaly detection results.

[0291] For each re-examination anomaly, the alternative detection result further maintains its feature dimensions and direction of change. When there are differences between the original anomaly detection result and the alternative detection result when represented using internal data, the mapping of fields, feature dimensions, and direction of change is performed according to the aforementioned unified feature semantics, so that the two types of detection results enter the same anomaly comparison semantics.

[0292] The semantics of comparing the same anomaly mentioned here include at least the correspondence between vehicle anomaly detection task identity, source data identity, anomaly time series range, feature dimension, and direction of change. These identity relationships are used to subsequently read the state of common anomaly features in the alternative detection results, and also to read the corresponding manifestations of anomaly changes in the residual anomaly state of the vehicle in the alternative detection results item by item.

[0293] For the current common anomaly features, the replacement detection results retain the data query location and change direction information of the corresponding feature dimension, so that subsequent processing can directly determine the state of the common anomaly features in the detection results after replacement processing.

[0294] For residual abnormal states of vehicles, the alternative detection results provide re-inspection data for each abnormal change according to the identity of the corresponding vehicle abnormal detection task and the identity of the source data, so that each candidate abnormality in the residual abnormal state of the vehicle has a corresponding alternative processing result basis.

[0295] When a vehicle anomaly detection task is associated with multiple anomaly propagation relationships, each re-inspection result is registered separately according to the anomaly propagation relationship. When multiple anomaly propagation relationships correspond to the same upstream input data, the same target processing range, and the same alternative processing link, an alternative processing is performed once, and the resulting alternative detection results are associated with the corresponding anomaly propagation relationships respectively.

[0296] When the anomaly propagation origin is located at the last processing position of the current processing link, after the alternative processing link completes the data processing at that last position, it directly forms an alternative detection result according to the detection output semantics of the corresponding vehicle anomaly detection task.

[0297] Figure 4 The result object represents the alternative detection result. After the alternative detection result is formed, it enters the subsequent common cause anomaly component and vehicle residual anomaly state review process as the re-inspection result of the corresponding vehicle anomaly detection task. The original anomaly detection result continues to maintain the corresponding processing state according to its output qualification identifier until the review process generates the corresponding state update result.

[0298] After the alternative detection results are generated, each vehicle anomaly detection task has a corresponding re-inspection output. The re-inspection output maintains the vehicle anomaly detection task identity, source data identity, and anomaly technical semantic correspondence with the anomaly detection results generated by the original current processing chain. On one hand, based on the state of common anomaly features in the alternative detection results, the current common-cause anomaly components are reviewed; on the other hand, each anomaly change in the vehicle's residual anomaly state is used as a candidate object, and its state in the corresponding alternative detection results is read item by item. These two types of processing respectively generate common processing source review results and vehicle-specific anomaly review results.

[0299] Specifically, the verification of the common-cause anomaly components and the vehicle residual anomaly state includes:

[0300] Common anomaly features are obtained from the anomaly propagation relationship, and the existence status of the common anomaly features in each of the alternative detection results is determined. When the common anomaly features do not exist in the corresponding alternative detection results, the corresponding common cause anomaly component is confirmed, and the anomaly detection result formed by the corresponding vehicle anomaly detection task through the current processing link is confirmed and maintained in a restricted output state, and the anomaly detection result is restricted from being directly output as the vehicle anomaly confirmation result.

[0301] For each of the abnormal changes in the residual abnormal states of the vehicles, the existence status of each abnormal change in the alternative detection result of the corresponding vehicle abnormality detection task is determined. The abnormal changes that exist in the corresponding alternative detection result are retained in the corresponding residual abnormal state of the vehicle to form a reviewed residual abnormal state of the vehicle. Based on the reviewed residual abnormal state of the vehicle, the vehicle abnormality confirmation result of the corresponding vehicle abnormality detection task is formed.

[0302] The following explains the task-level correspondence between the original abnormal changes and the alternative detection results, the review of common cause anomalies, and the item-by-item review of vehicle residual anomalies.

[0303] The original current processing chain and the alternative processing chain each form their own processing records. After the same vehicle operation data has passed through two processing paths, the processing time and the time of result formation have their own task execution characteristics. Therefore, the source data identity and the semantics of the abnormal technology are used as the main correspondences during the review.

[0304] For a vehicle anomaly detection task, the original anomaly changes are obtained from the common cause anomaly components or the vehicle residual anomaly state, and the re-inspection anomaly changes are obtained from the alternative detection results corresponding to the vehicle anomaly detection task.

[0305] The two types of abnormal changes establish a technical identity correspondence based on the vehicle anomaly detection task identity, source data identity, anomaly-related data time period, feature dimension, and change direction.

[0306] Among them, the vehicle anomaly detection task identity is used to determine the task to which the review belongs; the source data identity is used to determine the source of vehicle operation data targeted by the two processing steps; the anomaly-related data time period is used to determine the source data range corresponding to the anomaly change; the feature dimension is used to determine the vehicle operation technology meaning expressed by the anomaly change; and the change direction is used to determine the semantic change of the anomaly change relative to the corresponding reference state.

[0307] In one implementation, when vehicle operation data enters the anomaly detection task as a continuous data sequence, the data segment corresponding to the original anomaly change is determined based on the source data sequence identifier and the anomaly time range. The re-detected anomaly change formed within the same source data sequence range is then read from the alternative detection results. Even when the alternative processing link experiences processing delay changes, data alignment between the two processing results is still performed according to the source data sequence identity.

[0308] For batch data, a correspondence is established based on the same source data batch identity and the data location within the batch. For state-type anomalies, a correspondence is established based on the same state variable identity, source data range, and state transition direction.

[0309] When the original processing chain and the alternative processing chain use different internal data representations, they are mapped along the unified feature semantics established above. After the vehicle operation field in the original processing result and the derived features in the alternative detection result are mapped to the same feature dimension, the abnormal state comparison is then performed.

[0310] The record identifier plays a role in data location during the above processing, and the identity of the abnormal technology is jointly determined by the vehicle anomaly detection task, the range of source data, feature dimensions, and the direction of change.

[0311] When an original abnormal change corresponds to multiple consecutive re-examination abnormal segments in the alternative detection results, the corresponding re-examination segments with the same characteristic dimensions and change direction, and covering the range of source data related to the original abnormality, are used together as re-examination evidence of the original abnormal change.

[0312] For the i-th vehicle anomaly detection task and the current anomaly propagation relationship, the anomaly changes in the common cause anomaly components corresponding to this task are grouped into a set. The abnormal changes in the corresponding vehicle residual abnormal state are grouped into a set. .

[0313] The abnormal changes in the corresponding substitution detection results are semantically mapped according to the technical identities described above, and a set of substitution anomalies is formed. .

[0314] The dual-path verification results are expressed as follows: In the formula This represents the dual-path verification result generated by the i-th vehicle anomaly detection task under the influence of the current alternative detection result.

[0315] The intersection of the sets here is matched according to the aforementioned established anomaly technical identities. The first component represents the corresponding state of the anomalous changes in the common-cause anomaly component after the substitution process; the second component represents the corresponding state of the anomalous changes in the vehicle residual anomaly state after the substitution process.

[0316] The first component continues to undergo common anomaly feature verification. The second component continues to screen for vehicle residual anomalies item by item.

[0317] Common-cause anomaly review and vehicle residual anomaly review maintain their respective processing objectives. Common-cause anomaly review controls the eligibility of the original anomaly detection results and the interpretation of the current common processing source; vehicle residual anomaly review directly forms the basis for subsequent confirmation of the vehicle's own anomalies.

[0318] For each vehicle anomaly detection task associated with anomaly propagation relationships, common anomaly features are obtained from the anomaly propagation relationships, and the alternative detection results corresponding to that vehicle anomaly detection task are read.

[0319] The common anomaly features have maintained their corresponding feature dimensions and directions of change. Based on the unified anomaly technical identity established above, the re-examination data corresponding to the common anomaly features is located in the alternative detection results, and an existence state is formed according to the anomaly judgment conditions adopted above.

[0320] When the alternative detection result forms an abnormal change that satisfies the abnormal condition on the feature dimension corresponding to the common abnormal feature, and the direction of the change is consistent with the common abnormal feature, the existence state of the common abnormal feature is recorded as 1; other state combinations are recorded as 0.

[0321] When the common anomaly feature exists in a state of 0, after the upstream inputs related to the same anomaly have undergone the aforementioned substitution processing interval and subsequent vehicle anomaly detection task processing, the substitution detection result has formed a state that is distinct from the original common anomaly feature. Combining the anomaly propagation starting point, the upstream inputs from the same source, and the source of substitution processing, the corresponding common cause anomaly components obtain re-examination evidence support.

[0322] At this point, the attribution status of the corresponding common-cause anomaly component is recorded as the confirmed status. The confirmed status indicates that the anomalous change in the common-cause anomaly component has a source association with the common processing source pointed to by the current anomaly propagation relationship, supported by alternative detection results.

[0323] Subsequently, the abnormal detection results generated by the corresponding vehicle abnormal detection task through the current processing link are confirmed and maintained in a restricted output state, and the identity of the corresponding alternative detection result is associated with the abnormal detection result record.

[0324] The aforementioned output restriction processing occurs before the alternative re-inspection is performed, and is used to establish a pre-re-inspection result gating system; the output restriction status confirmation here occurs after the re-inspection evidence is formed, and is used to record the eligibility of the result after common-cause verification. Both processes apply to the same anomaly detection result output status field.

[0325] When the common anomaly feature exists in state 1, the vehicle anomaly detection task and the current common anomaly feature are kept as the source relocation objects, and the subsequent re-inspection execution path delimitation process is initiated. During the source relocation process, the anomaly detection result formed by the corresponding vehicle anomaly detection task through the original current processing link continues to maintain the restricted output state until the corresponding re-inspection is completed based on the updated anomaly propagation relationship and a new output state confirmation result is formed.

[0326] When multiple vehicle anomaly detection tasks are associated with the same anomaly propagation relationship, each vehicle anomaly detection task reads its own alternative detection results to form a common anomaly feature existence state. Tasks with a state of 0 enter the common cause anomaly confirmation processing, and tasks with a state of 1 enter the source relocation processing. Each task continues to maintain its own vehicle anomaly detection task identity and re-inspection evidence identity.

[0327] The residual abnormal state of the vehicle is formed by the aforementioned abnormal re-attribution processing and is used to save the vehicle's own abnormality candidates in the current vehicle abnormality detection task; the alternative detection result is formed by the aforementioned process and is used to provide the re-inspection data formed by the vehicle abnormality detection task under the conditions of the same source input and alternative processing.

[0328] The vehicle's residual abnormal condition and alternative test results are combined into the process of determining the existence of abnormal changes.

[0329] like Figure 5 As shown, the residual abnormal state of the vehicle is represented by a state container, and the multiple abnormal change units inside the state container represent the abnormal changes to be reviewed contained therein. The residual abnormal state of the vehicle belongs to the higher-level state object, and each abnormal change belongs to the constituent abnormal item inside this state object.

[0330] The input from the vehicle's residual abnormal state to the core processing process is the abnormal changes obtained item by item; the input from the alternative detection results to the core processing process is the re-inspection abnormal data of the corresponding vehicle abnormality detection task.

[0331] The two inputs are paired based on the vehicle anomaly detection task identity and the source data identity. The residual anomaly state of the vehicle in vehicle anomaly detection task ① is paired with the detection result of task ① to form a set of verification inputs, and vehicle anomaly detection task ② forms another set of verification inputs according to its own task identity. When the anomaly propagation relationship involves more vehicle anomaly detection tasks, each task is executed according to the same task-level pairing method.

[0332] Alternative test results in Figure 5 The middle part assumes the technical identity of the evidence to be re-examined, while each abnormal change assumes the technical identity of the object to be judged.

[0333] For each abnormal change in the residual abnormal state of the vehicle, read the vehicle abnormal detection task identity, source data identity, abnormal time sequence information, feature dimension and change direction associated with the abnormal change.

[0334] Subsequently, in the alternative detection results of the corresponding vehicle anomaly detection task, the range of data related to the same anomaly is located based on the vehicle anomaly detection task identity and the source data identity, and then the anomaly changes of the corresponding feature dimensions are obtained according to the unified feature semantics.

[0335] If the abnormal changes during re-inspection meet the corresponding abnormality judgment conditions, and the direction of change is consistent with the direction of change of the original vehicle's residual abnormal changes, the existence status of the current abnormal change in the alternative detection results is recorded as 1; other combinations of statuses are recorded as 0.

[0336] Figure 5 The core processing box, "Determine the existence status of each abnormal change in the corresponding alternative detection result," represents the above-mentioned task's identity matching, source data range positioning, feature dimension correspondence, and change direction comparison process.

[0337] After core processing, enter Figure 5 The given value is the only binary decision node. State 1 corresponds to the "Yes" exit in the diagram, and state 0 corresponds to the "No" exit in the diagram.

[0338] When state 1 exists, the abnormal change in the original vehicle residual abnormal state is retained, and the corresponding alternative test results and re-inspection abnormal evidence are associated in the abnormal change record.

[0339] The objects retained here are still the anomalous changes in the original vehicle's residual anomalous state. The alternative detection results provide evidence for the re-examination of the persistent state of this anomalous change, ensuring that the task identity, source data identity, and anomalous temporal sequence identity of the original anomalous change remain continuous.

[0340] When state 0 exists, the abnormal change is marked as a rejection item, and the retention process of the abnormal change in the vehicle's residual abnormal state is terminated.

[0341] When a vehicle's residual abnormal state contains multiple abnormal changes, the above processing is performed on each of the abnormal changes separately. Each abnormal change forms its own existence state and is then either entered into a retained branch or a removed branch.

[0342] After completing the existence status judgment of all abnormal changes in the residual abnormal state of a vehicle corresponding to a vehicle anomaly detection task, the abnormal changes with an existence status of 1 are reorganized according to the original vehicle anomaly detection task identity to form the reviewed residual abnormal state of the vehicle.

[0343] The reviewed vehicle residual anomaly status consists of the original anomaly changes retained after re-inspection. Each retained anomaly change is further associated with the original anomaly time sequence information, anomaly change characteristics, vehicle anomaly detection task identity, source data identity, and corresponding alternative detection result evidence.

[0344] like Figure 5 As shown, the residual abnormal state of the vehicle after verification is still represented by a state container. The container records the abnormal changes that enter the reserved branch after each state is judged.

[0345] When the number of abnormal changes in the vehicle's residual abnormal state after review is greater than 0, the vehicle's own abnormal state field in the vehicle abnormality confirmation result is recorded as 1, and the abnormal changes retained in the vehicle's residual abnormal state after review are written into the vehicle abnormality confirmation result.

[0346] When the number of abnormal changes in the vehicle's residual abnormal status after review is 0, the vehicle's own abnormal status field in the vehicle abnormality confirmation result is recorded as 0, and the corresponding vehicle abnormality detection task identity and re-inspection result identity are recorded.

[0347] The vehicle anomaly confirmation result must retain at least the vehicle anomaly detection task identity, the vehicle's own anomaly state, the reviewed residual anomaly state, and the corresponding alternative detection result identity. The vehicle anomaly confirmation output is carried by this result object.

[0348] Figure 5 The process ends at the reviewed vehicle residual anomaly status. The vehicle anomaly confirmation result continues to be formed from the reviewed vehicle residual anomaly status and is combined with... Figure 1 The output process corresponds to the result of S105.

[0349] Common cause anomaly review and vehicle residual anomaly review generate separate processing results for the same vehicle anomaly detection task.

[0350] When the common abnormal feature exists in a state of 0, and the number of abnormal changes in the vehicle residual abnormal state after review is greater than 0, the corresponding common cause abnormal component enters the confirmation state, the original abnormal detection result remains in the restricted output state, the vehicle's own abnormal state in the vehicle abnormal confirmation result is recorded as 1, and the vehicle's own abnormal content retained after review is recorded.

[0351] When the common abnormal feature exists in a state of 0, and the number of abnormal changes in the vehicle residual abnormal state after verification is 0, the corresponding common cause abnormal component enters the confirmation state, the original abnormal detection result remains in the restricted output state, and the vehicle's own abnormal state in the vehicle abnormal confirmation result is recorded as 0.

[0352] When the common anomaly feature has a state of 1, and the number of abnormal changes in the vehicle's residual anomaly state after review is greater than 0, the common anomaly feature enters the source relocation processing. The vehicle's own anomaly state in the vehicle anomaly confirmation result is recorded as 1, and the vehicle's residual anomaly content after review is retained.

[0353] When the common anomaly feature has a state of 1, and the number of abnormal changes in the vehicle's residual anomaly state after verification is 0, the common anomaly feature enters the source relocation processing, and the vehicle's own anomaly state in the vehicle anomaly confirmation result is recorded as 0.

[0354] Through the above task-level combined processing, the common cause anomaly source location and the vehicle's own anomaly confirmation continue to be executed according to their respective review results. The same vehicle anomaly detection task thus simultaneously maintains two technical dimensions: the common cause source status and the vehicle's own anomaly status.

[0355] When the presence status of a common anomaly feature in the substitution detection result is 1, the same common anomaly feature will still be formed after the current substitution process is completed. In this case, a new common anomaly formation location delimitation will be performed on the data processing path actually traversed in this re-inspection.

[0356] During the aforementioned re-inspection of the alternative processing link, upstream input data, alternative processing link processing records, and subsequent processing records of the vehicle anomaly detection task are retained according to the identity of the re-inspection task. During source relocation, the aforementioned re-inspection execution records are read, and a corresponding re-inspection processing path is formed according to the data processing order of the vehicle anomaly detection task.

[0357] The re-inspection process path starts from the aforementioned fixed upstream input data, passes sequentially through the processing unit corresponding to the alternative processing link and the subsequent processing node of the vehicle anomaly detection task, until an alternative detection result is formed.

[0358] For vehicle anomaly detection tasks where the common anomaly feature state is 1, according to the unified feature semantics established above, the node input data and node output data are obtained sequentially from each processing position in the re-inspection processing path, and the existence state of the common anomaly feature on the node input side and node output side are determined respectively.

[0359] For processing locations where multiple vehicle anomaly detection tasks still have a common processing relationship, the shared processing correspondence is re-established according to the same node identity granularity, and the common anomaly features are searched along the data processing order of the re-inspection processing path to form a cross section from state 0 to state 1.

[0360] When the new state 0 to state 1 forming section is located in the alternative processing interval, the corresponding alternative processing position is registered as a new anomaly propagation starting point candidate; when the forming section is located in the subsequent processing interval of the vehicle anomaly detection task, the corresponding downstream shared processing position is registered as a new anomaly propagation starting point candidate.

[0361] When a common abnormal feature has been formed at the starting input side of the re-inspection processing path, state 1 is formed. Continue to read the upstream input data corresponding to the previous level processing record along the vehicle abnormal detection task identity, source data identity and abnormal time sequence identity, and extend the source delimitation range according to the same existence state logic.

[0362] After redefining the anomaly propagation starting point, an updated anomaly propagation relationship is formed according to the aforementioned anomaly propagation relationship formation method, maintaining the correspondence between the new anomaly propagation starting point and the task-level processing position of each vehicle anomaly detection task. Subsequently, based on the updated anomaly propagation relationship, the corresponding result qualification control and alternative re-inspection processing are initiated.

[0363] Based on the above-described implementation of the vehicle-to-everything (V2X) distributed anomaly detection method, this application also discloses a V2X distributed anomaly detection system. The system is implemented by a computer device executing corresponding programs, and each unit in the system is a program module, a processing module, or a combination of a program module and a processing device that performs corresponding data processing functions. For example... Figure 6 As shown, the system includes the following units:

[0364] The local anomaly formation unit 110 is used to acquire vehicle operation data corresponding to at least two vehicle anomaly detection tasks and the current processing link formed by each vehicle operation data passing through the distributed processing nodes in sequence, perform anomaly detection on the vehicle operation data to obtain anomaly changes, and associate the anomaly changes with the corresponding current processing link to form a local anomaly state.

[0365] The synchronous anomaly collection unit 120 is used to determine the distributed processing nodes that each current processing link passes through in accordance with the current processing link associated with each local anomaly state, form a shared processing dependency, and synchronously collect each local anomaly state based on the shared processing dependency to form a synchronous anomaly set corresponding to the shared processing dependency.

[0366] Anomaly propagation relationship construction unit 130 is used to determine common anomaly features from the synchronous anomaly set, determine the anomaly propagation starting point based on the existence and state changes of the common anomaly features in each current processing link associated with the shared processing dependency, and form an anomaly propagation relationship associated with each local anomaly state in the synchronous anomaly set and the corresponding vehicle anomaly detection task by the common anomaly features and the anomaly propagation starting point.

[0367] Anomaly reattribution unit 140 is used to determine common cause anomaly components from each associated local anomaly state based on the anomaly propagation relationship, and to form corresponding vehicle residual anomaly states from the anomaly changes in each local anomaly state that are not attributed to the corresponding common cause anomaly components.

[0368] The alternative re-inspection and confirmation unit 150 is used to adjust the output state of the abnormal detection results formed by the vehicle abnormality detection task associated with the abnormality propagation relationship through the current processing link based on the abnormality propagation relationship and each common cause abnormality component, perform alternative processing link re-inspection on each of the vehicle abnormality detection tasks, review each common cause abnormality component and the corresponding vehicle residual abnormality state according to the re-inspection results, update the corresponding abnormality detection result output state and form the corresponding vehicle abnormality confirmation result.

[0369] The above description is merely a preferred embodiment of this application. It should be understood that this application is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the concept described herein through the above teachings or the technology or knowledge in related fields. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of this application should fall within the protection scope of this application.

Claims

1. A distributed anomaly detection method based on vehicle-to-everything (V2X) networks, characterized in that, include: The system acquires vehicle operation data corresponding to at least two vehicle anomaly detection tasks and the current processing link formed by the sequential passing of each vehicle operation data through distributed processing nodes. It performs anomaly detection on the vehicle operation data to obtain abnormal changes and associates the abnormal changes with the corresponding current processing link to form a local anomaly state. Based on the current processing links associated with each local abnormal state, the distributed processing nodes that each current processing link passes through are determined to form a shared processing dependency. Based on the shared processing dependency, each local abnormal state is synchronously collected to form a synchronous abnormal set corresponding to the shared processing dependency. A common anomaly feature is determined from the set of synchronous anomalies. The anomaly propagation starting point is determined based on the existence and state changes of the common anomaly feature in each current processing link associated with the shared processing dependency. An anomaly propagation relationship is formed by the common anomaly feature and the anomaly propagation starting point, which are associated with each local anomaly state in the set of synchronous anomalies and the corresponding vehicle anomaly detection task. Based on the aforementioned abnormal propagation relationship, common cause abnormal components are determined from each associated local abnormal state, and the abnormal changes in each local abnormal state that are not attributed to the corresponding common cause abnormal components are respectively used to form the corresponding vehicle residual abnormal state. Based on the aforementioned anomaly propagation relationship and each common cause anomaly component, the output state of the anomaly detection results formed by the vehicle anomaly detection task associated with the anomaly propagation relationship through the current processing link is adjusted respectively. The alternative processing link is re-examined for each of the aforementioned vehicle anomaly detection tasks. Based on the re-examination results, each common cause anomaly component and the corresponding vehicle residual anomaly state are reviewed respectively. The output state of the corresponding anomaly detection results is updated and the corresponding vehicle anomaly confirmation result is formed.

2. The distributed anomaly detection method based on vehicle networking according to claim 1, characterized in that, The formation of the current processing link and local abnormal state includes: As the vehicle operation data passes through each distributed processing node in sequence, each distributed processing node receives node input data, processes the node input data, and forms node output data. According to the data processing order of the vehicle operation data and the data transmission relationship between the node output data of each distributed processing node and the node input data of the subsequent distributed processing nodes, the distributed processing nodes through which the vehicle operation data passes in sequence are associated to form the current processing link. Anomaly detection is performed on the vehicle operation data, and based on the anomaly detection results, the abnormal time sequence information corresponding to the abnormal changes is determined. The abnormal change features corresponding to the abnormal time sequence information are extracted from the vehicle operation data. The abnormal changes, abnormal timing information, and abnormal change characteristics are associated with the current processing link corresponding to the vehicle operation data to form a local abnormal state.

3. A distributed anomaly detection method based on vehicle networking according to any one of claims 1-2, characterized in that, The formation of the shared processing dependencies and synchronization exception set includes: By comparing the current processing links associated with each of the local abnormal states, the distributed processing nodes that each current processing link passes through and the processing positions of the distributed processing nodes in each current processing link are determined, and a shared processing dependency is formed based on the distributed processing nodes and their processing positions. For each of the aforementioned local abnormal states, abnormal timing information is determined based on the abnormal changes in the local abnormal states, and the abnormal start time is determined based on the abnormal timing information. The local abnormal states that start at the same preset synchronization time window and correspond to the current processing link containing each distributed processing node in the shared processing dependency are synchronously collected to form a synchronization abnormal set corresponding to the shared processing dependency.

4. The distributed anomaly detection method based on vehicle networking according to claim 3, characterized in that, The determination of the common abnormal features and the starting point of abnormal propagation includes: For each local abnormal state in the synchronization abnormal set, abnormal change features are extracted from the abnormal changes in each local abnormal state. The feature dimensions and change directions of each abnormal change feature are compared to determine the abnormal changes that are in the same feature dimension and have the same change direction. The feature dimensions and change directions of the abnormal changes form a common abnormal feature. Along the data processing order of each current processing link associated with the shared processing dependency, feature changes in the feature dimension corresponding to the common anomaly feature are extracted from the node input data and node output data of each distributed processing node in the shared processing dependency. The direction of change of the feature changes is compared with the direction of change of the common anomaly feature, and the existence state of the common anomaly feature in the node input data and node output data is determined according to the comparison result. Based on the aforementioned state, the distributed processing node that first satisfies the condition that the common abnormal feature does not exist in the node input data and the common abnormal feature exists in the node output data in the shared processing dependency along the data processing order is determined as the starting point of the abnormal propagation.

5. The distributed anomaly detection method based on vehicle networking according to claim 4, characterized in that, The formation of the abnormal propagation relationship includes: Starting from the point of origin of the anomaly propagation, the existence status of the common anomaly feature in the node output data of each distributed processing node is determined sequentially downstream along the data processing order of each current processing link associated with the shared processing dependency. Based on the existence status, a distributed processing node with the common abnormal characteristics is determined to exist continuously downstream from the abnormal propagation starting point along the data processing order. According to the data processing order of each current processing link, the common abnormal features, the abnormal propagation starting point, the distributed processing nodes that continuously contain the common abnormal features are associated with the corresponding local abnormal states and corresponding vehicle abnormal detection tasks in the synchronous abnormal set to form an abnormal propagation relationship.

6. The distributed anomaly detection method based on vehicle networking according to claim 5, characterized in that, The formation of the common cause anomaly components and the vehicle residual anomaly state includes: From the abnormal propagation relationship, obtain the common abnormal features and the corresponding local abnormal states, determine the feature dimension and change direction of the common abnormal features, and determine the corresponding feature dimension of the common abnormal features in each of the local abnormal states. The change direction of the abnormal change in the corresponding feature dimension in each of the local abnormal states is compared with the change direction of the common abnormal feature to determine the abnormal changes with the same change direction in each of the local abnormal states, and the abnormal changes are respectively used to form common cause abnormal components associated with the corresponding local abnormal states. Each of the aforementioned local abnormal states is formed by abnormal changes in which the corresponding common cause abnormal component is not attributed to the corresponding local abnormal state, thus creating a vehicle residual abnormal state associated with the corresponding local abnormal state.

7. The distributed anomaly detection method based on vehicle networking according to claim 6, characterized in that, The output status adjustment of the anomaly detection result includes: Based on the aforementioned anomaly propagation relationship, determine the vehicle anomaly detection task corresponding to each of the aforementioned common cause anomaly components; The output state of the anomaly detection results generated by each of the vehicle anomaly detection tasks through the current processing link is adjusted to a restricted output state, and the anomaly detection results are restricted from being directly output as vehicle anomaly confirmation results.

8. The distributed anomaly detection method based on vehicle networking according to claim 7, characterized in that, The alternative processing link re-check includes: For each vehicle anomaly detection task associated with the anomaly propagation relationship, the anomaly propagation starting point is obtained from the anomaly propagation relationship, and the node input data of the anomaly propagation starting point in the current processing link corresponding to each vehicle anomaly detection task is obtained as the corresponding upstream input data. For each of the vehicle anomaly detection tasks, an alternative processing link is determined that uses the corresponding upstream input data as the re-inspection input, does not pass through the anomaly propagation starting point, and is used to replace the data processing performed at the anomaly propagation starting point and continue to execute the subsequent processing of the vehicle anomaly detection task. Each of the upstream input data is connected to the corresponding alternative processing link for re-inspection, forming a corresponding alternative detection result, and the alternative detection result is used as the re-inspection result of the corresponding vehicle anomaly detection task.

9. The distributed anomaly detection method based on vehicle networking according to claim 8, characterized in that, The verification of the common-cause anomaly components and the vehicle residual anomaly status includes: Common anomaly features are obtained from the anomaly propagation relationship, and the existence status of the common anomaly features in each of the alternative detection results is determined. When the common anomaly features do not exist in the corresponding alternative detection results, the corresponding common cause anomaly component is confirmed, and the anomaly detection result formed by the corresponding vehicle anomaly detection task through the current processing link is confirmed and maintained in a restricted output state, and the anomaly detection result is restricted from being directly output as the vehicle anomaly confirmation result. For each of the abnormal changes in the residual abnormal states of the vehicles, the existence status of each abnormal change in the alternative detection result of the corresponding vehicle abnormality detection task is determined. The abnormal changes that exist in the corresponding alternative detection result are retained in the corresponding residual abnormal state of the vehicle to form a reviewed residual abnormal state of the vehicle. Based on the reviewed residual abnormal state of the vehicle, the vehicle abnormality confirmation result of the corresponding vehicle abnormality detection task is formed.

10. A distributed anomaly detection system based on vehicle networking, characterized in that, The system includes: The local anomaly formation unit is used to acquire vehicle operation data corresponding to at least two vehicle anomaly detection tasks and the current processing link formed by each vehicle operation data passing through distributed processing nodes in sequence, perform anomaly detection on the vehicle operation data to obtain anomaly changes, and associate the anomaly changes with the corresponding current processing link to form a local anomaly state. The synchronous anomaly collection unit is used to determine the distributed processing nodes that each current processing link passes through in accordance with the current processing link associated with each local anomaly state, form a shared processing dependency, and synchronously collect each local anomaly state based on the shared processing dependency to form a synchronous anomaly set corresponding to the shared processing dependency. An anomaly propagation relationship construction unit is used to determine common anomaly features from the synchronous anomaly set, determine the anomaly propagation starting point based on the existence and state changes of the common anomaly features in each current processing link associated with the shared processing dependency, and form an anomaly propagation relationship associated with each local anomaly state in the synchronous anomaly set and the corresponding vehicle anomaly detection task by the common anomaly features and the anomaly propagation starting point. An anomaly reattribution unit is used to determine common cause anomaly components from each associated local anomaly state based on the anomaly propagation relationship, and to form corresponding vehicle residual anomaly states from the anomaly changes in each local anomaly state that are not attributed to the corresponding common cause anomaly components. The alternative re-inspection and confirmation unit is used to adjust the output state of the abnormal detection results formed by the vehicle abnormality detection tasks associated with the abnormality propagation relationship through the current processing link based on the abnormality propagation relationship and each common cause abnormality component, perform alternative processing link re-inspection on each of the vehicle abnormality detection tasks, review each common cause abnormality component and the corresponding vehicle residual abnormality state according to the re-inspection results, update the corresponding abnormality detection result output state and form the corresponding vehicle abnormality confirmation result.

Images