A method and system for identifying vehicle risks facing network-physical coupling anomalies

Abstract

The application provides a kind of network physical coupling abnormality-oriented automobile risk identification method and system, it is related to intelligent automobile safety technical field, the method includes obtaining vehicle normal and abnormal operation data, extracts hierarchical time sequence features of physical operation layer, vehicle-mounted communication layer, control function layer to construct time sequence sample set, combined with multi-dimensional risk index completes risk grade labeling;Again, a multi-layer risk graph containing risk receptor layer is constructed, after mapping nodes, edges and multi-dimensional risk information, four-level risk representation is extracted through graph risk representation learning, and cross-layer risk association is established;Finally, based on multi-layer risk representation, risk propagation aggregation and abnormal event hazard assessment are carried out.The application solves the problems of difficult modeling of cross-layer coupling of vehicle physics, network and control and difficult assessment of abnormal multi-dimensional hazards, and realizes comprehensive hazard assessment through multi-layer risk graph and other technologies, providing quantitative support for intelligent automobile safety warning and protection decision.

Description

Technical Field

[0001] This invention relates to the field of intelligent vehicle safety technology, and in particular to a method and system for identifying vehicle risks oriented to network-physical coupling anomalies. Background Technology

[0002] With the rapid development of automotive electrification, connectivity, and intelligence technologies, intelligent vehicles have evolved from traditional purely mechanical control systems into cyber-physical coupled systems that deeply integrate sensing units, in-vehicle communication networks, electronic control units, actuators, and environmental interactions. In such systems, there are significant cross-layer correlations and coupling effects among network layer message anomalies, sensing layer information distortion, control layer output offsets, and physical layer state fluctuations: single-layer anomalies caused by local network attacks or device failures can propagate and spread along communication links, control links, and functional links, accumulating and amplifying under specific driving scenarios, ultimately leading to functional safety risks to the entire vehicle and causing serious safety accidents such as loss of control and collisions.

[0003] Current research and technical solutions for intelligent vehicle security risks largely focus on single-dimensional anomaly detection: one type of solution focuses on intrusion detection in the vehicle network, identifying bus attacks by analyzing packet characteristics, but can only determine whether anomalies exist at the network layer, unable to correlate with subsequent control deviations and physical risks; another type focuses on fault diagnosis of vehicle dynamics, determining vehicle state anomalies solely based on physical operating data, unable to trace the root cause of the anomaly at the network or control layer. Existing technologies generally lack a unified model of the risk propagation relationship between the network, control, and physical layers, making it difficult to reveal the coupling and amplification mechanisms of anomalies at different levels, and unable to quantitatively assess the comprehensive harm of a single anomaly event to the overall vehicle safety.

[0004] Therefore, there is an urgent need for vehicle risk identification methods and systems that address the anomalies in network-physical coupling to solve existing technical problems. Summary of the Invention

[0005] This invention aims to solve at least one of the technical problems existing in the prior art, and proposes a method and system for identifying vehicle risks oriented to network-physical coupling anomalies.

[0006] In a first aspect, embodiments of the present invention provide a method for identifying vehicle risks oriented towards network-physical coupling anomalies, including:

[0007] Acquire normal and abnormal vehicle operation data, extract hierarchical time-series features from the physical operation layer, vehicle communication layer, and control function layer to form normal and abnormal time-series sample sets, and label the risk level of the time-series sample sets with multi-dimensional risk indicators.

[0008] Based on the normal and abnormal time-series sample sets and their risk level labels, a multi-layer risk graph is constructed, including the physical operation layer, vehicle communication layer, control function layer, and risk receptor layer. The node features, edge features, abnormal amplitude, latency mismatch information, and functional criticality information of each layer are mapped to the multi-layer risk graph. The node-level, edge-level, function-level, and vehicle-level risk representations are extracted through a graph risk representation learning model, and the correlation between network layer anomalies, control layer anomalies, and physical response risks is established.

[0009] Based on the obtained multi-level risk representations at the node, edge, function, and vehicle levels, risk propagation aggregation and abnormal event hazard assessment are performed on the vehicle.

[0010] Furthermore, normal operation data is generated based on vehicle dynamics model, vehicle communication model, control function model, and parameters of multiple operating conditions. The specific method for generating normal operation data includes: synchronously driving the vehicle dynamics simulation unit, vehicle communication simulation unit, and control function simulation unit to run under a unified sampling period according to multiple sets of normal operating condition configuration parameters, generating the original time sequence of normal operation covering the physical operation layer, vehicle communication layer, and control function layer; the normal operating condition configuration parameters include road adhesion coefficient, speed operating condition parameters, road curvature parameters, network load parameters, and controller operating parameters.

[0011] Furthermore, abnormal operational data is constructed through preset attack or fault injection methods. The specific methods for constructing abnormal operational data include:

[0012] Construct a set of anomaly patterns that include communication layer anomalies, state anomalies, control layer anomalies, and cross-layer coupling anomalies. Select a target anomaly pattern and apply it to the original normal operation time sequence to generate an anomaly operation sequence.

[0013] The communication layer anomalies include message replay, message forgery, periodic drift, delay injection, sudden packet loss, denial of service, and message ambiguity disturbance; the state anomalies include sensor bias, asymptotic drift, random noise amplification, measurement distortion, and timing delay; the control layer anomalies include control command tampering, actuator delay, actuator gain variation, and control saturation; the cross-layer coupling anomalies include message anomalies causing control layer output anomalies, control layer anomalies causing physical response offsets, misalignment between sensing feedback and control output, and multi-layer timing asynchrony.

[0014] Furthermore, the multidimensional risk indicators include anomaly intensity, duration, propagation range, functional impact, and safety margin loss. The time-series sample set is labeled with risk levels using these multidimensional risk indicators, specifically through the following methods:

[0015] Normal operation sequences and abnormal operation sequences are uniformly time-aligned, and multi-level time series samples are obtained by using a sliding window segmentation. After normalization of anomaly intensity, duration, propagation range, functional impact degree and safety margin loss, the samples are weighted and fused to obtain a window-level comprehensive risk score. The comprehensive risk score is divided into multiple risk levels according to a preset threshold, and a corresponding risk level label is assigned to each multi-level time series sample.

[0016] Furthermore, the node set of the multi-layer risk graph includes the physical operation layer node set, the vehicle communication layer node set, the control function layer node set, and the risk receptor layer node set; the edge set of the multi-layer risk graph includes the dynamic coupling edge within the physical operation layer, the statistical correlation edge within the vehicle communication layer, the functional dependency edge within the control function layer, the inter-layer mapping edge between the three layers, and the risk transmission edge from each layer to the risk receptor layer.

[0017] Furthermore, the risk receptor layer nodes may include lateral stability risk nodes, longitudinal collision risk nodes, trajectory deviation risk nodes, braking performance risk nodes, and control availability risk nodes; the risk receptor layer nodes are used to further map the abnormal effects of the network layer, control layer, and physical layer into vehicle risk characterization objects, directly serving subsequent multidimensional hazard analysis and event hazard level output.

[0018] Furthermore, node-level, edge-level, function-level, and vehicle-level risk representations are extracted using a graph risk representation learning model. Specific methods include:

[0019] Construct a risk graph sequence corresponding to a continuous event process, and extract the intermediate representation of the graph structure of each node at each time step through a heterogeneous graph message propagation mechanism;

[0020] The node representation sequence is temporally encoded by a gated cyclic unit to obtain a node-level temporal risk representation;

[0021] Edge-level risk representation is obtained by fusing node-level risk representation with edge features. Then, the risk representations of nodes and edges are hierarchically aggregated by aggregation operators to obtain functional-level risk representation and vehicle-level risk representation.

[0022] Furthermore, based on the obtained multi-level risk representations at the node, edge, function, and vehicle levels, risk propagation aggregation and abnormal event hazard assessment are performed on the vehicle. Specific methods include:

[0023] First, the risks of local nodes, edge propagation, and functional modules are quantified to form multi-level risk scores. Then, the multi-level risk scores are propagated and aggregated by combining inter-layer propagation relationships, functional criticality, and safety margin loss to construct a comprehensive hazard measurement of abnormal events. Finally, for the selected target abnormal pattern, hazard analysis is performed from multiple dimensions such as abnormal intensity, propagation and diffusion degree, functional impact degree, and safety margin loss degree. Based on the preset hazard level mapping rules, the hazard level, key risk contributing units, main impact dimensions, and affected functional areas of the abnormal event are output.

[0024] Furthermore, specific methods for constructing a comprehensive hazard measurement for abnormal events include:

[0025] The risk propagation weight between nodes is obtained by normalizing the edge propagation risk score, and the node comprehensive risk score is calculated by combining the node local risk score. The node comprehensive risk and edge propagation risk within the functional module are aggregated to obtain the functional module comprehensive risk score. The comprehensive hazard measure of abnormal events is obtained by weighting the comprehensive risk scores of each functional module, the functional criticality coefficient, and the vehicle-level safety margin loss.

[0026] Secondly, this invention also discloses a vehicle risk identification system for network-physical coupling anomalies, comprising: a data generation and annotation module, a risk graph construction and representation learning module, and a risk assessment and output module; wherein

[0027] The data generation and labeling module is used to acquire normal vehicle operation data and abnormal operation data, extract the hierarchical time series features of the physical operation layer, vehicle communication layer and control function layer, form normal and abnormal time series sample sets, and label the time series sample sets with risk levels in combination with multi-dimensional risk indicators.

[0028] The risk graph construction and representation learning module is used to construct a multi-layer risk graph, including a physical operation layer, an in-vehicle communication layer, a control function layer, and a risk receptor layer, based on the normal and abnormal time-series sample sets and their risk level labels. The module maps the node features, edge features, abnormal amplitude, latency mismatch information, and functional criticality information of each layer to the multi-layer risk graph. The module extracts node-level, edge-level, function-level, and vehicle-level risk representations through a graph risk representation learning model, and establishes the correlation between network layer anomalies, control layer anomalies, and physical response risks.

[0029] The risk assessment and output module is used to perform risk propagation aggregation and abnormal event hazard assessment on vehicles based on the obtained multi-level risk representations at the node, edge, function, and vehicle levels.

[0030] This invention provides a method and system for identifying vehicle risks oriented towards network-physical coupling anomalies, relating to the field of intelligent vehicle safety technology. The method includes acquiring normal and abnormal vehicle operation data; extracting hierarchical temporal features from the physical operation layer, vehicle communication layer, and control function layer to construct a temporal sample set; and combining this with multi-dimensional risk indicators to complete risk level labeling. Next, a multi-layer risk graph including a risk receptor layer is constructed, mapping nodes, edges, and multi-dimensional risk information. Then, a four-level risk representation is extracted through graph risk representation learning to establish cross-layer risk associations. Finally, risk propagation aggregation and abnormal event hazard assessment are conducted based on the multi-layer risk representation. This invention solves the problems of difficult modeling of cross-layer coupling between vehicle physical, network, and control layers and the difficulty in assessing multi-dimensional anomalies. It achieves comprehensive hazard assessment through multi-layer risk graphs and other technologies, providing quantitative support for intelligent vehicle safety early warning and protection decisions.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] 1. This invention achieves standardized construction and annotation of cross-layer coupled data. By combining multi-model co-simulation with attack and fault injection, synchronous time-series data covering the network, control, and physical layers is generated, solving the problems of scarce abnormal samples collected from real vehicles and data asynchrony between layers; the annotation system of multi-dimensional risk indicators provides a high-quality data foundation for subsequent supervised risk modeling.

[0033] 2. This invention constructs a unified cross-layer risk graph model including a risk receptor layer. For the first time, the physical operation layer, vehicle communication layer, control function layer, and risk receptor layer are incorporated into the same graph structure model. This not only depicts the coupling relationship between underlying signals but also establishes a mapping relationship from underlying anomalies to overall vehicle safety risks. It can intuitively present the cross-layer propagation path of anomalies and significantly improve the interpretability of risk assessment.

[0034] 3. This invention proposes a risk assessment mechanism that combines graph representation learning with propagation aggregation. By combining heterogeneous graph message propagation with temporal coding, it simultaneously captures the spatial structure propagation and temporal evolution of risks; by combining risk propagation aggregation with comprehensive hazard measurement, it achieves accurate quantification from local anomalies to overall vehicle hazard, with assessment accuracy significantly superior to traditional single-layer detection methods.

[0035] 4. This invention achieves event-level multidimensional hazard analysis and structured output. It conducts a comprehensive assessment of target anomaly patterns from four dimensions: anomaly intensity, propagation and diffusion, functional impact, and safety margin loss. The output includes hazard level, key risk units, impact dimensions, and affected areas. The results can directly support safety early warning, protection strategy generation, and operation and maintenance decisions, demonstrating strong engineering applicability. Attached Figure Description

[0036] Figure 1A flowchart illustrating a method for identifying vehicle risks based on network-physical coupling anomalies, provided in an embodiment of the present invention;

[0037] Figure 2 This is a flowchart illustrating an optional specific implementation method of step S100 in an embodiment of the present invention;

[0038] Figure 3 This is a flowchart illustrating an optional specific implementation method of step S200 in an embodiment of the present invention;

[0039] Figure 4 This is a flowchart illustrating an optional specific implementation method of step S300 in an embodiment of the present invention;

[0040] Figure 5 A structural block diagram of a vehicle risk identification system for network-physical coupling anomalies provided in an embodiment of the present invention;

[0041] Figure 6 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0042] To enable those skilled in the art to better understand the technical solutions of the present invention, exemplary embodiments of the present invention are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0043] Where there is no conflict, the various embodiments of the present invention and the features thereof may be combined with each other.

[0044] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0045] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used herein, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded. Terms such as “connected” or “linked” are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect.

[0046] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having the meaning consistent with their meaning in the context of the relevant art and the invention, and will not be interpreted as having an idealized or overly formal meaning unless expressly so defined herein.

[0047] In the technical solution of this invention, the collection, storage, use, processing, transmission, provision, and disclosure of user personal information all comply with relevant laws and regulations and do not violate public order and good morals. The use of user data in this technical solution follows relevant national laws and regulations (e.g., the "Information Security Technology - Personal Information Security Specification"). For example: appropriate measures are taken for personal information access control; restrictions are imposed on the display of personal information; the purpose of using personal information does not exceed the scope of direct or reasonable association; and explicit identity targeting is eliminated when using personal information to avoid precisely locating a specific individual.

[0048] In related technologies, a vehicle-mounted CAN bus intrusion detection system based on cross-protocol layer fusion has been disclosed. This system improves the accuracy of attack identification by fusing physical layer voltage characteristics and application layer message characteristics, and can detect network anomalies such as message spoofing and BusOff attacks. However, this solution only covers the network protocol layer and does not model the control layer or physical operation layer, making it completely unable to characterize the propagation and impact of network physical coupling anomalies. Furthermore, it only outputs binary or multi-class intrusion detection results and lacks capabilities such as risk propagation quantification, functional impact assessment, and security margin analysis, thus failing to support vehicle-level risk assessment and protection decisions.

[0049] To address at least one of the technical problems existing in the aforementioned related technologies, the present invention provides a method and system for identifying vehicle risks oriented towards network-physical coupling anomalies.

[0050] This implementation discloses a method for identifying vehicle risks oriented towards network-physical coupling anomalies, such as... Figure 1 ,include:

[0051] S100. Acquire normal vehicle operation data and abnormal operation data, extract the hierarchical time series features of the physical operation layer, vehicle communication layer and control function layer, form normal and abnormal time series sample sets, and label the risk level of the time series sample sets in combination with multi-dimensional risk indicators.

[0052] In this embodiment, normal operation data is generated based on the vehicle dynamics model, the vehicle communication model, the control function model, and parameters of multiple operating conditions. The specific method for generating normal operation data includes: synchronously driving the vehicle dynamics simulation unit, the vehicle communication simulation unit, and the control function simulation unit under a unified sampling period according to multiple sets of normal operating condition configuration parameters, generating a normal operation original time sequence covering the physical operation layer, the vehicle communication layer, and the control function layer; the normal operating condition configuration parameters include road adhesion coefficient, speed operating condition parameters, road curvature parameters, network load parameters, and controller operating parameters.

[0053] Specifically, such as Figure 2 First, a mechanism for generating normal operating sample data under multiple operating conditions and aligning multi-layer timing data is established. For different normal operating condition configuration parameters, under a unified system sampling period, the vehicle dynamics simulation unit, in-vehicle communication simulation unit, and control function simulation unit are driven to run synchronously to generate raw timing data covering the physical operation layer, in-vehicle communication layer, and control function layer. The normal operating condition configuration parameters characterize the normal operating mode of the vehicle system under different driving scenarios and operating states, and may include road adhesion conditions, target speed range, road curvature, traffic density, network load level, and controller operating parameters, etc.

[0054] The normal operating condition configuration parameters are:

[0055]

[0056] in, Indicates the road adhesion coefficient. Indicates speed operating parameters, This represents the road curvature parameter. Indicates network load parameters. Indicates the controller's operating parameters. For parameter groups.

[0057] The original time series sequence for normal operation is represented as follows:

[0058]

[0059] in, Indicates the sequence length. Indicates the first Time under normal operating conditions Multi-layered raw data items.

[0060] The original data item can be further represented as:

[0061] in, Represents the physical runtime layer data vector. Represents the data vector of the vehicle communication layer. This represents the data vector of the control function layer.

[0062] For the physical runtime layer data vector, it can be represented as:

[0063]

[0064] in, For the longitudinal speed of the vehicle, For the vehicle's lateral speed, Let yaw rate be the vehicle's angular velocity. For the longitudinal acceleration of the vehicle, For the vehicle's lateral acceleration, This refers to the steering angle of the front wheels.

[0065] For the data vector of the vehicle communication layer, it can be represented as:

[0066]

[0067] in, Indicates the first The average transmission cycle of key messages Indicates the first Periodic jitter statistics for key messages, No. The packet loss rate or error frame ratio of key messages.

[0068] The control function layer data vector can be represented as:

[0069]

[0070] in, , and These represent braking, steering, and drive control quantities, respectively.

[0071] The aforementioned multi-source time-series data undergoes synchronization alignment and standardization processing under a unified time benchmark. This results in a set of normal operating time-series data aligned with a unified time benchmark under different normal operating conditions, providing a normal baseline data foundation for subsequent anomaly sample construction, multi-layer time-series sample organization, and risk level labeling.

[0072] In this embodiment, abnormal operating data is constructed through a preset attack or fault injection method. The specific method for constructing abnormal operating data includes:

[0073] Construct a set of anomaly patterns that include communication layer anomalies, state anomalies, control layer anomalies, and cross-layer coupling anomalies. Select a target anomaly pattern and apply it to the original normal operation time sequence to generate an anomaly operation sequence.

[0074] The communication layer anomalies include message replay, message forgery, periodic drift, delay injection, sudden packet loss, denial of service, and message ambiguity disturbance; the state anomalies include sensor bias, asymptotic drift, random noise amplification, measurement distortion, and timing delay; the control layer anomalies include control command tampering, actuator delay, actuator gain variation, and control saturation; the cross-layer coupling anomalies include message anomalies causing control layer output anomalies, control layer anomalies causing physical response offsets, misalignment between sensing feedback and control output, and multi-layer timing asynchrony.

[0075] Specifically, this implementation introduces network attacks or system failure disturbances to construct abnormal operation samples, reflecting the coupling and propagation relationship between network layer anomalies, control layer anomalies, and physical operating state deviations. Anomaly time sequences are generated by combining communication layer anomalies, state anomalies, control layer anomalies, and cross-layer coupling anomalies.

[0076] Preferably, the set of abnormal patterns can be represented as:

[0077]

[0078] in, This represents a set of communication layer anomaly modes, which may include message replay, message forgery, periodic drift, delay injection, burst packet loss, denial of service, and message ambiguity perturbation, etc. This represents a set of abnormal state patterns, which may include sensor bias, asymptotic drift, random noise amplification, measurement distortion, and timing delay. This represents a set of abnormal control layer modes, which may include control command tampering, actuator delay, actuator gain variation, and control saturation, etc. This represents a set of cross-layer coupling anomaly modes, which may include message anomalies causing control layer output anomalies, control layer anomalies causing physical response offsets, misalignment between sensing feedback and control output, and multi-layer timing asynchrony, etc.

[0079] For any normal operating time sequence, construct an abnormal operating sequence:

[0080]

[0081] in, Indicates the selected exception mode. The abnormal injection parameters may include the abnormal start time, duration, abnormal intensity, level of action, and propagation delay, etc. Indicates based on the first Normal operating conditions in abnormal mode At the moment of action Abnormal data items, This represents the exception injection mapping function.

[0082] For communication layer anomalies, the message transmission delay under the influence of the anomaly can be expressed as:

[0083]

[0084] in, The message transmission delay after the abnormal action, This is the time delay disturbance term.

[0085] For the physical operation layer, bias disturbances, asymptotic drift, or noise amplification are introduced into the sensing and state measurement links to cause deviations in the vehicle's speed, acceleration, yaw rate, and position.

[0086] Preferably, the longitudinal velocity of the vehicle under abnormal action can be expressed as:

[0087]

[0088] in, The longitudinal speed of the vehicle under abnormal conditions. This refers to the velocity disturbance term. Lateral velocity, yaw rate, position, and attitude angles can also shift under abnormal conditions.

[0089] For the control function layer, introducing instruction tampering, execution lag, or abnormal control gain during the generation or execution of control instructions can cause inconsistencies between control output and execution feedback.

[0090] Preferably, the steering control command under abnormal action can be expressed as:

[0091]

[0092] in, This refers to the steering control input under abnormal conditions. To control disturbance terms. Braking control and drive control quantities can also deviate under abnormal conditions.

[0093] Meanwhile, considering the multi-layered coupling and propagation relationships, abnormal message delays at the communication layer can further cause delays in control command updates, leading to deviations in vehicle position updates and trajectory offsets. Abnormal commands at the control layer can further affect vehicle acceleration and yaw rate, thus influencing the vehicle's position evolution in the global coordinate system. Therefore, abnormal operational data manifests as a temporally coupled change process propagating sequentially along the communication layer, control layer, and physical operation layer.

[0094] In this embodiment, the multidimensional risk indicators include anomaly intensity, duration, propagation range, functional impact, and safety margin loss. The risk level of the time-series sample set is labeled using these multidimensional risk indicators. Specific methods include:

[0095] Normal operation sequences and abnormal operation sequences are uniformly time-aligned, and multi-level time series samples are obtained by using a sliding window segmentation. After normalization of anomaly intensity, duration, propagation range, functional impact degree and safety margin loss, the samples are weighted and fused to obtain a window-level comprehensive risk score. The comprehensive risk score is divided into multiple risk levels according to a preset threshold, and a corresponding risk level label is assigned to each multi-level time series sample.

[0096] Specifically, based on the above-mentioned normal and abnormal operating data, the multi-source time series information is uniformly time-aligned and windowed to construct multi-layer time series samples, and risk level labeling is completed by combining multi-dimensional abnormal features.

[0097] First, the multi-layer time series data is discretized using a fixed sampling period. The number of sampling points within the window is represented as follows:

[0098]

[0099] in, For a fixed sampling period, To analyze window length, The number of sampling points corresponding to each analysis window.

[0100] For any starting position of a time window, the multiple time series segments within that window are uniformly organized to form a multi-layer time series sample:

[0101]

[0102] in, For time A multi-layered timing window sample starting from [the specified point]. The sample contains consecutive timing segments of the physical operation layer, the vehicle communication layer, and the control function layer within the window.

[0103] The sample set consisting of normal operating time series sequences is as follows:

[0104]

[0105] The sample set consisting of abnormal runtime sequence is denoted as:

[0106]

[0107] The joint cross-layer time series sample set of normal and abnormal data is represented as follows:

[0108]

[0109] in, It serves as a training, validation, or evaluation sample base for subsequent multi-layer risk graph construction, graph risk representation learning, risk propagation aggregation, and abnormal event hazard assessment.

[0110] Furthermore, to achieve a unified measurement of different anomaly characteristics, the anomaly intensity, duration, propagation range, functional impact, and safety margin loss are normalized:

[0111]

[0112] in, It is of abnormal strength. For the duration of the abnormality, For abnormal propagation range, To the extent of functional impact, For safety margin loss, and These are the corresponding reference normalization factors.

[0113] By weighting and fusing the multidimensional normalized indicators, a comprehensive risk score for the sample window is obtained:

[0114]

[0115] in, For dimensionless comprehensive risk scoring, This is a dimensionless weighting coefficient.

[0116] Finally, based on the correspondence between risk scores and preset thresholds, the risk levels of the multi-level time series samples are classified. The risk level set is represented as follows:

[0117]

[0118] in, Indicates a normal state. Indicates low risk. Indicates medium risk. Indicates high risk. Indicates a dangerous situation.

[0119] The corresponding risk level label is:

[0120]

[0121] in, Thresholds for classifying risk levels, Indicates time window The corresponding time-series risk level.

[0122] Therefore, normal and abnormal samples are organized into a multi-layer time-series sample set with risk level labels to characterize the cross-layer coupling relationship between network layer anomalies, control layer anomalies and physical operating state.

[0123] Through the above steps, the construction of normal and abnormal datasets, the organization of multi-level time-series samples, and the generation of risk level labels are completed. Auxiliary annotation information such as abnormal amplitude, propagation range, functional impact degree, and safety margin loss are obtained, which serve as the input basis for subsequent multi-level risk graph construction, graph risk representation learning, risk propagation aggregation, and multi-dimensional hazard analysis of target abnormal patterns.

[0124] S200. Based on the normal and abnormal time-series sample sets and their risk level labels, construct a multi-layer risk graph including the physical operation layer, vehicle communication layer, control function layer, and risk receptor layer; map the node features, edge features, abnormal amplitude, delay mismatch information, and functional criticality information of each layer to the multi-layer risk graph; extract node-level, edge-level, function-level, and vehicle-level risk representations through a graph risk representation learning model; and establish the correlation between network layer anomalies, control layer anomalies, and physical response risks.

[0125] In this embodiment, the node set of the multi-layer risk graph includes the physical operation layer node set, the vehicle communication layer node set, the control function layer node set, and the risk recipient layer node set; the edge set of the multi-layer risk graph includes the dynamic coupling edge within the physical operation layer, the statistical correlation edge within the vehicle communication layer, the functional dependency edge within the control function layer, the inter-layer mapping edge between the three layers, and the risk transmission edge from each layer to the risk recipient layer.

[0126] In this embodiment, the risk receptor layer node may include lateral stability risk node, longitudinal collision risk node, trajectory deviation risk node, braking performance risk node, and control availability risk node; the risk receptor layer node is used to further map the abnormal effects of the network layer, control layer, and physical layer into a whole vehicle risk characterization object, directly serving the subsequent multidimensional hazard analysis and event hazard level output.

[0127] Specifically, such as Figure 3 First, a set of nodes and edges for a multi-layer risk graph is constructed. Based on the normal and abnormal time-series samples obtained in Example 1, a corresponding multi-layer risk graph is constructed:

[0128]

[0129] in, Represents a set of nodes. Denotes the set of edges. Indicates time window The feature set of the nodes below, Indicates time window The feature set of the edges below. The multi-layer risk graph is used to uniformly describe the coupling relationship between network layer anomalies, control layer anomalies and changes in physical operating state, as well as the propagation relationship of the impact of various anomalies on vehicle functional safety and operational risks.

[0130] The node set is:

[0131]

[0132] in, This represents the set of physical operation layer nodes, used to describe the vehicle's physical state and actuator response state; This represents the set of nodes in the vehicle communication layer, used to describe key messages, communication links, and network operating status. This represents the set of nodes in the control function layer, used to describe the states of braking control, steering control, drive control, and fusion functions. This represents the set of risk receptor layer nodes, used to describe risk receptor objects that are directly related to the safe operation of the entire vehicle.

[0133] Preferably, the risk receptor layer nodes may include lateral stability risk nodes, longitudinal collision risk nodes, trajectory deviation risk nodes, braking performance risk nodes, and control availability risk nodes. These risk receptor layer nodes are used to further map the abnormal effects of the network layer, control layer, and physical layer into vehicle risk characterization objects, directly serving subsequent multi-dimensional hazard analysis and event hazard level output.

[0134] The edge set is:

[0135]

[0136] in, This represents the dynamic coupling edge between variables within the physical runtime layer. This represents the statistical association edges between messages and nodes within the vehicle communication layer. This indicates the functional dependency edges between control function layer modules. This represents the inter-layer mapping edge between the physical operation layer, the vehicle communication layer, and the control function layer. This represents the risk propagation edge that transmits the influence of each layer's state to the risk recipient layer.

[0137] The basic relational attributes are:

[0138]

[0139] in, Represents a node With nodes The coupling type identifier between them can include various relationships such as message-driven control, physical response to control action, physical state feedback risk receptor, and risk receptor affected by control state. Indicates the total number of coupling types.

[0140] Then, the risk mapping construction of node features and edge features is completed. After the graph structure is completed, the time series features, abnormal amplitude, time delay mismatch information and functional criticality information obtained in Example 1 are further mapped to the nodes and edges in the graph to form a risk graph feature expression.

[0141] The node feature vector is:

[0142]

[0143] in, Represents a node At any moment The basic state characteristics are derived from the multi-layer time series samples constructed in Example 1; This indicates the abnormal amplitude of a node, reflecting the degree of deviation of the current node's state from the normal statistical baseline; Indicates the criticality of a node's function, used to characterize the importance of that node to the overall vehicle's operational safety; This represents the loss of node security margin, used to characterize the degree to which the current node state erodes the system's security boundary.

[0144] For abnormal node amplitudes, the normalized deviation of the node features from the mean and covariance of normal samples is used for calculation:

[0145]

[0146] in, Represents a node The mean vector in the normal sample set, This represents the corresponding covariance matrix. The above definition is used to uniformly quantify the degree of abnormal deviation of different types of nodes at the current time.

[0147] For risk receptor layer nodes, node characteristics are constructed by combining scenario risk indicators:

[0148]

[0149] in, This represents the metric corresponding to the risk receptor node, and can be selected as stability margin, collision margin, trajectory offset, or braking margin. This indicates the importance coefficient of the risk receptor. This indicates the loss of safety margin in the risk receptor layer.

[0150] The edge feature vector is:

[0151]

[0152] in, Indicates the coupling type of the edge. This represents the dynamic coupling strength of the edge. Represents a node With nodes The time delay mismatch between them This indicates the criticality of the edge propagation.

[0153] The dynamic coupling strength of an edge can be constructed based on the anomalous amplitudes of the two endpoints and the structural coupling relationship, and is expressed as:

[0154]

[0155] in, This is a constructor for edge coupling strength, used to characterize the level of activity in anomaly propagation on edges.

[0156] The delay mismatch of the edge is:

[0157]

[0158] in, Indicates time side The observation delay This represents the reference delay for this side under normal operating conditions. The delay mismatch is used to characterize the impact of anomalies on network-control-physical transmission.

[0159] The node feature set and the edge feature set are as follows:

[0160]

[0161] Thus, the time is completed. Multi-layer risk graph feature construction.

[0162] In this embodiment, node-level, edge-level, function-level, and vehicle-level risk representations are extracted using a graph risk representation learning model. The specific method includes:

[0163] Construct a risk graph sequence corresponding to a continuous event process, and extract the intermediate representation of the graph structure of each node at each time step through a heterogeneous graph message propagation mechanism;

[0164] The node representation sequence is temporally encoded by a gated cyclic unit to obtain a node-level temporal risk representation;

[0165] Edge-level risk representation is obtained by fusing node-level risk representation with edge features. Then, the risk representations of nodes and edges are hierarchically aggregated by aggregation operators to obtain functional-level risk representation and vehicle-level risk representation.

[0166] After obtaining the multi-layer risk map, graph risk representation learning is further performed on the risk map sequence within the continuous analysis segment to extract the multi-layer risk representation in the event process.

[0167] The multi-level risk diagram sequence is represented as follows:

[0168]

[0169] in, For the event process analysis window length, This represents a graph sequence sample used to characterize the evolution of network physical coupling risk within the analysis window.

[0170] The graph structure representation of nodes is extracted using a heterogeneous graph message passing mechanism. The message update process is as follows:

[0171]

[0172] in, For the first After layer message passing, the node The middle representation, Represents a set of edge relation types. Represents nodes By relation type The set of connected neighbor nodes, This indicates the risk propagation weight of adjacent nodes to the current node. and For the model parameter matrix, It is a non-linear activation function.

[0173] Through the above heterogeneous graph message passing, the risk representation of each time node on the graph structure can be extracted, and the process encoding of the representation sequence of each time node can be performed to describe the propagation and impact evolution of abnormal events in continuous analysis segments.

[0174] node The process risks are:

[0175]

[0176] in, Indicates a gated loop unit. Indicates the process Node representation after message passing in the layered graph This represents the node state at the previous time step.

[0177] After obtaining the node-level process risk representation, the edge-level risk representation can be further obtained.

[0178] side The risk is represented as:

[0179]

[0180] in, This is a mapping function for representing edge risk, used to fuse the process states and edge features of the nodes at both ends of an edge; and Representing nodes respectively and At any moment The risk representation of the node process; Represents a node and The feature vectors of the edges between them.

[0181] To support subsequent hazard assessment of abnormal events, nodes at different levels are further aggregated to obtain functional-level risk representations and vehicle-level risk representations.

[0182] For any level or subsystem, its functional-level risk can be represented as:

[0183]

[0184] in, Indicates belonging to a hierarchy or subsystem The set of nodes, The aggregation operator can be represented by mean pooling, weighted pooling, or attention pooling.

[0185] The risk representation of the entire vehicle at the event process can be expressed as follows:

[0186]

[0187] in, This represents the overall vehicle-level risk under the current analysis, used to comprehensively reflect the overall coupling state of network layer anomalies, control layer anomalies, and physical layer risks.

[0188] (4) Finally, a multi-layered risk representation output is generated, providing input for subsequent risk propagation aggregation, construction of comprehensive hazard measurement for abnormal events, and hazard analysis of target abnormal patterns. Based on the above graph risk representation learning process, the final multi-layered risk representations at the node level, edge level, function level, and vehicle level are obtained, denoted as follows:

[0189]

[0190] in, Indicates a functional hierarchy or set of subsystems. Indicates time Alternatively, it can analyze the multi-layered risk representation within a segment and output the results.

[0191] The node-level risk representation reflects local anomalies and their propagation impact within the graph structure; the edge-level risk representation reflects the activity level of anomaly propagation along structural relationships; the function-level risk representation reflects the risk intensity borne by different functional modules; and the vehicle-level risk representation reflects the comprehensive impact of the current anomaly on the overall vehicle operational safety. These multi-layered risk representations will serve as the foundational inputs for subsequent steps, including risk propagation aggregation, construction of comprehensive hazard measurement for anomalies, and multi-dimensional hazard analysis of anomaly intensity, propagation extent, functional impact, and safety margin loss for target anomaly patterns.

[0192] In summary, based on the above steps, the construction of a multi-layer risk graph and the graph risk representation learning process were completed. This enabled a unified graph structure representation and event process representation extraction of risk states at the network layer, control layer, physical layer, and risk receptor layer, providing a foundation for the assessment of abnormal event hazards in subsequent steps.

[0193] S300. Based on the obtained multi-level risk representations at the node, edge, function, and vehicle levels, risk propagation aggregation and abnormal event hazard assessment are performed on the vehicle.

[0194] In this embodiment, based on the obtained multi-level risk representations at the node, edge, function, and vehicle levels, risk propagation aggregation and abnormal event hazard assessment are performed on the vehicle. Specific methods include:

[0195] First, the risks of local nodes, edge propagation, and functional modules are quantified to form multi-level risk scores. Then, the multi-level risk scores are propagated and aggregated by combining inter-layer propagation relationships, functional criticality, and safety margin loss to construct a comprehensive hazard measurement of abnormal events. Finally, for the selected target abnormal pattern, hazard analysis is performed from multiple dimensions such as abnormal intensity, propagation and diffusion degree, functional impact degree, and safety margin loss degree. Based on the preset hazard level mapping rules, the hazard level, key risk contributing units, main impact dimensions, and affected functional areas of the abnormal event are output.

[0196] In this embodiment, the specific method for constructing a comprehensive hazard measurement of abnormal events includes:

[0197] The risk propagation weights between nodes are obtained by normalizing the edge propagation risk score, and the comprehensive risk score of a node is calculated by combining the local risk score of the node. The comprehensive risk of nodes and edge propagation risk within a functional module are aggregated to obtain the comprehensive risk score of the functional module. Risk propagation aggregation and abnormal event hazard assessment are then performed by combining the comprehensive risk scores of each functional module, the functional criticality coefficient, and the multi-level risk representation of the whole vehicle based on S200 at the node, edge, functional, and whole vehicle levels. This step first quantifies the local risk of nodes, edge propagation risk, and functional module risk to form multi-level risk scores. Then, combining the inter-level propagation relationship, functional criticality, and safety margin loss, the multi-level risk scores are propagated and aggregated to construct a comprehensive hazard metric for abnormal events. Finally, for the target abnormal pattern selected in step S1, hazard analysis is performed from multiple dimensions, including abnormality intensity, propagation and diffusion degree, functional impact degree, and safety margin loss degree. Based on the preset hazard level mapping rules, the hazard level, key risk contributing units, main impact dimensions, and affected functional areas of the abnormal event are output. The specific process is as follows: Figure 4 As shown, it includes:

[0198] First, calculate the local risk score of nodes, the risk score of edge propagation, and the risk score of functional modules. Based on the multi-layer risk representation obtained from S200, first quantify the risk status of each layer of nodes, each layer of edges, and each functional module.

[0199] Any node The local risk score is:

[0200]

[0201] in, Represents a node Node-level risk representation under analysis fragments Indicates the criticality of a node's function. Indicates the loss of node safety margin. This represents the node risk quantification function. The node local risk score is used to characterize the comprehensive result of the node's abnormal state, functional importance, and degree of loss of safety margin.

[0202] either side The transmission risk score is:

[0203]

[0204] in, Representing an edge The representation of boundary-level risk under the analysis segment Indicates the criticality of edge propagation. This represents the time delay mismatch corresponding to the edge. This represents the edge risk quantification function. The propagation risk score is used to characterize the degree of risk propagation activity and intensity in structural relationships, and the extent to which it is affected by temporal misalignment.

[0205] Any functional module The risk score is:

[0206]

[0207] in, Indicates functional modules Functional-level risk representation under analysis fragments Indicates the criticality of a functional module. This indicates the loss of safety margin for the functional module. This represents the risk quantification function for a functional module. The risk score of a functional module is used to comprehensively reflect the overall risk posed to that module by abnormal communication behavior, abnormal control output, and abnormal physical response related to that module.

[0208] Preferably, the node risk quantification function, edge risk quantification function, and functional module risk quantification function can be constructed using linear mapping, weighted norm mapping, or multi-layer perception mapping.

[0209] For one possible implementation, the local risk score of a node can be expressed as:

[0210]

[0211] The side-propagation risk score can be expressed as:

[0212]

[0213] The risk score for a functional module can be expressed as:

[0214]

[0215] in, These are non-negative weight parameters.

[0216] Then, risk propagation aggregation is performed based on inter-layer propagation relationships to construct a comprehensive hazard measurement for abnormal events. After obtaining the local risk score of nodes, the edge propagation risk score, and the functional module risk score, the propagation and convergence process of risks across layers is further considered. To reflect the diffusion effect of risks along the graph structure, the edge propagation risk score is first normalized to obtain the risk propagation weights between nodes:

[0217]

[0218] in, Indicates pointing to a node The set of adjacent nodes, To prevent tiny positive numbers with a denominator of zero, Indicates within the time window The risk is caused by the node To the node Normalized weights for propagation.

[0219] Any node The aggregated node risk can be represented as:

[0220]

[0221] in, Represents a node The overall node risk score is calculated after considering the risk propagation effect of adjacent nodes. This quantity reflects the cumulative effect of local anomalies in intra-layer propagation, inter-layer mapping, and functional dependencies.

[0222] For any functional module, the overall risk of nodes within the module, the risk of edge propagation within the module, and the risk of the module itself are aggregated to obtain the overall risk score of the functional module:

[0223] in, This indicates that it belongs to a functional module. The set of nodes, This indicates that it belongs to a functional module. The set of edges, Represents the aggregation operator, These are non-negative weighting parameters. The comprehensive risk score of the functional module is used to reflect the overall risk level borne by a single functional module within the current analysis segment.

[0224] Furthermore, by combining the comprehensive risks of each functional module with the loss of vehicle-level safety margin, a comprehensive hazard measurement for abnormal events is constructed:

[0225]

[0226] in, Represents a collection of functional modules. Indicates functional modules Keyness coefficient, This indicates that the whole vehicle is in the analysis segment. The overall safety margin loss, These are non-negative weight parameters. This represents the overall hazard measure of an abnormal event.

[0227] Preferably, the overall safety margin loss of the vehicle It can be obtained by aggregating the safety margin loss corresponding to the risk receptor layer node:

[0228]

[0229] in, Represents the set of risk receptor layer nodes. Indicates risk receptor node The loss of safety margin.

[0230] Therefore, the comprehensive hazard measurement of abnormal events simultaneously considers the intensity of local risk, cross-layer propagation effect, degree of functional criticality, and the degradation result of the vehicle safety boundary, and can uniformly reflect the comprehensive impact of network physical coupling anomalies on the operational safety of the vehicle.

[0231] Furthermore, for the target anomaly pattern selected in step S1, based on the above-mentioned comprehensive hazard measurement of anomalies and multi-layer risk scores, a hazard analysis is carried out from four dimensions: anomaly intensity, degree of propagation and diffusion, degree of functional impact, and degree of loss of safety margin, and the hazard level of the safety event corresponding to the target anomaly pattern is output.

[0232] The anomaly intensity dimension is used to characterize the local risk level of the target anomaly pattern on relevant nodes and functional modules, and can be expressed as:

[0233]

[0234] in, Indicates the abnormal pattern of the target The set of associated nodes, Indicates the target anomaly pattern in the analysis segment The score for the anomaly intensity dimension.

[0235] The propagation and diffusion dimension is used to characterize the scope and activity of the outward propagation of the target anomaly pattern along edge relationships and inter-layer mapping paths, and can be expressed as:

[0236]

[0237] in, Indicates the abnormal pattern of the target The set of edges related to the propagation path Indicates the target anomaly pattern in the analysis segment The score for the propagation and diffusion dimension.

[0238] The functional impact dimension is used to characterize the degree of influence of the target anomaly pattern on key functional modules, and can be expressed as:

[0239]

[0240] in, Indicates the target abnormal pattern The set of functional modules affected Indicates the target anomaly pattern in the analysis segment The following functions affect the dimension score.

[0241] The safety margin loss dimension is used to characterize the degree to which the target anomalous mode erodes the vehicle's operational safety boundary, and can be expressed as:

[0242]

[0243] in, Indicates the target anomaly pattern in the analysis segment The score for the safety margin loss dimension.

[0244] The four dimensions mentioned above are weighted and fused to obtain the comprehensive hazard score corresponding to the target abnormal pattern:

[0245]

[0246] in, Indicates the target abnormal pattern In analyzing fragments The overall hazard score is as follows: These are non-negative weighting coefficients, and the sum of the coefficients is 1.

[0247] Based on the correspondence between the comprehensive hazard score and the preset hazard level threshold, the hazard level of the safety event corresponding to the target abnormal pattern is output.

[0248] The hazard level is used to characterize the overall hazard level of the safety event corresponding to the target abnormal pattern in the current analysis segment. The hazard level classification rule can adopt the same classification method as the risk level labeling in S100, or be set independently according to the hazard assessment requirements of the abnormal event.

[0249] The risk contribution of each node is calculated based on its comprehensive risk score, and key risk-contributing nodes are identified. The risk contribution can be expressed as:

[0250]

[0251] in, Represents a node The proportion of contribution to the overall harm of the current abnormal event. Preferably, select the one that satisfies... The nodes are considered as a set of key risk-contributing nodes.

[0252] For functional modules Whether a function falls under the affected functional area can be determined based on the comprehensive risk score of the functional module, as shown below:

[0253]

[0254] in, The threshold for determining whether a functional module is affected. Indicates within the time window The set of affected functional areas. The affected functional areas may include the steering control functional area, braking control functional area, drive control functional area, fusion perception functional area, or other functional areas closely related to the safety of vehicle operation.

[0255] The main influencing dimensions of the target anomaly pattern are determined based on the magnitude relationship of the scores across the four dimensions. Preferably, the following conditions are met:

[0256]

[0257] Corresponding dimensions As the main influencing dimension of the current target anomaly pattern.

[0258] Based on the above risk propagation aggregation and level mapping process, this embodiment ultimately outputs the following abnormal event hazard assessment results: the hazard level of the safety event corresponding to the target abnormal pattern; and the set of key risk contributing nodes. Main influencing dimensions Affected functional area set .

[0259] The hazard level is used to characterize the overall hazard level of the security event corresponding to the target anomaly pattern; the key risk contribution unit is used to characterize the key structural unit that has a significant impact on the current anomaly event; the main influence dimension is used to characterize the most prominent manifestation direction of the current hazard of the target anomaly pattern; and the affected functional area is used to characterize the range of functional domains that are significantly affected by the current anomaly event.

[0260] In summary, based on the above, step S3 completed the risk propagation aggregation, the construction of comprehensive hazard measurement for abnormal events, and the multi-dimensional hazard analysis process for target abnormal patterns. It achieved a unified aggregation from local node risks, edge propagation risks, and functional module risks to the overall hazard of abnormal events. Furthermore, it output the hazard level, key risk contributing units, main impact dimensions, and affected functional areas of the security events corresponding to the target abnormal patterns. This provides a quantitative basis for risk identification, hazard assessment, early warning, and protection decisions for abnormal physical coupling in intelligent vehicle networks.

[0261] This invention provides a method for identifying vehicle risks oriented towards network-physical coupling anomalies. The method includes acquiring normal and abnormal vehicle operation data, extracting hierarchical temporal features from the physical operation layer, vehicle communication layer, and control function layer to construct a temporal sample set, and combining this with multi-dimensional risk indicators to complete risk level labeling. Next, a multi-layer risk graph including a risk receptor layer is constructed. After mapping nodes, edges, and multi-dimensional risk information, a four-level risk representation is extracted through graph risk representation learning to establish cross-layer risk associations. Finally, risk propagation aggregation and anomaly event hazard assessment are conducted based on the multi-layer risk representation. This invention solves the problems of difficult modeling of cross-layer coupling between vehicle physical, network, and control layers and the difficulty in assessing multi-dimensional anomalies. It achieves comprehensive hazard assessment through multi-layer risk graphs and other technologies, providing quantitative support for intelligent vehicle safety early warning and protection decisions.

[0262] Based on the same inventive concept, embodiments of the present invention also provide a vehicle risk identification system for network-physical coupling anomalies, such as... Figure 5 It includes: a data generation and annotation module, a risk map construction and representation learning module, and a risk assessment and output module; among which...

[0263] The data generation and labeling module is used to acquire normal vehicle operation data and abnormal operation data, extract the hierarchical time series features of the physical operation layer, vehicle communication layer and control function layer, form normal and abnormal time series sample sets, and label the time series sample sets with risk levels in combination with multi-dimensional risk indicators.

[0264] The risk graph construction and representation learning module is used to construct a multi-layer risk graph, including a physical operation layer, an in-vehicle communication layer, a control function layer, and a risk receptor layer, based on the normal and abnormal time-series sample sets and their risk level labels. The module maps the node features, edge features, abnormal amplitude, latency mismatch information, and functional criticality information of each layer to the multi-layer risk graph. The module extracts node-level, edge-level, function-level, and vehicle-level risk representations through a graph risk representation learning model, and establishes the correlation between network layer anomalies, control layer anomalies, and physical response risks.

[0265] The risk assessment and output module is used to perform risk propagation aggregation and abnormal event hazard assessment on vehicles based on the obtained multi-level risk representations at the node, edge, function, and vehicle levels.

[0266] The specific working methods of the data generation and annotation module, the risk graph construction and representation learning module, and the risk assessment and output module have been described in detail in the above-mentioned method for identifying vehicle risks in the context of network-physical coupling anomalies, and will not be repeated here.

[0267] Based on the same inventive concept, embodiments of the present invention also provide an electronic device. Figure 6 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Figure 6As shown, an embodiment of the present invention provides an electronic device including: one or more processors 101, a memory 102, and one or more I / O interfaces 103. The memory 102 stores one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement any of the methods described in the above embodiments; the one or more I / O interfaces 103 are connected between the processor and the memory, configured to enable information interaction between the processor and the memory.

[0268] The processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read / write interface) 103 is connected between the processor 101 and the memory 102, and can realize information interaction between the processor 101 and the memory 102, including but not limited to a data bus (Bus).

[0269] In some embodiments, the processor 101, memory 102, and I / O interface 103 are interconnected via bus 104, and thus connected to other components of the computing device.

[0270] In some embodiments, the one or more processors 101 include a field-programmable gate array.

[0271] This invention also provides a computer-readable medium. The computer-readable medium stores a computer program, which, when executed by a processor, implements the steps of any of the methods described in the above embodiments. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium.

[0272] This invention also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in the processor of an electronic device, the processor in the electronic device executes the above-described method.

[0273] Those skilled in the art will understand that all or some of the steps, systems, and apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software can be distributed on a computer-readable storage medium, which may include computer storage media (or non-transitory media) and communication media (or transient media).

[0274] As is known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable program instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technologies, portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, it is known to those skilled in the art that communication media typically contain computer-readable program instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0275] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0276] The computer program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing state information from the computer-readable program instructions. This electronic circuitry can execute the computer-readable program instructions to implement various aspects of the invention.

[0277] The computer program product described herein can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0278] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0279] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0280] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0281] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0282] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A method for identifying vehicle risks based on network-physical coupling anomalies, characterized in that, include: Acquire normal and abnormal vehicle operation data, extract hierarchical time-series features from the physical operation layer, vehicle communication layer, and control function layer to form normal and abnormal time-series sample sets, and label the risk level of the time-series sample sets with multi-dimensional risk indicators. Based on the normal and abnormal time-series sample sets and their risk level labels, a multi-layer risk graph is constructed, including the physical operation layer, vehicle communication layer, control function layer, and risk receptor layer. The node features, edge features, abnormal amplitude, latency mismatch information, and functional criticality information of each layer are mapped to the multi-layer risk graph. The node-level, edge-level, function-level, and vehicle-level risk representations are extracted through a graph risk representation learning model, and the correlation between network layer anomalies, control layer anomalies, and physical response risks is established. Based on the obtained multi-level risk representations at the node, edge, function, and vehicle levels, risk propagation aggregation and abnormal event hazard assessment are performed on the vehicle.

2. The identification method according to claim 1, characterized in that, Normal operation data is generated based on vehicle dynamics model, vehicle communication model, control function model and parameters of multiple operating conditions. The specific method for generating normal operation data includes: according to multiple sets of normal operating condition configuration parameters, driving the vehicle dynamics simulation unit, vehicle communication simulation unit and control function simulation unit to run synchronously under a unified sampling period, generating the original time sequence of normal operation covering the physical operation layer, vehicle communication layer and control function layer; the normal operating condition configuration parameters include road adhesion coefficient, speed operating condition parameters, road curvature parameters, network load parameters and controller operating parameters.

3. The identification method according to claim 1, characterized in that, Abnormal operational data is constructed by means of a preset attack or fault injection method. The specific method for constructing abnormal operational data includes: Construct a set of anomaly patterns that include communication layer anomalies, state anomalies, control layer anomalies, and cross-layer coupling anomalies. Select a target anomaly pattern and apply it to the original normal operation time sequence to generate an anomaly operation sequence. The communication layer anomalies include message replay, message forgery, periodic drift, delay injection, sudden packet loss, denial of service, and message ambiguity disturbance; the state anomalies include sensor bias, asymptotic drift, random noise amplification, measurement distortion, and timing delay; the control layer anomalies include control command tampering, actuator delay, actuator gain variation, and control saturation; the cross-layer coupling anomalies include message anomalies causing control layer output anomalies, control layer anomalies causing physical response offsets, misalignment between sensing feedback and control output, and multi-layer timing asynchrony.

4. The identification method according to claim 1, characterized in that, The multidimensional risk indicators include anomaly intensity, duration, propagation range, functional impact, and safety margin loss. The time-series sample set is labeled with risk levels using these multidimensional risk indicators. Specific methods include: Normal operation sequences and abnormal operation sequences are uniformly time-aligned, and multi-level time series samples are obtained by using a sliding window segmentation. After normalization of anomaly intensity, duration, propagation range, functional impact degree and safety margin loss, the samples are weighted and fused to obtain a window-level comprehensive risk score. The comprehensive risk score is divided into multiple risk levels according to a preset threshold, and a corresponding risk level label is assigned to each multi-level time series sample.

5. The identification method according to claim 1, characterized in that, The node set of the multi-layer risk graph includes the physical operation layer node set, the vehicle communication layer node set, the control function layer node set, and the risk receptor layer node set; the edge set of the multi-layer risk graph includes the dynamic coupling edge within the physical operation layer, the statistical correlation edge within the vehicle communication layer, the functional dependency edge within the control function layer, the inter-layer mapping edge between the three layers, and the risk transmission edge from each layer to the risk receptor layer.

6. The identification method according to claim 1, characterized in that, The risk receptor layer nodes may include lateral stability risk nodes, longitudinal collision risk nodes, trajectory deviation risk nodes, braking performance risk nodes, and control availability risk nodes; the risk receptor layer nodes are used to further map the abnormal effects of the network layer, control layer, and physical layer into vehicle risk characterization objects, directly serving subsequent multidimensional hazard analysis and event hazard level output.

7. The identification method according to claim 1, characterized in that, The graph risk representation learning model extracts node-level, edge-level, function-level, and vehicle-level risk representations. Specific methods include: Construct a risk graph sequence corresponding to a continuous event process, and extract the intermediate representation of the graph structure of each node at each time step through a heterogeneous graph message propagation mechanism; The node representation sequence is temporally encoded by a gated cyclic unit to obtain a node-level temporal risk representation; Edge-level risk representation is obtained by fusing node-level risk representation with edge features. Then, the risk representations of nodes and edges are hierarchically aggregated by aggregation operators to obtain functional-level risk representation and vehicle-level risk representation.

8. The identification method according to claim 1, characterized in that, Based on the obtained multi-level risk representations at the node, edge, function, and vehicle levels, risk propagation aggregation and abnormal event hazard assessment are performed on vehicles. Specific methods include: First, the risks of local nodes, edge propagation, and functional modules are quantified to form multi-level risk scores. Then, the multi-level risk scores are propagated and aggregated by combining inter-layer propagation relationships, functional criticality, and safety margin loss to construct a comprehensive hazard measurement of abnormal events. Finally, for the selected target abnormal pattern, hazard analysis is performed from multiple dimensions such as abnormal intensity, propagation and diffusion degree, functional impact degree, and safety margin loss degree. Based on the preset hazard level mapping rules, the hazard level, key risk contributing units, main impact dimensions, and affected functional areas of the abnormal event are output.

9. The identification method according to claim 8, characterized in that, Specific methods for constructing a comprehensive hazard measurement for abnormal events include: The risk propagation weight between nodes is obtained by normalizing the edge propagation risk score, and the node comprehensive risk score is calculated by combining the node local risk score. The node comprehensive risk and edge propagation risk within the functional module are aggregated to obtain the functional module comprehensive risk score. The comprehensive hazard measure of abnormal events is obtained by weighting the comprehensive risk scores of each functional module, the functional criticality coefficient, and the vehicle-level safety margin loss.

10. A vehicle risk identification system for network-physical coupling anomalies, employing the identification method described in any one of claims 1-9, characterized in that, include: The module includes data generation and annotation, risk map construction and representation learning, and risk assessment and output. in The data generation and labeling module is used to acquire normal vehicle operation data and abnormal operation data, extract the hierarchical time series features of the physical operation layer, vehicle communication layer and control function layer, form normal and abnormal time series sample sets, and label the time series sample sets with risk levels in combination with multi-dimensional risk indicators. The risk graph construction and representation learning module is used to construct a multi-layer risk graph, including a physical operation layer, an in-vehicle communication layer, a control function layer, and a risk receptor layer, based on the normal and abnormal time-series sample sets and their risk level labels. The module maps the node features, edge features, abnormal amplitude, latency mismatch information, and functional criticality information of each layer to the multi-layer risk graph. The module extracts node-level, edge-level, function-level, and vehicle-level risk representations through a graph risk representation learning model, and establishes the correlation between network layer anomalies, control layer anomalies, and physical response risks. The risk assessment and output module is used to perform risk propagation aggregation and abnormal event hazard assessment on vehicles based on the obtained multi-level risk representations at the node, edge, function, and vehicle levels.

Images