Real-time analysis method and system for highway toll data based on time series

Abstract

The application discloses a real-time analysis method and system for expressway toll data based on time series, and the method comprises the following steps: collecting data sets of an expressway toll network in an actual operation process; obtaining a first preprocessed data set according to the Grubbs criterion based on the data sets; obtaining a second preprocessed data set according to a difference operation; collecting data characteristics, establishing a mesoscopic traffic flow model, and obtaining model parameters; calculating the entity value of an actual vehicle based on the second preprocessed data set, and obtaining the relative importance weight of the vehicle; combining the threat behavior evaluation indexes of all actual vehicles on all threat paths to obtain a network global threat index; and detecting the network global threat index in real time. The application realizes the whole-process accurate monitoring of the expressway toll network from data preprocessing to security situation analysis.

Description

Technical Field

[0001] This application relates to the fields of data processing and network monitoring, and more specifically, to a method and system for real-time analysis of highway toll data based on time series. Background Technology

[0002] The highway toll collection system is a core infrastructure for highway operation. On the one hand, it completes vehicle route identification, toll calculation, and online clearing and settlement. The collected tolls are used to repay road construction loans, carry out road maintenance and equipment operation and maintenance, and ensure the continuous operation of the road network. On the other hand, it collects vehicle passage time data to support traffic flow statistics, toll evasion investigation and road network status monitoring. Relying on equipment such as ETC gantries, it enables non-stop passage, improves traffic efficiency, and identifies abnormal passage behavior to assist in road network risk management and ensure highway traffic order and operational safety.

[0003] Due to the multimodal, time-varying, and non-homogeneous characteristics of highway toll system data, a single baseline model struggles to effectively identify all abnormal behaviors. A key challenge is how to integrate heterogeneous data streams from different payment methods (ETC / MTC) and scenarios such as mainline / ramp in real time, and accurately distinguish between normal behavior patterns and potential security threats. Summary of the Invention

[0004] In view of the above problems, the purpose of this invention is to provide a method and system for real-time analysis of highway toll data based on time series, which can more accurately monitor the network security status of highway toll networks in real time.

[0005] The first aspect of this invention provides a method for real-time analysis of highway toll data based on time series, comprising: S1. Collect datasets of the highway toll collection network during its actual operation; S2. Based on the dataset, outlier data is removed according to Grubbs' criterion to obtain the first preprocessed dataset; S3. Based on the first preprocessed dataset, a second preprocessed dataset is obtained according to the difference operation; S4. Based on the second preprocessed dataset, collect data features, establish a meso-level traffic flow model, and obtain model parameters according to the meso-level traffic flow model. S5. Based on the second preprocessed dataset, calculate the actual value of vehicles in the highway toll network and obtain the relative importance weight of the vehicles. S6. Based on the relative importance weights of the vehicles and according to the model parameters, obtain the threat behavior assessment index; on a single threat path, combine the threat behavior assessment indices of all actual vehicles to obtain the comprehensive threat path index; combine the comprehensive threat path index on all threat paths to obtain the global network threat index. S7. Based on continuous output of time series, network security is assessed according to the real-time detection of the global network threat index. If the global network threat index exceeds the preset threat threshold, a warning is triggered; otherwise, detection continues.

[0006] In this solution, S1 includes: Based on the operation records of the highway toll system for a preset number of days, a preset number of structured data entries are collected to obtain the dataset of the highway toll network in actual operation. The dataset includes network traffic capture records, system log events, and security device alarm information.

[0007] In this solution, S2 includes: According to Grubbs' criteria, the sources of outlier data to be removed include hardware failures of data acquisition equipment, communication transmission interference, or software algorithm defects. Let X be the data from the same workday at the same time in the dataset. i If g complete data sets are obtained from the dataset within a preset sampling time period, then there will be g data points at any given time, and their average value is... The formulas for calculating the standard deviation v are as follows: ; ; Where i represents the number from which data at the same time point were extracted from the dataset; If the standard deviation exceeds a preset multiple of the mean, expand the g data points, remove the data points with the largest deviation from the mean, and recalculate the mean and standard deviation. Check if the recalculated standard deviation exceeds a preset multiple of the recalculated mean. If so, continue to remove data. Otherwise, integrate the processed data to obtain the first preprocessed dataset.

[0008] In this solution, S3 includes: The non-stationary time series in the first preprocessed dataset are converted into stationary time series by the difference operation to obtain the second preprocessed dataset. Data X from the second preprocessed dataset under stationary time series analysis t for: ; Where e represents a constant term, This represents white noise, p represents the autoregressive order, and q represents the moving average order. Represents the autoregressive coefficient. The parameter 'o' represents the index of the data in the stationary time series.

[0009] In this solution, S4 includes: Based on the second preprocessed dataset, the collected data features include queue, speed, and capacity; Based on the data characteristics, a meso-level traffic flow model is constructed, which includes a queue model, a speed model, and a capacity model. The queue model is established based on the queuing behavior of target vehicles detected at highway toll stations; The movement of all vehicles within the area constitutes the highway traffic network. Each segment of the highway traffic network is divided into several areas, and each area is further divided into several lanes. Lanes traveling in the same direction downstream of an area are grouped into a lane group. The target vehicle entered the toll booth queue, T t The time delay index T is the time delay caused by the target vehicle during the queuing process. t The expression is: ; Where C represents the total number of vehicles output by the lane group, and t´ represents the time period during which the target vehicle departs; The target vehicle at time delay T t When the target vehicle arrives at the last segment of the queue, after time t, the position q(t) of the target vehicle is expressed as: ; Where q(0) represents the initial queuing position of the target vehicle when it just arrives at the end of the queue at t=0, and C t t represents the total number of vehicles that can pass through the lane normally within time t, and m represents the number of vehicles between the last vehicle in the queue and the target vehicle. Based on the current speed of the target vehicle, establish the speed model; Once a certain density of vehicles is reached on a highway section, the speed of the target vehicles is calculated using an exponential function. The relationship between the current speed of the target vehicles and the density is expressed as follows: ; in, This represents the speed of the target vehicle at time t. and These represent the minimum and maximum permissible speeds for highways, respectively. This represents the highway density at time t-1. Represents the maximum density of highways; The capacity model is established based on the output capacity of the detection lane group; The capacity model is primarily established to detect the output capacity of the lane group. Its expression is: ; in, This represents the maximum number of vehicles that can exit in lane group j within time period t. Indicates the statistical time interval. This represents the total number of lanes in the downstream j+1 region lane group. This indicates the length of the road segment in the downstream j+1 region. This represents the saturated traffic density in the downstream j+1 region. This represents the actual traffic density in region j+1 at time t-1; The meso-level traffic flow model is established based on the data characteristics, and the model parameters corresponding to the queue model, speed model and capacity model are obtained.

[0010] In this solution, S5 includes: By extracting the feature parameters of the actual vehicle from the second preprocessed dataset, and then processing them, the actual vehicle e is calculated. k EV k The calculation formula is: ; in, For the actual vehicle's first Item feature parameters, The weights corresponding to each feature parameter, for The exponential function, KB represents the number of the feature parameters of the actual vehicle, and KB represents the total number of all feature parameters on the actual vehicle. When the total number of vehicles in the high-speed power tolling network is m, and the actual number of vehicles is e... k The formula for calculating the relative importance weights is: ; Among them, EV k Represents the actual vehicle e k The physical value of EV f This represents the physical value of the f-th actual vehicle. Represents the actual vehicle e k The relative importance weights, This represents the relative importance weight of the f-th actual vehicle, where f represents the vehicle number.

[0011] In this solution, S6 includes: By coupling the model parameters of the queue model and the velocity model, the success rate of threat behavior can be obtained. The relative importance weight of the vehicles and the success rate of threat behaviors are combined to obtain the threat behavior assessment index, the calculation formula of which is as follows: ; in, Threatening behaviors representing highway toll networks, T ac ( ) represents threatening behavior Threat Behavior Assessment Index, P i ( ) represents threatening behavior The success rate, where W represents the degree of threat to the network; Based on the threat behavior assessment index of all actual vehicles on a single threat path, and combined with the model parameters of the capacity model, a comprehensive threat path index is obtained, where the formula is: ; in, This represents the comprehensive threat path index along the threat path, where n represents the total number of threat behaviors along the threat path, and ac represents the number of threat behaviors along the threat path. If there are M threat paths from the initial state to the target state in a highway toll network, the global threat index of the network is obtained by combining the comprehensive threat path index of the M threat paths. The calculation formula is as follows: ; Among them, T h (TO) represents the global threat index of the highway toll network, and L represents the threat path number.

[0012] In this solution, S7 includes: Based on the global network threat index, a threat sliding window {T} is constructed by setting a preset time interval in the time series. I (TO)1,T I (TO)2,...,T I (TO) k}, where k is the preset number of global network threat indices obtained within a preset time interval; Based on the threat sliding window, the network global threat index under the continuous output of the time series is detected in real time, and the threat sliding window is detected; If the global network threat index exceeds a preset threat threshold, a warning is triggered, and the threat behavior of the actual vehicle on the threat path is located by backtracking according to the threat sliding window; otherwise, real-time detection continues.

[0013] This plan also includes: Based on the historical dataset of the highway toll network, historical datasets under special historical conditions were collected within a preset historical sampling time. Based on the historical dataset collected under special historical conditions, a third preprocessed dataset is obtained according to the Grubbs criterion and the difference operation. The third preprocessed dataset and the historical network global threat index are used to train and establish a network global threat index prediction model. Based on the current special environment, calculate the impact factor of the current special environment. Based on the historical dataset, collect the historical global network threat index corresponding to the one with the smallest absolute value of the difference between the impact factors of the historical special environment and the current special environment. Constrain the capacity model. Based on the constrained capacity model, obtain the global network threat index of the current special environment. Network security is assessed based on the real-time detection of the current special environment's global network threat index; Based on the network global threat index prediction model and considering the current special environment, a predicted network global threat index for the special environment is determined. The predicted network global threat index for the special environment is then adjusted according to the current special environment network global threat index. If the adjusted predicted network global threat index for the special environment is greater than the preset predicted threat threshold, the detection intensity for all vehicles and highway toll networks is increased; otherwise, the prediction continues.

[0014] A second aspect of the present invention provides a real-time analysis system for time-series highway toll data, comprising: The data acquisition module is used to collect datasets from the actual operation of the highway toll network. The data preprocessing module is used to remove outlier data based on the dataset according to the Grubbs criterion to obtain a first preprocessed dataset; and to obtain a second preprocessed dataset based on the first preprocessed dataset using a difference operation. The model building module is used to collect data features based on the second preprocessed dataset, build a meso-level traffic flow model, and obtain model parameters based on the meso-level traffic flow model. The first calculation module is used to calculate the entity value of actual vehicles in the highway toll network based on the second preprocessed dataset, and obtain the relative importance weight of the vehicles. The second calculation module is used to obtain a threat behavior assessment index based on the relative importance weights of the vehicles and the model parameters; to obtain a comprehensive threat path index by combining the threat behavior assessment indices of all actual vehicles on a single threat path; and to obtain a global network threat index by combining the comprehensive threat path indices on all threat paths. The early warning module is used for continuous output based on time series. It assesses network security based on the real-time detection of the global network threat index. If the global network threat index exceeds a preset threat threshold, an alert is triggered; otherwise, the detection continues.

[0015] This invention discloses a method and system for real-time analysis of highway toll data based on time series. After collecting highway toll network data, the method ensures data quality and stability through Grubbs' criterion and differential processing, laying a reliable data foundation for subsequent modeling. Based on this data, a meso-level traffic flow model is constructed, characterizing the dynamic features of traffic flow from three dimensions: queue size, speed, and capacity, providing accurate traffic state input for security analysis. Finally, based on entity value and threat assessment indicators, combined with the model parameters output from the meso-level traffic flow model, a hierarchical and real-time assessment of network security status is achieved. Simultaneously, the network security status under special environments is also assessed and predicted. These three parts progress step-by-step, from data preprocessing to state modeling, and then to security analysis, forming a complete logical chain from underlying data to upper-level applications, jointly supporting accurate perception and real-time response to the network security situation of toll network security. Attached Figure Description

[0016] Figure 1 A flowchart of the real-time analysis method for highway toll data based on time series provided by the present invention is shown; Figure 2 A block diagram of the time-series-based real-time analysis system for highway toll data provided by the present invention is shown. Detailed Implementation

[0017] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0018] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0019] Figure 1 A flowchart of the real-time analysis method for highway toll data based on time series provided by the present invention is shown.

[0020] like Figure 1 As shown, this invention discloses a real-time analysis method for highway toll data based on time series, including: S1. Collect datasets of the highway toll collection network during its actual operation; S2. Based on the dataset, outlier data is removed according to Grubbs' criterion to obtain the first preprocessed dataset; S3. Based on the first preprocessed dataset, the second preprocessed dataset is obtained through the difference operation; S4. Based on the second preprocessed dataset, collect data features, establish a meso-level traffic flow model, and obtain model parameters based on the meso-level traffic flow model. S5. Based on the second preprocessed dataset, calculate the actual value of vehicles in the highway toll network and obtain the relative importance weight of vehicles. S6. Based on the relative importance weights of vehicles and according to the model parameters, the threat behavior assessment index is obtained; on a single threat path, the comprehensive threat path index is obtained by combining the threat behavior assessment indices of all actual vehicles; and the network global threat index is obtained by combining the comprehensive threat path indices of all threat paths. S7. Based on continuous time-series output, network security is assessed according to the real-time detection of the global network threat index. If the global network threat index exceeds the preset threat threshold, a warning is triggered; otherwise, detection continues.

[0021] According to an embodiment of the present invention, firstly, a dataset of the highway toll network in actual operation is collected. Based on the Grubbs criterion, outlier data in the dataset is removed to obtain a first preprocessed dataset. The first preprocessed dataset is then subjected to a difference operation to obtain a second preprocessed dataset. Data features, including queue size, speed, and capacity, are collected from the second preprocessed dataset. A meso-level traffic flow model is established based on the data features. The meso-level traffic flow model includes a queue size model, a speed model, and a capacity model. The corresponding model parameters are obtained according to the model formula.

[0022] Then, based on the feature parameters of actual vehicles in the second preprocessed dataset, the entity value of actual vehicles in the highway toll network is calculated, thereby obtaining the relative importance weight of vehicles. The model parameters of the queue model and speed model are combined with the relative importance weight of vehicles to obtain the threat behavior assessment index of actual vehicles. The model parameters of the capacity model are combined, and the threat behavior assessment index of all actual vehicles on a single threat path is calculated to obtain the comprehensive threat path index. At the same time, the comprehensive threat path index of all threat paths in the highway toll network from the initial state to the target state is calculated to obtain the global threat index of the network.

[0023] Finally, based on the global network threat index, a threat sliding window is constructed and monitored in real time to achieve accurate monitoring of the highway toll network. In special environments, the capacity model is optimized based on historical datasets to obtain the current global network threat index for that specific environment, enabling accurate monitoring of the highway toll network under those conditions. Simultaneously, a global network threat index prediction model is established to predict the global network threat index for special environments, thus predicting threats to the highway toll network under those special conditions.

[0024] According to embodiment S1 of the present invention, it includes: Based on the operation records of the highway toll system for a preset number of days, a preset number of structured data entries are collected to obtain the dataset of the highway toll network in actual operation. The dataset includes network traffic capture records, system log events, and security device alarm information.

[0025] It should be noted that the preset number of days covers weekdays, weekends, and special holidays. The highway toll system operation records include statistics on daily traffic peaks, complete ETC transaction records, and MTC special situation handling.

[0026] The preset number of days and preset number of structured data are set by those skilled in the art according to actual needs.

[0027] According to an embodiment of the present invention, S2 includes: According to Grubbs' criteria, the sources of outlier data to be removed include hardware failures of data acquisition equipment, communication transmission interference, or software algorithm defects. Let X be the data corresponding to the same time on the same workday in the dataset. i If g complete data sets are obtained from the dataset within a preset sampling time period, then there will be g data points at any given time, and their average value is... The formulas for calculating the standard deviation v are as follows: ; ; Where i represents the number from which data at the same time point were extracted from the dataset; If the standard deviation exceeds a preset multiple of the mean, expand the g data points, remove the data points with the largest deviation from the mean, and recalculate the mean and standard deviation. Check if the recalculated standard deviation exceeds a preset multiple of the recalculated mean. If so, continue removing data. Otherwise, integrate the processed data to obtain the first preprocessed dataset.

[0028] It should be noted that outlier data can significantly distort the statistical characteristics of time series data, thereby interfering with the parameter training process of the analytical model based on the data and reducing the accuracy and robustness of the algorithm. Therefore, data preprocessing is required using the Grubbs criterion, and statistical bias can be effectively eliminated through an iterative mean correction mechanism.

[0029] According to Grubbs' criterion, the termination condition for the loop process of outlier removal is: ; Among them, X j represents other data points in the data sequence, and k represents the threshold for judging outliers.

[0030] The preset multiplier can be set by those skilled in the art according to actual needs.

[0031] According to an embodiment of the present invention, S3 includes: The non-stationary time series in the first preprocessed dataset are transformed into stationary time series by the difference operation to obtain the second preprocessed dataset. Data X from the stationary time series analysis in the second preprocessed dataset t for: ; Where e represents a constant term, This represents white noise, p represents the autoregressive order, and q represents the moving average order. Represents the autoregressive coefficient. The parameter 'o' represents the index of the data in the stationary time series.

[0032] It should be noted that the traffic flow and network global threat index time series collected by the highway toll network are affected by peak traffic and holidays, and have trend and periodic characteristics. They are non-stationary time series. The original non-stationary series are transformed into stationary series through d-order difference operation.

[0033] Based on the first preprocessed dataset, time series data are collected, time series plots are drawn, and ADF unit root tests are performed. The null hypothesis of ADF is that the series is non-stationary. If the statistical test output probability p > 0.05 in the ADF unit root test, the null hypothesis cannot be rejected, the series has a trend or periodicity, and is a non-stationary series, which requires differencing.

[0034] If a time series is non-stationary, it can generally be decomposed as follows: ; Y t Let Z be a non-stationary time series at time t. t Let S be the trend term at time t. t Let I be the seasonal periodic term at time t. t Let I be the random disturbance term at time t; the difference is obtained by subtraction to eliminate trends and periods, and retain the random stationary component I. t .

[0035] If there is a linear trend Since it is a constant, the linear trend is eliminated, and the first difference is performed as follows: ; Y t Y is the first difference of a non-stationary time series at time t. t-1 For a non-stationary time series at time t-1, Z t-1S represents the trend term at time t-1. t-1 Let I be the seasonal periodic term at time t-1. t-1 Let be the random perturbation term at time t-1.

[0036] If the data in a non-stationary time series exhibits daily or weekly periodic fluctuations (a typical characteristic of toll-based traffic), and the ADF test still indicates non-stationarity after first-order differencing, then second-order differencing is performed. ; in, Let be the second difference of the non-stationary time series at time t. It is the first difference of the non-stationary time series at time t-1.

[0037] For paid data traffic, seasonal differentiation is also required: ; Y represents the seasonal difference of a non-stationary time series at time t, where s is the period length (e.g., for daily statistics, the period length of one week is s=7). t-s It is a non-stationary time series at time ts.

[0038] Perform the ADF test again. The difference order should generally not exceed 2, as excessive difference introduces additional spurious noise.

[0039] After differencing, the original dimensions of the sequence are changed. The model predicts the result of the differencing sequence, which cannot be directly used as the original index result. It is necessary to perform integration to restore the differenced predicted value to the time series dimensions of the first preprocessed dataset, thus obtaining the second preprocessed dataset.

[0040] The ADF unit root test is a standard technique and will not be elaborated upon here.

[0041] According to an embodiment of the present invention, S4 includes: Based on the second preprocessed dataset, the collected data features include queue, speed, and capacity; Based on data characteristics, a meso-level traffic flow model is constructed, which includes a queue model, a speed model, and a capacity model. A queue model is established based on the queuing behavior of target vehicles at highway toll stations. The movement of all vehicles within a region constitutes the highway traffic network. Each segment of the highway traffic network is divided into several regions, and each region is further divided into several lanes. Lanes traveling in the same direction downstream of a region are grouped into a lane group. The target vehicle entered the toll booth queue, T t The time delay index T is the time delay caused by the target vehicle during the queuing process. tThe expression is: ; Where C represents the total number of vehicles output by the lane group, and t´ represents the time period during which the target vehicle departs; The target vehicle at time delay T t When the target vehicle arrives at the last segment of the queue, after time t, the position q(t) of the target vehicle is expressed as: ; Where q(0) represents the initial queuing position when the target vehicle just arrives at the end of the queue at t=0, and C t t represents the total number of vehicles that can pass through the lane normally within time t, and m represents the number of vehicles between the last vehicle in the queue and the target vehicle. Establish a speed model based on the current speed of the target vehicle; Once a certain density of vehicles is reached on a highway section, the speed of the target vehicles is calculated using an exponential function. The relationship between the current speed of the target vehicles and the density is expressed as follows: ; in, This represents the speed of the target vehicle at time t. and These represent the minimum and maximum permissible speeds for highways, respectively. This represents the highway density at time t-1. Represents the maximum density of highways; A capacity model is established based on the output capacity of the detection lane group; The capacity model is mainly established to detect the output capacity of lane groups. Its expression is: ; in, This represents the maximum number of vehicles that can exit in lane group j within time period t. Indicates the statistical time interval. This represents the total number of lanes in the downstream j+1 region lane group. This indicates the length of the road segment in the downstream j+1 region. This represents the saturated traffic density in the downstream j+1 region. This represents the actual traffic density in region j+1 at time t-1; A meso-level traffic flow model is established based on data characteristics, and the model parameters corresponding to the queue model, speed model and capacity model are obtained.

[0042] It should be noted that meso-level traffic flow lies between micro-level individual vehicle movement and macro-level overall road network flow. It uses road segments, toll stations, and highway ramps as analysis units. Its core feature is that it does not track the trajectory of individual vehicles, but depicts the dynamic changes in traffic flow aggregation and dissipation, queue evolution, time-varying vehicle speed, and traffic capacity.

[0043] Vehicle queues and congestion at highway toll stations are a core cause of overload in vehicle-to-everything (V2X) communication, transmission latency jitter, and high server load. This study establishes a queue model to quantitatively characterize the evolution of vehicle queues, transforming congestion levels into indicators of network threat behavior. It dynamically calculates the success probability of various network attacks and the overall security risk of road sections, enabling coupled simulation of traffic flow and toll station network security status. This provides a quantitative basis for network security early warning and resource allocation during peak hours.

[0044] The speed model quantifies the changes in communication dwell time and network access switching behavior caused by speed differences by depicting the evolution of vehicle speed throughout the entire process of a vehicle entering a toll station. Vehicles traveling at speeds below the toll station's speed limit will prolong the attack window, increase the overall network communication load, and significantly lower the toll station's network security threshold. Introducing the speed model into the threat behavior assessment system, complementing the vehicle queue model, provides data support for time-segmented network security early warning and adaptive protection at toll stations.

[0045] This paper constructs a toll station capacity model based on the output capacity of lane groups, quantifying the upper limit of lane capacity and the supply and demand of traffic flow. When traffic flow approaches or exceeds the capacity, vehicles accumulate and queue, network concurrency load surges, communication quality deteriorates, and the success rate of various network attacks increases, exacerbating system vulnerability. This model couples the supply and demand situation of traffic capacity with the network security situation, which can not only quantify the changes in security risks caused by traffic overload, but also allocate security protection resources according to capacity margin, realizing dynamic assessment and early warning of toll station capacity and network security.

[0046] According to an embodiment of the present invention, S5 includes: By extracting the feature parameters of the actual vehicles from the second preprocessed dataset, and then processing them, the actual vehicle e is calculated. k EV k The calculation formula is: ; in, For the actual vehicle's first Item feature parameters, The weights corresponding to each feature parameter, for The exponential function, KB represents the number of the feature parameters of the actual vehicle, and KB represents the total number of all feature parameters on the actual vehicle. When the total number of vehicles in the high-speed power tolling network is m, and the actual number of vehicles is e... k The formula for calculating the relative importance weights is: ; Among them, EV k Represents the actual vehicle e k The physical value of EV f This represents the physical value of the f-th actual vehicle. Represents the actual vehicle e k The relative importance weights, This represents the relative importance weight of the f-th actual vehicle, where f represents the vehicle number.

[0047] It should be noted that the actual vehicle e k EV k In the context of vehicle-to-everything (V2X) toll collection at highway toll stations, the e-toll for a single actual vehicle... k The importance of a network security system for toll collection is emphasized, for example, the impact of a cyberattack or communication anomaly by a real vehicle on lane equipment, communication links, and even the entire toll collection network. Feature parameters of the real vehicles, including vehicle location, speed, OBU trusted status, and traffic queue, are extracted from the second preprocessed dataset. These feature parameters are then normalized to calculate the actual vehicle's e-value. k EV k .

[0048] Setting relative importance weights for vehicles allows for the differentiation of information sensitivity and security hazard levels among different vehicles; vehicles with higher weights have more confidential data and suffer more severe consequences from cyberattacks. Calculating a threat behavior assessment index for actual vehicles using relative importance weights breaks away from standardized risk assessment models, facilitating enhanced communication protection for key vehicles, rational allocation of security resources, and improving the accuracy and targeted nature of toll station cybersecurity assessments.

[0049] Normalizing the feature parameters is an existing technique and will not be elaborated here.

[0050] According to an embodiment of the present invention, S6 includes: By coupling the model parameters of the queue model and the velocity model, the success rate of threat behavior can be obtained. By combining the relative importance weight of vehicles with the success rate of threat behaviors, a threat behavior assessment index is obtained, the calculation formula of which is as follows: ; in, Threatening behaviors representing highway toll networks, T ac ( ) represents threatening behavior Threat Behavior Assessment Index, P i ( ) represents threatening behavior The success rate, where W represents the degree of threat to the network; Based on the threat behavior assessment index of all actual vehicles on a single threat path, and combined with the model parameters of the capacity model, a comprehensive threat path index is obtained, where the formula is: ; in, This represents the comprehensive threat path index along the threat path, where n represents the total number of threat behaviors along the threat path, and ac represents the number of threat behaviors along the threat path. If there are M threat paths from the initial state to the target state in a highway toll network, the global threat index of the network is obtained by combining the comprehensive threat path index of the M threat paths. The calculation formula is as follows: ; Among them, T h (TO) represents the global threat index of the highway toll network, and L represents the threat path number.

[0051] It should be noted that the highway network security threat assessment employs a hierarchical recursive estimation strategy that extends from local details to the overall global picture. This strategy is specifically divided into three levels: state layer, path layer, and system layer. It strictly follows the assessment logic order from point to line to surface, where a point is a specific node, a line is a related path, and a surface is the entire network. Through this method, the threat status, threat path, and global threat quantitative assessment index can be accurately obtained, thereby comprehensively and deeply reflecting the security situation of the highway network from multiple dimensions and different levels.

[0052] According to the queue model, when the number of vehicles between the last vehicle in the queue and the actual vehicle is 0, the position q(t1) of the actual vehicle represents the queue length; the actual vehicle's speed can be calculated based on the speed model. The system vulnerability S is obtained based on the model parameters of the queue model and the velocity model, where the formula is: ; in, Represents the model parameter weights of the queue model; This represents the weights of the model parameters for the velocity model. The success rate of the threat behavior is then calculated as follows: ; in, Based on the inherent success rate, under conditions of no traffic congestion and system idle state, the threat behavior The inherent attack success rate (determined by the attack type: data tampering, DoS, and privacy theft; the inherent probability is pre-defined, with a value range of 0-1). This is a vulnerability amplification factor, used to constrain the upper limit of the success rate of threat behaviors; among which, , and All settings are configured by those skilled in the art based on actual needs.

[0053] Threat behavior assessment is calculated using the success rate of single-step threat behavior, threat level, and the physical value of the target vehicle. Based on the calculation formula of the network threat assessment results, a threat behavior assessment index is obtained.

[0054] The threat level W is set by those skilled in the art based on actual needs.

[0055] The Comprehensive Threat Path Index is a quantitative assessment indicator for the vehicle-to-everything (V2X) toll collection scenario at highway toll stations. It uses the entire traffic flow link as a single threat transmission path as the calculation unit. First, it collects the individual threat behavior assessment index of each vehicle within the path due to abnormal speed, spatial position deviation, queuing delays, and illegal lane-crossing / following. This index is then aggregated to obtain the index. The index reflects the cumulative level of cybersecurity threats along the entire traffic flow link. A higher value indicates a stronger risk superposition effect on this traffic flow path, and more prominent cybersecurity risks such as channel congestion, man-in-the-middle attacks, replay attacks, and data verification failures. It can be used to determine the safe operation status of lanes, classify risk levels, and provide quantitative basis for traffic flow control, ETC communication time slot scheduling, and security verification strategy adjustments.

[0056] The Global Network Threat Index is a quantitative indicator representing the overall security status of the highway toll station network. The toll system evolves from a stable and secure initial operating state to a target state with increasing risk due to factors such as traffic flow disturbances, communication interference, and illegal driving. Throughout this process, there are M independent or coupled threat paths. The comprehensive threat path index for each threat path is calculated individually, and the comprehensive threat path indices of the M threat paths are cumulatively summed to obtain the final value. This index uniformly quantifies the cumulative total of various network security risks across the entire station, including channel conflicts, authentication failures, abnormal packet accumulation, toll evasion fraud, and internal network overload. A higher value indicates a higher overall vulnerability of the toll network and a greater likelihood of denial-of-service attacks and data tampering. It is used for overall station security risk assessment, congestion management, dynamic allocation of ETC communication resources, and overall evaluation of the effectiveness of toll network security control.

[0057] According to an embodiment of the present invention, S7 includes: Based on the global network threat index, a threat sliding window {T} is constructed by setting preset time intervals in the time series.I (TO)1,T I (TO)2,...,T I (TO) k}, where k is the preset number of global network threat indices obtained within a preset time interval; Based on the threat sliding window, the global network threat index under the continuous output of the time series is detected in real time, and the threat sliding window is detected. If the global network threat index exceeds the preset threat threshold, an alert is triggered, and the threat behavior of the actual vehicle on the threat path is located by tracing back through the threat sliding window; otherwise, real-time detection continues.

[0058] It should be noted that by constructing a threat sliding window mechanism, the judgment of single-point instantaneous values ​​is abandoned, and continuous time-series monitoring of the global network threat index is carried out. This not only triggers alarms when the risk exceeds the standard, but also allows for backtracking and source tracing based on the sliding window, accurately locating the source vehicle's illegal threat behavior, and solving the problems of false alarms due to instantaneous fluctuations and the inability to trace the source of risks.

[0059] The system continuously outputs a global network threat index based on time series data to dynamically assess the network security status of highway toll collection networks. A monitoring time interval is pre-set, and continuous time-series samples are extracted to construct a threat sliding window, which contains the global threat index of k time-series nodes. The system performs real-time security analysis based on the continuous data within the sliding window. If the window determines that the global network threat index exceeds a preset threshold, a security alarm is triggered. The system then uses the time-series records of the sliding window to trace back the entire threat chain, accurately locating the abnormal vehicle threat behavior that triggers the risk. When the risk does not exceed the threshold, the sliding window continues to iterate forward, cyclically executing time-series monitoring.

[0060] The preset time interval can be set by those skilled in the art according to actual needs.

[0061] According to an embodiment of the present invention, it further includes: Based on the historical dataset of the highway toll network, historical datasets under special historical conditions were collected within a preset historical sampling time. Based on historical datasets collected under special historical environments, a third preprocessed dataset is obtained according to the Grubbs criterion and differential operations. The third preprocessed dataset and the historical network global threat index are used to train a network global threat index prediction model. Based on the current special environment, calculate the impact factor of the current special environment. Based on the historical dataset, collect the historical global network threat index corresponding to the one with the smallest absolute value of the difference between the impact factors of the historical special environment and the current special environment. Constrain the capacity model. Based on the constrained capacity model, obtain the global network threat index of the current special environment. Network security is assessed based on real-time detection of the global network threat index in the current special environment; Based on the network global threat index prediction model and considering the current special environment, the predicted network global threat index for the special environment is determined. The predicted network global threat index for the special environment is then adjusted according to the current special environment network global threat index. If the adjusted predicted network global threat index for the special environment is greater than the preset predicted threat threshold, the detection intensity of all vehicles and highway toll network is increased; otherwise, the prediction continues.

[0062] It should be noted that the toll station's environmental hardware equipment, such as weather sensors, traffic flow data collection, and communication monitoring, undergoes a self-check of its operational status. Once the equipment is confirmed to be functioning normally, historical datasets of the toll network under various special environmental conditions are collected within a preset sampling period. These special environmental conditions are mainly characterized by vehicles being prone to skidding and low visibility, primarily including rainy, foggy, and snowy days.

[0063] The influencing factors of the special environment are visibility A and road friction B. The weight of visibility A is preset to be a, and the weight of road friction B is preset to be b. The influencing factor under the special environment is calculated as E = a × A + b × B. Based on the influencing factors under the special environment, the historical network global threat index corresponding to the one with the smallest absolute value of the difference between the influencing factors under the current special environment is obtained. A constraint coefficient is established, and the capacity model is combined with the constraint coefficient to obtain the constrained capacity model and the network global threat index under the current special environment. Based on the influencing factors under special environments, the most similar historical special environments are identified and input into the network global threat index prediction model to accurately determine the predicted network global threat index for special environments. Based on the current network global threat index for special environments, correction coefficients are set to adjust the predicted network global threat index for special environments. This not only avoids assessment bias caused by capacity reduction in special scenarios such as severe weather and peak traffic, and eliminates misjudgments caused by accidental data disturbances, ensuring the accuracy and stability of network security assessments, but also allows for advance risk assessment based on prediction thresholds. When risks escalate, the detection of vehicles and the entire toll network is proactively strengthened, transforming from traditional passive alarms to proactive prediction and defense. This effectively suppresses the accumulation and deterioration of network security risks such as channel conflicts, message tampering, and toll evasion by following other vehicles, significantly improving the security resilience and risk management effectiveness of highway toll networks under complex and special operating conditions.

[0064] Weight a, weight b, and preset threshold are set by those skilled in the art according to actual needs.

[0065] Figure 2 A block diagram of the time-series-based real-time analysis system for highway toll data provided by the present invention is shown.

[0066] like Figure 2As shown, a second aspect of the present invention provides a real-time analysis system for highway toll data based on time series, comprising: The data acquisition module is used to collect datasets from the actual operation of the highway toll network. The data preprocessing module is used to remove outlier data from the dataset according to the Grubbs criterion to obtain a first preprocessed dataset; and to obtain a second preprocessed dataset based on the first preprocessed dataset through a difference operation. The model building module is used to collect data features based on the second preprocessed dataset, build a meso-level traffic flow model, and obtain model parameters based on the meso-level traffic flow model. The first calculation module is used to calculate the entity value of actual vehicles in the highway toll network based on the second preprocessed dataset, and to obtain the relative importance weight of the vehicles. The second calculation module is used to obtain the threat behavior assessment index based on the relative importance weight of vehicles and the model parameters; on a single threat path, it combines the threat behavior assessment indices of all actual vehicles to obtain the comprehensive threat path index; and it combines the comprehensive threat path index on all threat paths to obtain the global network threat index. The early warning module is used for continuous output based on time series. It assesses network security based on the real-time detection of the global network threat index. If the global network threat index exceeds the preset threat threshold, an alert is triggered; otherwise, the detection continues.

[0067] All information (including but not limited to user equipment information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals (including but not limited to signals transmitted between user terminals and other devices) involved in this application have been authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the "dataset of the highway toll network in actual operation" and "historical dataset of the highway toll network" involved in this disclosure were obtained with full authorization.

[0068] This invention discloses a method and system for real-time analysis of highway toll data based on time series. After collecting highway toll network data, the method ensures data quality and stability through Grubbs' criterion and differential processing, laying a reliable data foundation for subsequent modeling. Based on this data, a meso-level traffic flow model is constructed, characterizing the dynamic features of traffic flow from three dimensions: queue size, speed, and capacity, providing accurate traffic state input for security analysis. Finally, based on entity value and threat assessment indicators, combined with the model parameters output from the meso-level traffic flow model, a hierarchical and real-time assessment of network security status is achieved. Simultaneously, the network security status under special environments is also assessed and predicted. These three parts progress step-by-step, from data preprocessing to state modeling, and then to security analysis, forming a complete logical chain from underlying data to upper-level applications, jointly supporting accurate perception and real-time response to the network security situation of toll network security.

[0069] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0070] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0071] In addition, in the various embodiments of the present invention, each functional unit can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0072] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0073] Alternatively, if the integrated units of this invention are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

Claims

1. A method for real-time analysis of highway toll data based on time series, characterized in that, include: S1. Collect datasets of the highway toll collection network during its actual operation; S2. Based on the dataset, outlier data is removed according to Grubbs' criterion to obtain the first preprocessed dataset; S3. Based on the first preprocessed dataset, a second preprocessed dataset is obtained according to the difference operation; S4. Based on the second preprocessed dataset, collect data features, establish a meso-level traffic flow model, and obtain model parameters according to the meso-level traffic flow model. S5. Based on the second preprocessed dataset, calculate the actual value of vehicles in the highway toll network and obtain the relative importance weight of the vehicles. S6. Based on the relative importance weights of the vehicles, and according to the model parameters, obtain the threat behavior assessment index; On a single threat path, the comprehensive threat path index is obtained by combining the threat behavior assessment index of all actual vehicles; and the network global threat index is obtained by combining the comprehensive threat path index on all threat paths. S7. Based on continuous output of time series, network security is assessed according to the real-time detection of the global network threat index. If the global network threat index exceeds the preset threat threshold, a warning is triggered; otherwise, detection continues.

2. The method for real-time analysis of highway toll data based on time series as described in claim 1, characterized in that, S1 includes: Based on the operation records of the highway toll system for a preset number of days, a preset number of structured data entries are collected to obtain the dataset of the highway toll network in actual operation. The dataset includes network traffic capture records, system log events, and security device alarm information.

3. The real-time analysis method for highway toll data based on time series as described in claim 1, characterized in that, The S2 includes: According to Grubbs' criteria, the sources of outlier data to be removed include hardware failures of data acquisition equipment, communication transmission interference, or software algorithm defects. Let X be the data from the same workday at the same time in the dataset. i If g complete data sets are obtained from the dataset within a preset sampling time period, then there will be g data points at any given time, and their average value is... The formulas for calculating the standard deviation v are as follows: ； ； Where i represents the number from which data at the same time point were extracted from the dataset; If the standard deviation exceeds a preset multiple of the mean, expand the g data points, remove the data points with the largest deviation from the mean, and recalculate the mean and standard deviation. Check if the recalculated standard deviation exceeds a preset multiple of the recalculated mean. If so, continue to remove data. Otherwise, integrate the processed data to obtain the first preprocessed dataset.

4. The real-time analysis method for highway toll data based on time series as described in claim 3, characterized in that, The S3 includes: The non-stationary time series in the first preprocessed dataset are converted into stationary time series by the difference operation to obtain the second preprocessed dataset. Data X from the second preprocessed dataset under stationary time series analysis t for: ； Where e represents a constant term, This represents white noise, p represents the autoregressive order, and q represents the moving average order. Represents the autoregressive coefficient. The parameter 'o' represents the index of the data in the stationary time series.

5. The method for real-time analysis of highway toll data based on time series as described in claim 1, characterized in that, The S4 includes: Based on the second preprocessed dataset, the collected data features include queue, speed, and capacity; Based on the data characteristics, a meso-level traffic flow model is constructed, which includes a queue model, a speed model, and a capacity model. The queue model is established based on the queuing behavior of target vehicles detected at highway toll stations; The movement of all vehicles within the area constitutes the highway traffic network. Each segment of the highway traffic network is divided into several areas, and each area is further divided into several lanes. Lanes traveling in the same direction downstream of an area are grouped into a lane group. The target vehicle entered the toll booth queue, T t The time delay index T is the time delay caused by the target vehicle during the queuing process. t The expression is: ； Where C represents the total number of vehicles output by the lane group, and t´ represents the time period during which the target vehicle departs; The target vehicle at time delay T t When the target vehicle arrives at the last segment of the queue, after time t, the position q(t) of the target vehicle is expressed as: ； Where q(0) represents the initial queuing position of the target vehicle when it just arrives at the end of the queue at t=0, and C t t represents the total number of vehicles that can pass through the lane normally within time t, and m represents the number of vehicles between the last vehicle in the queue and the target vehicle. Based on the current speed of the target vehicle, establish the speed model; Once a certain density of vehicles is reached on a highway section, the speed of the target vehicles is calculated using an exponential function. The relationship between the current speed of the target vehicles and the density is expressed as follows: ； in, This represents the speed of the target vehicle at time t. and These represent the minimum and maximum permissible speeds for highways, respectively. This represents the highway density at time t-1. Represents the maximum density of highways; The capacity model is established based on the output capacity of the detection lane group; The capacity model is primarily established to detect the output capacity of the lane group. Its expression is: ； in, This represents the maximum number of vehicles that can exit in lane group j within time period t. Indicates the statistical time interval. This represents the total number of lanes in the downstream j+1 region lane group. This indicates the length of the road segment in the downstream j+1 region. This represents the saturated traffic density in the downstream j+1 region. This represents the actual traffic density in region j+1 at time t-1; The meso-level traffic flow model is established based on the data characteristics, and the model parameters corresponding to the queue model, speed model and capacity model are obtained.

6. The method for real-time analysis of highway toll data based on time series as described in claim 5, characterized in that, The S5 includes: By extracting the feature parameters of the actual vehicle from the second preprocessed dataset, and then processing them, the actual vehicle e is calculated. k EV k The calculation formula is: ； in, For the actual vehicle's first Item feature parameters, The weights corresponding to each feature parameter, for The exponential function, KB represents the number of the feature parameters of the actual vehicle, and KB represents the total number of all feature parameters on the actual vehicle. When the total number of vehicles in the high-speed power tolling network is m, and the actual number of vehicles is e... k The formula for calculating the relative importance weights is: ； Among them, EV k Represents the actual vehicle e k The physical value of EV f This represents the physical value of the f-th actual vehicle. Represents the actual vehicle e k The relative importance weights, This represents the relative importance weight of the f-th actual vehicle, where f represents the vehicle number.

7. The method for real-time analysis of highway toll data based on time series as described in claim 6, characterized in that, The S6 includes: By coupling the model parameters of the queue model and the velocity model, the success rate of threat behavior can be obtained. The relative importance weight of the vehicles and the success rate of threat behaviors are combined to obtain the threat behavior assessment index, the calculation formula of which is as follows: ； in, Threatening behaviors representing highway toll networks, T ac ( ) represents threatening behavior Threat Behavior Assessment Index, P i ( ) represents threatening behavior The success rate, where W represents the degree of threat to the network; Based on the threat behavior assessment index of all actual vehicles on a single threat path, and combined with the model parameters of the capacity model, a comprehensive threat path index is obtained, where the formula is: ； in, This represents the comprehensive threat path index along the threat path, where n represents the total number of threat behaviors along the threat path, and ac represents the number of threat behaviors along the threat path. If there are M threat paths from the initial state to the target state in a highway toll network, the global threat index of the network is obtained by combining the comprehensive threat path index of the M threat paths. The calculation formula is as follows: ； Among them, T h (TO) represents the global threat index of the highway toll network, and L represents the threat path number.

8. The method for real-time analysis of highway toll data based on time series as described in claim 7, characterized in that, The S7 includes: Based on the global network threat index, a threat sliding window {T} is constructed by setting a preset time interval in the time series. I (TO)1,T I (TO)2,...,T I (TO) k }, where k is the preset number of global network threat indices obtained within a preset time interval; Based on the threat sliding window, the network global threat index under the continuous output of the time series is detected in real time, and the threat sliding window is detected; If the global network threat index exceeds a preset threat threshold, a warning is triggered, and the threat behavior of the actual vehicle on the threat path is located by backtracking according to the threat sliding window; otherwise, real-time detection continues.

9. The method for real-time analysis of highway toll data based on time series as described in claim 8, characterized in that, Also includes: Based on the historical dataset of the highway toll network, historical datasets under special historical conditions were collected within a preset historical sampling time. Based on the historical dataset collected under special historical conditions, a third preprocessed dataset is obtained according to the Grubbs criterion and the difference operation. The third preprocessed dataset and the historical network global threat index are used to train and establish a network global threat index prediction model. Based on the current special environment, calculate the impact factor of the current special environment. Based on the historical dataset, collect the historical global network threat index corresponding to the one with the smallest absolute value of the difference between the impact factors of the historical special environment and the current special environment. Constrain the capacity model. Based on the constrained capacity model, obtain the global network threat index of the current special environment. Network security is assessed based on the real-time detection of the current special environment's global network threat index; Based on the network global threat index prediction model and considering the current special environment, a predicted network global threat index for the special environment is determined. The predicted network global threat index for the special environment is then adjusted according to the current special environment network global threat index. If the adjusted predicted network global threat index for the special environment is greater than the preset predicted threat threshold, the detection intensity for all vehicles and highway toll networks is increased; otherwise, the prediction continues.

10. A real-time analysis system for highway toll data based on time series, used to implement the real-time analysis method for highway toll data based on time series as described in any one of claims 1-9, characterized in that, include: The data acquisition module is used to collect datasets from the actual operation of the highway toll network. The data preprocessing module is used to remove outlier data based on the dataset according to the Grubbs criterion to obtain a first preprocessed dataset; Based on the first preprocessed dataset, a second preprocessed dataset is obtained through a difference operation; The model building module is used to collect data features based on the second preprocessed dataset, build a meso-level traffic flow model, and obtain model parameters based on the meso-level traffic flow model. The first calculation module is used to calculate the entity value of actual vehicles in the highway toll network based on the second preprocessed dataset, and obtain the relative importance weight of the vehicles. The second calculation module is used to obtain a threat behavior assessment index based on the relative importance weights of the vehicles and the model parameters. On a single threat path, the comprehensive threat path index is obtained by combining the threat behavior assessment index of all actual vehicles; and the network global threat index is obtained by combining the comprehensive threat path index on all threat paths. The early warning module is used for continuous output based on time series. It assesses network security based on the real-time detection of the global network threat index. If the global network threat index exceeds a preset threat threshold, an alert is triggered; otherwise, the detection continues.

Images