Attack identification method and related apparatus

Abstract

The application provides an attack identification method and related device, and relates to the technical field of vehicle safety. The attack identification method can include: determining first motion state data of a vehicle at a current time according to a preset vehicle physical model and motion state data of the vehicle at a previous time; determining second motion state data of an external target at the current time according to a preset motion model and trusted motion state data of the external target at the previous time; determining third motion state data of the external target relative to the vehicle according to the first motion state data and the second motion state data; determining fourth motion state data of the external target relative to the vehicle at the current time based on actual perception data; comparing the third motion state data and the fourth motion state data at the same time, and determining whether the vehicle perception system is attacked based on a comparison result. The technical scheme provided by the application can solve the problem that the effectiveness of the attack identification method in the prior art needs to be improved.

Description

Technical Field

[0001] This application relates to the field of vehicle driving safety technology, and more specifically, to an attack identification method and related device. Background Technology

[0002] With the deep integration of vehicle intelligence and connectivity, intelligent driving vehicles generally adopt multi-sensor fusion solutions, integrating various heterogeneous sensors such as cameras, LiDAR, millimeter-wave radar, global navigation satellite systems, and inertial measurement units. By fusing redundant and complementary information acquired by these sensors under different physical dimensions and operating principles, the system can build a robust, beyond-line-of-sight, all-weather perception of the surrounding environment, which is the fundamental prerequisite for subsequent vehicle decision-making and control. However, this high dependence on external information also brings unprecedented information security attack surfaces to vehicles. The perception system, as the "eyes" and "ears" of the vehicle's interaction with the physical world, has become a key entry point for malicious attackers to carry out cyber-physical attacks, especially data deception attacks, which pose the most direct and serious threat. Attackers can inject carefully crafted false data to make the system produce erroneous perception results, thereby affecting driving safety.

[0003] To address these threats, anomaly detection methods based on cross-sensor data consistency verification have been developed. These methods project observations of the same physical entity from different sensors onto a unified coordinate system and identify anomalies by comparing whether they meet preset geometric or kinematic constraints in dimensions such as spatial location and motion state.

[0004] However, when attackers carry out elaborate collaborative deception attacks, causing multiple sensors to simultaneously output false scenarios with internally consistent logic, this result comparison-based mechanism will fail due to the lack of objective external references. Summary of the Invention

[0005] Based on the defects and shortcomings of the prior art, this application proposes an attack identification method and related apparatus, which can solve the problem that the effectiveness of existing data deception attack identification methods needs to be improved.

[0006] According to a first aspect of the embodiments of this application, an attack identification method is provided, the method comprising: Based on the preset vehicle physical model and the vehicle's motion state data at the previous moment, determine the vehicle's first motion state data in the world coordinate system at the current moment; Based on the preset motion model and the reliable motion state data of the external target at the previous moment, determine the second motion state data of the external target in the world coordinate system at the current moment; Based on the first motion state data and the second motion state data, a third motion state data of the external target relative to the vehicle is determined; Based on the actual perception data obtained by the perception sensors on the vehicle, the fourth motion state data of the external target relative to the vehicle at the current moment is determined; The third motion state data at the same time is compared with the fourth motion state data, and the vehicle's perception system is determined based on the comparison result.

[0007] According to a second aspect of the embodiments of this application, an attack identification device is provided, the device comprising: The first determining module is used to determine the first motion state data of the vehicle in the world coordinate system at the current moment based on the preset vehicle physical model and the motion state data of the vehicle at the previous moment. The second determining module is used to determine the second motion state data of the external target in the world coordinate system at the current moment based on the preset motion model and the reliable motion state data of the external target at the previous moment. The third determining module is used to determine the third motion state data of the external target relative to the vehicle based on the first motion state data and the second motion state data. The fourth determining module is used to determine the fourth motion state data of the external target relative to the vehicle at the current moment based on the actual perception data obtained by the perception sensors on the vehicle. The detection module is used to compare the third motion state data at the same time with the fourth motion state data, and determine whether the vehicle's perception system has been attacked based on the comparison result.

[0008] According to a third aspect of the embodiments of this application, an electronic device is provided, including: a memory and a processor; The memory is connected to the processor and is used to store programs; The processor is used to implement the attack identification method as described in the first aspect by running the program in the memory.

[0009] According to a fourth aspect of the embodiments of this application, a storage medium is provided, on which a computer program is stored, and when the computer program is run by a processor, it implements the attack identification method as described in the first aspect.

[0010] According to a fifth aspect of the embodiments of this application, a computer program product or a computer program is provided, the computer program product including the computer program, wherein when a processor executes the computer program, it implements the steps in the attack identification method as described in the first aspect.

[0011] Beneficial effects: The technical solution provided in this application can provide a verification benchmark for the perception system that is independent of all external environment sensors, based on vehicle motion state data with high reliability and resistance to external deception. Specifically, it determines the first motion state data of the vehicle in the world coordinate system at the current moment based on the vehicle's physical model and the vehicle's motion state data at the previous moment, and determines the second motion state data of the external target in the world coordinate system at the current moment based on a preset motion model and the reliable motion state data of the external target at the previous moment. Since both the first and second motion state data are in the same world coordinate system, the third motion state data of the external target relative to the vehicle can be determined based on their relationship in the world coordinate system. Furthermore, since both the first and second motion state data are reliable data, the third motion state data can serve as the expected motion state baseline of the external target. Then, the third motion state data is compared with the fourth motion state data of the external target relative to the vehicle at the current moment, determined based on the actual perception data obtained from the perception sensors on the vehicle, to detect whether the external environment sensors have been attacked. For example, if the perceived state data of an external target deviates significantly from the expected motion state baseline, it indicates a problem with the perceived state data of the external target, and the perception system is more likely to be attacked. The technical solution provided in this application is not limited to simple perception data correlation; it can effectively detect cooperative deception attacks that violate the physical motion laws of the vehicle even if the geometric consistency between sensors is satisfied, thus improving the accuracy and effectiveness of attack identification. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of an attack identification method provided in an embodiment of this application.

[0014] Figure 2 This is a block diagram of an attack identification system provided in an embodiment of this application.

[0015] Figure 3 This is a schematic diagram of data output from a status acquisition module provided in an embodiment of this application.

[0016] Figure 4 This is a block diagram of an attack identification device provided in an embodiment of this application.

[0017] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] Application Overview Attacks on intelligent driving perception systems are becoming increasingly sophisticated and covert, with data spoofing attacks posing the most direct and serious threat to driving safety because they can directly mislead system decisions. Unlike simple signal jamming or replay attacks, spoofing attacks inject carefully crafted, false but legally formatted malicious data into sensors, aiming to make the perception system believe it to be genuine, thereby generating incorrect perception results. For example, adversarial sample attacks at the visual level can cause cameras to identify normal road signs as stop signs, or spoofed Global Positioning System (GPS) signals can cause vehicles to deviate from their intended navigation routes. Early defense strategies mainly focused on anomaly detection within a single sensor channel, such as analyzing the statistical characteristics of image signals to detect adversarial perturbations, or monitoring the physical layer parameters of Global Navigation Satellite System (GNSS) signals to identify spoofed signal sources. These methods are effective in dealing with simple, isolated attacks, but their limitations are also quite obvious: on the one hand, as attack techniques evolve, attackers can generate deceptive data that is highly similar to real signals in terms of underlying characteristics, thus easily bypassing these shallow detection mechanisms; on the other hand, single-point defense cannot deal with coordinated attacks across multiple sensor domains. Attackers may simultaneously perform small but coordinated deceptions on cameras and lidar, making the data from each sensor seem reasonable to itself, but when fused together, they point to a dangerous phantom target.

[0020] To overcome the limitations of single-point defense, technological development has entered a stage centered on cross-sensor data consistency verification. The core idea of ​​this type of method is to utilize the principle that observations of the same physical entity by different sensors should satisfy specific geometric or kinematic constraints. For example, a vehicle detected by a camera should also have a corresponding 3D contour in the lidar point cloud, and the position, size, velocity, and other state variables of both should be highly consistent in the spatial coordinate system. This type of technology, by establishing association rules and consistency models at the data level, can, to a certain extent, identify forged data that contradicts the common sense of the physical world.

[0021] However, existing consistency verification methods still suffer from deep-seated technical bottlenecks. They employ a passive, result-comparison-based verification model, relying on synchronous observations from other sensors as a benchmark when determining the credibility of perceived data. This mechanism places the entire security verification system within a relative reference frame, enabling it to detect internal inconsistencies between different sensors. However, when a carefully crafted, coordinated attack that simultaneously satisfies basic geometric constraints can induce a false consensus among all relevant sensors with internally consistent logic, the system loses its ability to discriminate. This is because the false scenario created by the attacker is plausible within its verification logic, making it difficult to fundamentally guarantee the final credibility of the fused perception.

[0022] To address the aforementioned technical problems, this application provides a technical solution for identifying data deception attacks. This solution determines first motion state data based on a vehicle physical model and the vehicle's previous motion state data, predicts second motion state data based on reliable motion state data of an external target, and then generates third motion state data of the external target relative to the vehicle, serving as a baseline for the current motion state. The third motion state data is then compared with fourth motion state data of the external target determined based on actual perception data to detect whether the vehicle's perception system has been attacked. This constructs a prediction and verification mechanism independent of all external environmental sensors, transforming security verification from passive cross-sensor comparison to active physical law verification. When an attacker launches a coordinated attack, causing multiple sensors such as cameras and lidar to simultaneously output a false scene with internally consistent logic, if the state of the external target contradicts this physical prediction, the deception attack can be identified. This effectively defends against deeper attacks that are difficult to achieve with traditional methods, fundamentally changing the passive defense mode of existing technologies that rely on comparison results between different sensors to identify deception attacks.

[0023] Exemplary methods This application provides an attack identification method applied to vehicles equipped with intelligent driving systems. Specifically, the method is executed by the vehicle, which may be the intelligent driving domain controller or central computing unit within the vehicle. This module incorporates an attack identification system to implement the attack identification method provided in this application. The intelligent driving system described here can be of different levels, such as a high-level autonomous driving system or a low-level driver assistance system.

[0024] The method is described in detail below through some embodiments. The following embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0025] like Figure 1 As shown, the method may include steps 101 to 105, as described below: Step 101: Based on the preset vehicle physical model and the vehicle's motion state data at the previous moment, determine the vehicle's first motion state data in the world coordinate system at the current moment.

[0026] The vehicle physical model mentioned here refers to a mathematical model used to reflect the motion laws of a vehicle, such as a vehicle kinematics model or a vehicle dynamics model. Preferably, the vehicle physical model can be obtained by integrating a vehicle dynamics model and a vehicle operation model. This vehicle physical model can be generated using digital twin technology. Based on the vehicle's motion state data from the previous moment, this vehicle physical model can predict the vehicle's motion state data from the next moment.

[0027] The first motion state data mentioned here refers to highly reliable information that reflects the vehicle's own motion state, and its acquisition is independent of sensing sensors. The first motion state data is data in the world coordinate system.

[0028] Optionally, the vehicle's initial motion state data can be vehicle data collected by non-perceptual sensors on the vehicle. Non-perceptual sensors refer to vehicle sensors other than perceptual sensors, which are sensors with high reliability and resistance to external deception. Such sensors may include, but are not limited to, at least one of the following: Inertial Measurement Unit (IMU), wheel speed sensors, steering angle sensors, etc. Therefore, the vehicle's initial motion state data may include, but are not limited to, at least one of the following: vehicle three-axis acceleration and angular velocity data provided by the IMU, wheel speed data provided by the wheel speed sensors, and steering wheel angle data provided by the steering angle sensor. Then, based on the vehicle's physical model and the vehicle's initial motion state data, the vehicle's first motion state data in the world coordinate system at the next moment can be determined.

[0029] Step 102: Based on the preset motion model and the reliable motion state data of the external target at the previous moment, determine the second motion state data of the external target in the world coordinate system at the current moment.

[0030] The external targets mentioned here refer to entities in the vehicle's surrounding environment that may interact with the sensing sensors, such as other vehicles, pedestrians, streetlights, and buildings. These external targets can be obtained based on trusted environmental information, which refers to trusted information independent of external sensor data that may be attacked at the current moment. For example, it may include at least one of the following: trusted sensing results from history (such as the previous period) or prior information from the current map (such as a high-precision map) (such as known buildings and road signs in the map).

[0031] For an external target, a motion model can be applied for state propagation. This motion model could be, for example, a constant velocity (CV) model or a constant turn rate and velocity (CTRV) model. Based on the external target's reliable motion state (position, velocity, orientation) at the previous moment, combined with a time step Δt, its new position in the world coordinate system at the current moment can be predicted. For example, under a simple constant velocity model, the predicted new position is: .

[0032] The second motion state data described here is obtained based on physical laws and reliable data, and is not contaminated by sensor data that may be deceptive.

[0033] Step 103: Determine the third motion state data of the external target relative to the vehicle based on the first motion state data and the second motion state data.

[0034] After obtaining the first motion state data of the vehicle in the world coordinate system and the second motion state data of the external target in the world coordinate system, it is necessary to convert this information in the world coordinate system back to the vehicle coordinate system to obtain the third motion state data of the external target relative to the vehicle, that is, the third motion state data of the external target in the vehicle coordinate system, thereby generating the expected perception state reference.

[0035] For example, a standard rigid body coordinate transformation can be used to transform the estimated vehicle pose (position and attitude) into relative coordinates of each predicted target in the vehicle's frame of reference, using the estimated world coordinates of each target. The transformed result can be a list-based data structure. Each entry in this list contains the same fields as the actual perceived data, such as target ID, expected position (x, y, z in the vehicle's coordinate system), and expected velocity (vx, vy in the vehicle's coordinate system).

[0036] Specifically, let the current discrete time step be... The time step is .

[0037] First, the motion state of the vehicle is estimated.

[0038] Define the vehicle's state vector in the world coordinate system. ,in For location, For heading angle, Linear velocity, ω is the angular velocity.

[0039] Based on the vehicle kinematics model, the prediction equation for the vehicle's state is: in, The longitudinal acceleration and angular velocity data are collected by the inertial measurement unit. After the above filtering algorithm, the optimal estimate is output. .

[0040] Then, the propagation prediction of external targets in the world coordinate system is performed.

[0041] For the number tracked in the previous frame A dynamic target, whose position in the world coordinate system is known. and absolute velocity vector Propagation is performed using a constant velocity (CV) model: Finally, the expected perceived state reference is generated by inverse coordinate transformation. At this point, the previously predicted external target world coordinates need to be... Transform to the current vehicle coordinate system.

[0042] Define rotation matrix . No. The expected relative position of each target The calculation formula is: Should (Combined with relative velocity and other states) constitutes the core data of the expected perception state benchmark.

[0043] In this embodiment, the predicted state data of external targets is inferred from the current motion state of the vehicle to obtain the attack detection benchmark, which can also be called the expected perception state benchmark. This benchmark is based on physical laws and reliable data, and is not contaminated by sensor data that may be deceptive. It represents the results that external environment sensors should observe under physical laws without attacks. The independence and objectivity of this benchmark are important conditions for achieving highly deceptive identification.

[0044] Step 104: Based on the actual perception data obtained by the perception sensors on the vehicle, determine the fourth motion state data of the external target relative to the vehicle at the current moment.

[0045] Among them, perception sensors, or external environment sensors, refer to sensors used to collect data on the vehicle's external environment, such as cameras, lidar, and millimeter-wave radar. These types of sensors are easily targeted by data spoofing attacks. The actual perception data collected by these sensors is the object of data credibility assessment in this application embodiment. This actual perception data can be structured information after preliminary processing within the sensor, such as a target detection list output by a camera (including target category, location, size, etc.), point cloud clustering or target list output by lidar, and target point trace information output by millimeter-wave radar. Through this actual perception data, perception status data of external targets of the vehicle, such as position and speed status information, can be obtained.

[0046] When there are multiple external environment sensors (such as multiple cameras, multiple millimeter-wave radars, etc.) or multiple types (such as including cameras, lidar, millimeter-wave radars, etc.), the perception status data of external targets of the vehicle can be determined for each sensor or each type of sensor.

[0047] Step 105: Compare the third motion state data and the fourth motion state data at the same time, and determine whether the vehicle's perception system has been attacked based on the comparison results.

[0048] After obtaining the predicted state data (i.e., the third motion state data) and the perceived state data (i.e., the fourth motion state data) of the external targets of the vehicle, the two types of data at the same time can be compared, and the vehicle's perception system can be determined based on the comparison results.

[0049] For example, the deviation between the perceived state data and the predicted state data can be used to determine whether the vehicle's perception system is under attack. If, in multiple rounds of comparison, the number of times the deviation exceeds a preset deviation threshold is continuously greater than or equal to a threshold, it can be determined that there is an attack risk targeting the external environment sensor; if the number of times the deviation exceeds the preset deviation threshold is greater than 0 but less than the threshold, observation can be conducted first; if the number of times the deviation exceeds the preset deviation threshold is equal to 0, it can be determined that there is no attack risk targeting the external environment sensor. Of course, this is just an example; the specific judgment criteria can be set according to actual needs.

[0050] The technical solution provided in this application can fully utilize the vehicle's own kinematics and dynamics information to construct an independent, priori expected observation model under the condition of limited on-board computing resources. This model can dynamically evolve and deeply integrate the vehicle's physical laws to obtain the behavioral benchmark of the perception system (i.e., the predicted state data of external targets), answering the question "What should the environmental perception sensor see under the current motion state of the vehicle?" Based on this, it can perform real-time and accurate deception attack identification on multimodal perception data streams, thereby effectively identifying and defending against carefully constructed cooperative data deception attacks that can bypass traditional cross-sensor consistency verification.

[0051] It should be noted that the motion state data of the vehicle or external target in the embodiments of this application may include, but are not limited to: the position, attitude, speed, acceleration, etc. of the vehicle or external target.

[0052] To improve the accuracy of vehicle motion state data, this application also provides an optional implementation method, as described below.

[0053] Step 101: Based on the preset vehicle physics model and the vehicle's motion state data from the previous moment, determine the vehicle's first motion state data in the world coordinate system at the current moment. This may include steps A1 to A3, as described below: Step A1: Determine the vehicle's fifth motion state data at the current moment based on the vehicle's target sensor.

[0054] The target sensor described herein may include, but is not limited to, at least one of the following: inertial measurement unit, wheel speed sensor, steering angle sensor, etc.

[0055] Step A2: Based on the preset vehicle physics model and the vehicle's motion state data at the previous moment, predict the vehicle's sixth motion state data at the current moment.

[0056] Step A3: Use the sixth motion state data to correct the fifth motion state data to obtain the first motion state data of the vehicle at the current moment.

[0057] The data collected by the target sensor has both advantages and disadvantages. For example, data collected by the inertial measurement unit, such as acceleration and angular velocity, can provide instantaneous dynamic information, but it suffers from drift errors that accumulate over time. Wheel speed data collected by wheel speed sensors can provide relatively accurate vehicle speed information, but it can become distorted in situations such as wheel slippage. Therefore, in this embodiment, the vehicle motion state data collected by the target sensor can be combined with the vehicle motion state data predicted by the vehicle physical model to obtain more accurate motion state data of the vehicle at the current moment. For example, weight values ​​can be set for the two types of data, and the weighted average of the two types of data can be used as the first motion state data. The weight values ​​of the two types of data can be set according to actual needs; for example, the weight value of the vehicle motion state data predicted by the vehicle physical model can be set to be greater than the weight value of the vehicle motion state data collected by the target sensor. Of course, other feasible methods can also be used to combine the two types of data to obtain the target motion state data.

[0058] Alternatively, sensor fusion filtering algorithms, such as extended Kalman filters or unscented Kalman filters, can be used to achieve the fusion of the two types of data.

[0059] This filter maintains a vehicle state vector, which can include the vehicle's three-dimensional position [x, y, z] in the world coordinate system, attitude angles (roll, pitch, yaw) [roll, pitch, yaw], and corresponding velocities and angular velocities. At each time step, the filter first uses the vehicle's kinematic model (e.g., the Ackerman steering geometry model) and the vehicle's motion state at the previous time step to predict the vehicle's motion state at the current time step. Then, it uses actual measurements from target sensors such as the inertial measurement unit and wheel speed sensors to update and correct the prediction results, thereby obtaining an optimal estimate of the vehicle's current motion state. This fused and filtered vehicle state exhibits higher accuracy and stability than any single set of two data points.

[0060] It should be noted that when vehicle motion state data from the previous moment is unavailable, the vehicle motion state data collected by the target sensor can be directly used as the first motion state data. Subsequently, the vehicle motion state data from the previous moment can be the vehicle motion state data obtained through steps A1 to A3.

[0061] In some optional embodiments, before determining the second motion state data of the external target in the world coordinate system at the current moment based on the preset motion model and the credible motion state data of the external target at the previous moment in step 102, the method may further include: determining the external target based on credible environmental information.

[0062] The external targets mentioned here can include moving external targets and stationary external targets.

[0063] The trusted environmental information mentioned herein may include, but is not limited to, at least one of the following: results from historical trusted perception, prior information from maps, etc. For a detailed description of the trusted environmental information, please refer to the foregoing embodiments, which will not be repeated here.

[0064] For static external targets, such as streetlights, buildings, and parked vehicles, since their positions in the world coordinate system are fixed, in addition to obtaining their current predicted state data through the methods described above, their coordinates can also be read directly from memory or a map database.

[0065] For dynamic external targets, a motion model can be applied to propagate their state, as described above, and will not be repeated here.

[0066] In this embodiment, by limiting the external target to information from a trusted environment, the input data of the prediction baseline is ensured to be independent of the currently potentially attacked perceived data stream, thus maintaining the independence and credibility of the verification mechanism.

[0067] Based on the above embodiments, in some alternative embodiments, the attack identification system can obtain the vehicle's own motion state data and the actual perception data collected by the perception sensors by listening to and parsing different vehicle network bus messages.

[0068] Real-time vehicle motion state data can be acquired by subscribing to and decoding CAN or CAN-FD messages from the chassis or powertrain domain controllers. These messages broadcast the vehicle's most basic physical state information at high frequencies (e.g., 100Hz for IMU data and 50Hz for wheel speed data). Optionally, the data can be precisely parsed from a specific message ID. Inertial measurement unit (IMU) data includes the vehicle's linear acceleration along the X, Y, and Z axes and its angular velocity around these axes. This data forms the basis for calculating the vehicle's attitude changes over short time periods.

[0069] Wheel speed data: This includes the real-time rotational speeds of the four wheels: front left, front right, rear left, and rear right. This data is a key input for calculating the vehicle's actual speed (vehicle speed).

[0070] Steering angle data: This includes the angle of rotation applied to the steering wheel by the driver or intelligent driving system. This data directly reflects the vehicle's steering intention.

[0071] These vehicle motion state data originate from physically coupled sensors inside the vehicle, making them difficult to be directly deceived by external malicious attackers. Therefore, they form the highly reliable data foundation for physical consistency verification in the embodiments of this application.

[0072] For acquiring actual perception data from external environment sensors, the main methods are to receive structured target information output from various environmental perception sensor ECUs or domain controllers via communication protocols such as SOME / IP or Data Distribution Service (DDS) over in-vehicle Ethernet. The structured target information referred to here is a list of targets that has undergone preliminary target detection and recognition algorithms. A target object data structure may include: target ID (for cross-frame tracking), target category (e.g., vehicle, pedestrian, bicycle), position (x, y, z coordinates) in the sensor's own coordinate system, velocity (Vx, Vy), dimensions (length, width, height), confidence score, etc.

[0073] Furthermore, since the vehicle's own motion state data and the actual perception data collected by the sensing sensors originate from different ECUs, their data generation and transmission inherently involve clock bias and latency jitter. To ensure the accuracy of subsequent bias analysis, all collected data needs to be unified to a common time reference.

[0074] In this embodiment, PTP (Precise Time Protocol) or gPTP (General Precise Time Protocol in Time-Sensitive Networks) can be used for clock synchronization. The master clock inside the vehicle broadcasts precise time information to all nodes, so the attack detection system can immediately assign a high-precision reception timestamp to any data packet it receives. Subsequently, through interpolation or extrapolation algorithms, data points at different times are aligned to a unified, discrete analysis time point (e.g., one analysis frame every 100ms), thereby forming a time-synchronized data snapshot. The specific implementation process can be described as follows: The implementation process may include a two-stage algorithm: global clock correction and kinematic spatiotemporal alignment.

[0075] Phase 1: Global clock correction and observation timestamp calibration based on PTP / gPTP Although the vehicle network uses the PTP / gPTP protocol, allowing all ECUs (such as camera controllers and IMU nodes) to share a master clock, transmission delays and processing jitter still exist during the data acquisition process from sensors to the attack detection system via the bus. Therefore, the attack detection system cannot simply use the receiver's local time; it needs to calculate the effective observation time that reflects the actual physical state of the data. .

[0076] Assume the attack detection system receives data from the sensor. The Data packets .

[0077] First, parse the generated timestamp to determine if the message contains a PTP timestamp added by the source ECU at the moment the data is generated. If it exists, then the high-precision result based on the PTP network will be directly adopted. As If it does not exist, meaning the sensor does not provide a high-precision generated timestamp, the attack detection system will add a precise received timestamp at the receiving end. And combined with the pre-calibrated typical transmission delay of the sensor Estimate the effective observation time: .

[0078] Second stage: Data alignment algorithm for discrete time frames (interpolation and extrapolation) The unified analysis cycle of this system is set as follows: (For example, 100ms), then the first The target time point for each discrete analysis frame is: Attack detection systems can utilize target time points. The surrounding asynchronous discrete data points accurately estimate the various physical quantities in The instantaneous value of this absolute moment Different alignment algorithms are used for different data characteristics: Algorithm A: Linear Interpolation Algorithm Applicable scenarios: High-sampling-rate continuous data, such as vehicle motion state data. Because its sampling frequency is higher than or equal to the analysis frequency, it can be used at the target time point. Find the adjacent observation data points on both sides.

[0079] Algorithm logic: On the timeline, find the condition that satisfies... Two adjacent valid observation data points. Physical quantity exist The value at time t is obtained by linearly weighting these two points.

[0080] Mathematical formula: in, It could be the acceleration of the IMU. angular velocity Or wheel speed, etc. This method can preserve the high-frequency characteristics of the vehicle's instantaneous dynamics to the greatest extent.

[0081] Algorithm B: Kinematics-based Adaptive Extrapolation Algorithm Applicable scenarios: External perception data with low sampling rates or significant processing latency, such as camera target lists, typically 10-30Hz, and including algorithm processing latency in the hundreds of milliseconds. When the attack detection system performs its first... During frame analysis, it may not have been received yet. Future data can be used to project historical data to the current point in time. Perform forward prediction, i.e., extrapolation.

[0082] Algorithm logic: Utilize the target's current state (e.g., position) output by the sensor. and speed By combining the time difference, its state is extrapolated to the target time point. .

[0083] Mathematical formula (in terms of target position coordinates) (For example) Assume the timestamp of the latest received target message is (and The message contains the target's location at that moment. and speed .

[0084] For general stationary targets, a constant velocity (CV) model can be used for first-order extrapolation: If time difference If the maximum extrapolation tolerance threshold (e.g., 200ms) is exceeded, it indicates that the sensor data is severely lagging or missing. In this case, extrapolation can be rejected and the sensor data in this analysis frame can be marked as "missing" to prevent excessive extrapolation from introducing large errors.

[0085] The two-stage algorithm described above can be used in each system cycle. Each outputs a time-synchronized data snapshot, which contains the vehicle's state vector. and external perception target list In the time dimension, they are forced to align to the same moment by the mathematical model. This completely eliminates the deviations caused by asynchronous communication, clearing the technical obstacles for subsequent physical consistency verification.

[0086] Furthermore, different environmental sensors are installed in different positions on the vehicle body, and their output information is based on their respective coordinate systems. For comparison and analysis, all spatial data can be transformed into a unified reference coordinate system. This embodiment can use a standard vehicle coordinate system as the unified coordinate system. This coordinate system typically has the rear axle center as the origin, the vehicle's forward direction as the positive X-axis, the left side as the positive Y-axis, and the vertically upward direction as the positive Z-axis.

[0087] The attack detection system can pre-load the precise extrinsic parameters of all relevant sensors relative to the vehicle coordinate system, including rotation matrices and translation vectors. These extrinsic parameters are calibrated during vehicle production and are known. For each frame of actual perceived data received (such as the target position detected by the camera), the corresponding coordinate transformation formula can be applied to transform it from the sensor coordinate system to a unified vehicle coordinate system.

[0088] In relevant technical solutions, a set of static or quasi-static verification rules and thresholds is typically relied upon. This makes it difficult to adapt to the complex and ever-changing dynamic driving environment faced by intelligent driving. When a vehicle makes sharp turns, brakes suddenly, or travels on bumpy roads, the measurement errors and asynchronicity of the sensors naturally increase. Fixed verification thresholds will therefore generate a large number of false alarms, interfering with normal driving decisions. Conversely, if the thresholds are relaxed to adapt to these scenarios, it becomes difficult to identify low-amplitude, covert attack behaviors. Therefore, fixed verification rules and thresholds are ill-suited to the natural fluctuations in sensor errors under complex operating conditions such as high speeds and dynamic changes, easily leading to false alarms or missed alarms.

[0089] In some optional embodiments of this application, different deviation thresholds can be set for different driving scenarios. Therefore, step 103: comparing the third motion state data and the fourth motion state data at the same time, and determining whether the vehicle's perception system has been attacked based on the comparison results, may include steps C1 to C3, as described below: Step C1: Determine the deviation between the third motion state data and the fourth motion state data at the same time.

[0090] When there is only one external target, the deviation between the predicted state data of that external target and the perceived state data at the same time can be determined. When there are multiple external targets, the deviation between the predicted state data of each external target and the perceived state data at the same time needs to be determined one by one.

[0091] Furthermore, the predicted and perceived state data for each external target includes data from different dimensions, such as velocity and position. For each data dimension, the deviation value also needs to be calculated individually.

[0092] Step C2: Determine the corresponding target deviation threshold based on the current driving scenario information.

[0093] The current driving context information mentioned here refers to information that characterizes the environment or motion state of the vehicle while it is driving. This type of information is related to the dynamic changes in the measurement errors of the sensing sensors.

[0094] Optionally, the current driving context information may include, but is not limited to, at least one of the following: vehicle speed, vehicle maneuvering status, road type and geometric features, etc.

[0095] The inherent measurement errors of the sensing sensors and their stability in observing the external environment vary across different speed ranges. Therefore, for vehicle speed, we can first calculate the vehicle speed based on the wheel speed sensors, and then use this calculated speed to initially classify the vehicle's macroscopic driving state. For example, we can define three basic states: low-speed driving (e.g., <20km / h, corresponding to urban congestion or parking lot scenarios), medium-speed driving (20-60km / h, corresponding to ordinary urban roads), and high-speed driving (>60km / h, corresponding to highways or expressways).

[0096] For vehicle maneuvering status, the focus is on analyzing the instantaneous dynamic changes of the vehicle to determine whether it is in a state of violent maneuvering. Violent maneuvering is the main cause of normal, non-aggressive deviations in the data observed by sensing sensors. Since vehicle maneuvering status can be determined using data from the inertial measurement unit, the following key dynamic parameters can be calculated in real time: Longitudinal acceleration: Obtained by filtering and processing the X-axis acceleration data from the inertial measurement unit. For example, a large absolute value of longitudinal acceleration (e.g., >3 m / s²) indicates that the vehicle is undergoing emergency acceleration or emergency braking.

[0097] Lateral acceleration: Obtained by filtering and processing the Y-axis acceleration data from the inertial measurement unit. For example, a large absolute value of lateral acceleration (e.g., >2.5 m / s²) indicates that the vehicle is making a rapid turn, changing lanes, or avoiding an obstacle.

[0098] Yaw rate: Obtained from the Z-axis angular velocity data of the inertial measurement unit. For example, a high yaw rate also indicates that the vehicle is undergoing a sharp turn.

[0099] The instantaneous values ​​of these dynamic parameters and their rate of change within a short time window together constitute an accurate depiction of the vehicle's current driving dynamics.

[0100] In this embodiment, the vehicle can also interact with an onboard high-precision map (HDMap) or navigation system to obtain the current road type (such as straight road, curve, slope, tunnel) and geometric parameters (such as radius of curvature, gradient), providing richer prior information for driving situation judgment. For example, before entering a known curve with large curvature, the tolerance for lateral deviation can be increased in advance.

[0101] This embodiment can integrate these multi-dimensional, qualitative or quantitative features into one or a set of standardized driving context information, so as to determine the corresponding target deviation threshold based on the current driving context information. The target deviation threshold mentioned here can include deviation thresholds for different data dimensions, such as the target speed deviation threshold corresponding to the speed dimension, the target position deviation threshold corresponding to the position dimension, etc.

[0102] Step C3: Compare the deviation between the third motion state data and the fourth motion state data at the same time with the target deviation threshold, and determine whether the vehicle's perception system has been attacked based on the comparison results.

[0103] Specifically, this could involve comparing the absolute value of the deviation with a target deviation threshold, and determining whether the vehicle's perception system has been attacked based on the comparison result. For example, comparing the absolute value of the speed deviation with the corresponding target speed deviation threshold, or comparing the absolute value of the position deviation with the corresponding target position deviation threshold, etc. Then, based on the comparison results of various data dimensions of one external target, or the comparison results of multiple external targets, it can be determined whether the vehicle's perception system has been attacked.

[0104] In this embodiment, the judgment threshold (i.e., deviation threshold) can be dynamically adjusted in real time based on driving context information. For example, for smooth driving, a smaller deviation threshold is set to capture subtle anomalies with high sensitivity in smooth driving scenarios; while for aggressive driving, a larger deviation threshold is set to appropriately relax the tolerance in dynamically changing driving scenarios to avoid false alarms. This adaptive capability reduces the false alarm rate without sacrificing safety sensitivity, resolving the inherent contradiction between robustness and sensitivity in existing technologies, and enabling the safety protection strategy to smoothly and reliably cover a wider range of driving scenarios.

[0105] Optionally, step C2: determining the corresponding target deviation threshold based on the current driving scenario information may include steps C11 and C12, as described below: Step C11: Determine the corresponding target scenario adjustment factor based on the current driving scenario information.

[0106] Step C12: Based on the target scenario, adjust the factor and the preset basic deviation threshold to determine the target deviation value threshold.

[0107] In this embodiment, after obtaining the current driving situation information, the qualitative situation information can be transformed into a quantitative target situation adjustment factor through an internal mapping function or lookup table. The numerical range of this target situation adjustment factor can be between [1.0, 2.0], and it is positively correlated with the magnitude of the vehicle dynamic parameters. A situation adjustment factor value of 1.0 represents the most stable state, while a larger value represents a more unstable state.

[0108] The attack detection system can pre-store the basic deviation threshold of the vehicle under the most stable driving conditions. This basic deviation threshold represents the maximum normal deviation value allowed by the system under relatively ideal conditions. For example, a basic threshold table can be preset for different target types and distance ranges. The table can include basic thresholds for position deviation and speed deviation for static obstacles, different types of vehicles, etc., as shown in Table 1.

[0109] Table 1 Vulnerable Road Users (VRUs) refer to pedestrians, cyclists, e-bike riders, and other individuals who are vulnerable to injury in traffic accidents.

[0110] The values ​​in this table can only be used directly as the adjudication benchmark under the most ideal and stable driving conditions. In other scenarios, the base thresholds in the table will be multiplied by a scenario adjustment factor greater than 1 to generate dynamic and reliable thresholds. Furthermore, in more complex application scenarios, more dimensions can be added to this table, such as sensor type (the threshold for LiDAR is usually more stringent than that for cameras) and weather conditions (the threshold will be relaxed in rainy or snowy weather), to achieve more refined adaptive adjudication.

[0111] The formula for calculating the dynamic confidence threshold is as follows: in, This is a target scenario adjustment factor determined by the current driving situation. For example, if the target scenario adjustment factor is 2.0, the dynamic position confidence threshold will be adjusted to 0.5. 2.0 = 1.0 meter, which means that during aggressive driving, the perception sensors have a greater tolerance, thus avoiding misjudging normal maneuvering errors as attacks.

[0112] This embodiment quantifies qualitative driving situation information into situation adjustment factors and multiplies them by a basic deviation threshold, which enables the threshold adjustment process to have good consistency and calibrability, thereby more accurately matching the perceptual deviation range allowed under different working conditions.

[0113] In one embodiment, step C11, which involves determining the corresponding target scenario adjustment factor based on the current driving scenario information, may include steps C111 and C112, as follows: Step C111: Determine the intensity of the vehicle's maneuvering based on its maneuvering status.

[0114] Step C112: Determine the target scenario adjustment factor based on the intensity of vehicle maneuvering and vehicle speed.

[0115] Different degrees of maneuver intensity have varying weights in their impact on the prediction accuracy of the vehicle's digital twin model. Therefore, this embodiment can determine the degree of maneuver intensity based on the vehicle's maneuvering state. Furthermore, vehicle dynamics laws indicate that the same steering maneuver produces a significantly larger trajectory prediction deviation at high speeds than at low speeds; that is, vehicle speed has an amplifying effect on the error. Therefore, this embodiment combines the degree of maneuver intensity with the vehicle's speed to determine the target scenario adjustment factor. This accurately reflects the physical law that the combined effects of severe maneuvering and high-speed driving increase the uncertainty of the prediction model, making the dynamic threshold more consistent with the true error distribution, thereby effectively suppressing false alarms while ensuring safety sensitivity.

[0116] Optionally, the process of determining the target situation adjustment factor essentially constructs a mathematical mapping relationship from a multidimensional vehicle physical state space to a one-dimensional dynamic tolerance multiplier. This process can be achieved by calculating the Dynamic Severity Index (DSI) and ultimately outputting a continuously changing situation adjustment factor. .

[0117] The specific algorithm steps are as follows: Step 1: Perform dynamic feature smoothing based on Exponential Moving Average (EMA).

[0118] Because data from vehicle chassis sensors (especially inertial measurement units) often includes high-frequency noise and glitches caused by instantaneous road bumps, directly using instantaneous values ​​for calculation can lead to frequent fluctuations in subsequent thresholds. Therefore, it is advisable to first process the input instantaneous state variables (such as longitudinal acceleration). lateral acceleration yaw rate and vehicle speed (etc.) An exponential moving average filter is applied to obtain smoothed data. Let the current discrete time frame be... The smoothing coefficient is ( (Typically, it is taken as 0.1~0.3). After the above processing, the denoised steady-state physical characteristic values ​​were obtained.

[0119] Step 2: Calculate the normalized dynamic intensity index (DSI). Different physical quantities (acceleration, deceleration, steering) have different weights in their impact on the prediction accuracy of the vehicle's digital twin model. This can be addressed by calculating a normalized spatial vector magnitude to comprehensively assess the intensity of the vehicle's current maneuvering.

[0120] Define the vehicle's physical limit thresholds (empirical calibration values) in various dimensions: maximum safe longitudinal acceleration. (like Maximum safe lateral acceleration (like Maximum safe yaw rate (like ).

[0121] Dynamic intensity index The calculation formula is as follows: in, The weighting coefficients are dimensionless, and The physical meaning of this formula lies in the fact that it nonlinearly amplifies the impact of violent maneuvers on the system's uncertainty through the square term; the closer the maneuver gets to the vehicle's physical limits, the more significant the impact. The value increases exponentially.

[0122] Step 3: Mapping to generate dynamic context adjustment factors In obtaining the intensity index Then, combined with the current vehicle speed The target situation adjustment factor is calculated.

[0123] Vehicle dynamics principles show that for the same steering maneuver, the trajectory prediction deviation at high speeds is much greater than at low speeds (i.e., vehicle speed amplifies the error). Therefore, the mapping function is designed as follows: in, This indicates travel in a straight line at an absolute standstill or an ideal uniform speed. The base partial multiplier when ). This represents the basic sensitivity amplification factor (system calibration parameter, for example, 2.0). This represents the speed coupling amplification factor (a system calibration parameter, for example, 1.5). This indicates the vehicle's maximum design speed and is used for speed normalization.

[0124] The physical and logical effects output by the algorithm: When a vehicle is traveling straight at a constant speed of 30 km / h on a smooth urban road, Approaching 0, the calculation yields The system maintains the highest sensitivity, directly using a baseline threshold (such as 0.2 meters) for rigorous deviation adjudication.

[0125] When a vehicle performs an emergency obstacle avoidance maneuver at 120 km / h on a highway (high-speed...) ,high )hour, The value increased significantly, and was affected by high vehicle speed. amplification effect (through) (parameters), finally calculated It could be as high as 3.5.

[0126] Module 400 received Subsequently, the basic threshold of 0.2 meters will be dynamically relaxed to... rice.

[0127] This is well achieved through mathematical formulas: at the moment when the vehicle moves violently and the model's inherent prediction error surges, the system automatically and smoothly handles the observation bias caused by normal physical maneuvering, avoiding major false alarms that misjudge sharp turns as data deception attacks.

[0128] In some alternative embodiments, before comparing the third motion state data with the fourth motion state data at the same time, a key question must first be addressed: which target in the actual sensed target list corresponds to which target in the expected sensed state baseline? This step aims to find the physical prediction twin for each valid target from the sensing sensor; in short, it requires identifying the data in the target prediction state data and the sensed state data that belong to the same external target, i.e., matching the same external target in the two types of data.

[0129] In this embodiment, a gated nearest neighbor-based association algorithm can be used to determine the correspondence between external targets.

[0130] In this method, for each target in the expected target list (i.e., target prediction state data), an association gate is defined centered on its predicted location. The size of this gate can be set based on the uncertainty (i.e., covariance) of the prediction result; that is, the size of the association gate can be a range of covariance. For example, based on vehicle motion state data, it is predicted that the preceding vehicle will appear at location A in the next moment. This location A is the aforementioned center. The association gate refers to a region drawn based on this center, which is the allowed search range. The size of this region is set based on the uncertainty (i.e., covariance) of the prediction result. This uncertainty refers to the error risk of the prediction itself, and covariance is a mathematical parameter that quantifies this uncertainty. When the prediction accuracy is high, indicating a small error, the association gate value is set small. When the prediction accuracy is low, for example, due to the vehicle's violent movement, the vehicle's physical model may have a larger error in predicting the location of external targets, requiring a larger search range to find the actually perceived targets. Therefore, in this case, the association gate can be set larger to avoid missed detections.

[0131] Then, the list of actual perceived targets is traversed, and only among the actual targets located within the association gate, the target that is closest in state space (such as position or velocity) to the expected target is found and paired. Successfully paired target pairs will proceed to the next step of deviation calculation.

[0132] Failure to find a matching expected target (i.e., "missed alert") or failure to find a matching actual target (i.e., "false alarm") is itself considered a potential anomaly signal and will be counted and monitored.

[0133] The above scheme can be summarized as follows: For each external target in the target prediction state data, a matching region (e.g., a circular region) is defined with its predicted position as the center. This matching region is set based on the covariance of the external target prediction result (e.g., with the covariance as the radius), and the covariance between the matching region and the external target prediction result is also considered. Then, the target list in the perception state data is traversed, and among the actual targets located within the matching region, the target that is closest to the expected target in the state space (e.g., position, velocity) is found, and the two targets are determined to be the same external target.

[0134] For each successfully associated target pair, the deviations between them in several key physical dimensions can be calculated.

[0135] Position deviation (ΔP): Calculates the Euclidean distance between the actual observed position (x_a, y_a) and the expected position (x_p, y_p). .

[0136] Velocity deviation (ΔV): Calculates the Euclidean distance between the actual observed velocity (vx_a, vy_a) and the expected velocity (vx_p, vy_p). In one embodiment, driving scenarios can be further categorized into levels, with corresponding scenario adjustment factors set for each level. Different driving scenarios correspond to different speed ranges, acceleration / deceleration ranges, yaw rate ranges, etc. For example, a level system from 1 to 5 (Level 1-5) can be defined, where Level 1 represents "very smooth" (e.g., constant speed straight-line driving), and Level 5 represents "very aggressive" (e.g., emergency obstacle avoidance and braking). In practical applications, the current driving scenario can be mapped to one of these five levels based on real-time calculated characteristic values ​​such as vehicle speed, acceleration / deceleration, and yaw rate. For example, one mapping rule could be: "IF (vehicle speed > 80 km / h) AND (lateral acceleration > 2 m / s²) THEN scenario level = Level 4".

[0137] In some alternative embodiments, step 105, "determining whether the vehicle's perception system has been attacked based on the comparison results," may include: If an external target consistently indicates a deviation value exceeding a target deviation threshold in the comparison results of consecutive preset frames of data, it is determined that the vehicle's perception system has been attacked, and a risk alarm message is output.

[0138] In a single analysis frame, if the deviation value of a target exceeds the corresponding target deviation threshold, the external target will be marked as "transient anomaly". To prevent false alarms caused by single packet loss or transient noise, the marking status of an external target over multiple consecutive analysis frames (e.g., the past 5 frames) can be used. When an external target is continuously marked as "transient anomaly" (e.g., more than 3 out of 5 frames), it can be determined that the external target is a high-confidence risk event, meaning the vehicle's perception system is considered to be under attack. Specifically, when the data of any dimension of the external target is abnormal, the external target will be marked as "transient anomaly". When any external target indicates a deviation value exceeding the target deviation threshold in the comparison results of consecutive preset frames of data, it can be determined that the vehicle's perception system is under attack.

[0139] After confirming the risk time, risk alert information can be generated. This risk alert information may include, but is not limited to, at least one of the following: risk level (such as high, medium, or low, which can be determined based on the degree to which the deviation exceeds the threshold), information of the attacked sensing sensor (e.g., forward-facing camera ID), abnormal external target (such as abnormal target ID), and deviation analysis details (such as actual value, predicted value, deviation value, target deviation threshold, etc., which can be used for subsequent log recording and attack tracing).

[0140] Specifically, a low-risk level is defined as follows: when the deviation value just exceeds the threshold (e.g., the exceeding value is within the first numerical range, which represents a smaller range of values), or when the anomaly is not persistent. A medium-risk level is defined as when the deviation consistently exceeds the threshold but by a small margin (e.g., the exceeding value is within the second numerical range, where the minimum value of the second range is greater than the maximum value of the first range). A high-risk level is defined as when the deviation is large (e.g., the exceeding value is within the third numerical range, where the minimum value of the third range is greater than the maximum value of the second range) and persistent, or when multiple targets exhibit anomalies simultaneously, indicating a possible severe and coordinated attack.

[0141] In the process of deviation analysis, multidimensional deviation calculations can be performed based on Mahalanobis distance.

[0142] Assume that the first The actual perceived target state vector is: The first successful pairing The expected target state vectors are: .

[0143] Calculate the residual vector between the actual and expected values: To eliminate the influence of differences in the physical dimensions of position and velocity, as well as the uncertainties in different dimensions, the Mahalanobis distance is calculated as a comprehensive deviation value. : in, The covariance matrix of the target state reflects the inherent noise of the prediction model and the sensor itself.

[0144] Adjustment factor based on the calculated target scenario And obtain the basic deviation tolerance by querying the basic threshold table. Calculate the dynamic confidence threshold: .

[0145] Instantaneous decision function : Set a length of The sliding time window of a frame (e.g.) The minimum number of anomalies required to trigger a real alert is defined as follows: ,For example .

[0146] Final risk alert function : This formula ensures that only deviations with physical spatiotemporal continuity are classified as attacks, filtering out occasional packet errors.

[0147] Optionally, after determining that the vehicle's perception system has been attacked, the method may further include: Reduce the weight of the perception data collected by the target's perception sensors in the multi-sensor data fusion calculation; or discard the perception data about abnormal external targets collected by the target's perception sensors when performing multi-sensor data fusion calculation.

[0148] For example, when the risk level is medium risk, a confidence reduction process can be applied by multiplying the confidence score of the anomalous target or the entire affected sensor source by a penalty factor (e.g., 0.5). In this way, the weight of the anomalous data will naturally decrease in the multi-sensor fusion algorithm, and its negative impact on the final fusion result will be significantly weakened, while the data from other reliable sensors will dominate.

[0149] For example, when the risk level is high, the abnormal target data can be completely discarded, or in extreme cases, the entire affected sensor data stream can be temporarily blocked. Although this approach may temporarily sacrifice some perception capabilities, it can fundamentally prevent malicious data from contaminating the decision-making system. Furthermore, if an attack causes critical perception capabilities (such as the front main sensor) to completely fail, a "severely degraded perception system" status can be reported to the vehicle's planning and control system, thereby triggering the vehicle's safety redundancy strategy, such as performing a minimum-risk maneuver like pulling over.

[0150] Specifically, suppose the original confidence score of the anomalous target in the original sensing sensor output is... (range of values) ).

[0151] Response Strategy 1: Continuous weight reduction penalty based on deviation magnitude To achieve smooth degradation, a penalty factor can be calculated based on the degree to which the deviation exceeds the threshold. An exponential decay function is used, so that the larger the deviation, the more severe the penalty: in, For the attenuation control coefficient (e.g.) ).when Just beyond hour, Approaching 1; when Much larger hour, It rapidly approaches 0.

[0152] In the update instruction issued to the perception fusion system, the new confidence level of the target is: The fusion system received Then, during Kalman fusion weight allocation, the data weight of the anomalous target will be automatically reduced to an extremely low level.

[0153] Response Strategy 2: Hard Rejection Based on Critical Threshold To prevent extremely malicious data from causing the entire fusion algorithm to crash, a critical threshold with extremely low confidence is set. (For example ).

[0154] When the instruction changes to "DISCARD_TARGET", the vehicle's main sensing system will directly erase the target data packet from physical memory, as if the target had never existed in the physical world, thus blocking the attack chain. "To reduce the weight."

[0155] In summary, the method provided in this application can determine first motion state data based on the vehicle's physical model and the vehicle's motion state data from the previous moment, predict second motion state data based on the reliable motion state data of an external target, and then generate third motion state data of the external target relative to the vehicle as a baseline for the current motion state. The third motion state data is then compared with fourth motion state data of the external target determined based on actual perception data to detect whether the vehicle perception system has been attacked. The technical solution provided in this application is not limited to simple perception data association; it can effectively detect collaborative deception attacks that violate the laws of vehicle physical motion even if they satisfy the geometric consistency between sensors, thus improving the accuracy and effectiveness of attack identification.

[0156] Exemplary System This application provides an attack identification system applied to a vehicle, that is, the system is deployed on the vehicle, specifically in the vehicle's intelligent driving domain controller or central computing unit.

[0157] like Figure 2As shown, the system may include: a status acquisition module, a context awareness module, a benchmark prediction module, a deviation analysis and adjudication module, and a response execution module.

[0158] Among them, the status acquisition module is the interface between the attack identification system and the vehicle data network. Its core responsibility is to serve as a high-throughput, high-timeliness data acquisition and preprocessing center, providing a standardized, synchronized, and coordinate-system-unified data foundation for the subsequent security analysis module.

[0159] This module acquires the vehicle's own state data package (i.e., target motion state data) and the actual perceived target list (i.e., perception state data) through three core stages: data acquisition, time synchronization, and coordinate system integration. Figure 3 As shown.

[0160] After the above three stages of processing, the state acquisition module ultimately outputs two key data streams to other modules within the system: one is a time-synchronized, standardized vehicle motion state data packet, which will be sent to the baseline prediction module and the context perception module; the other is a time-synchronized, coordinate-system-unified, standardized list of actual perceived targets, which will be sent to the deviation analysis and decision-making module. These two data streams constitute the data foundation for all subsequent analyses and decisions.

[0161] The context-aware module acts as a dynamic regulator in the attack detection system. Its core task is not to directly participate in attack identification, but rather to provide dynamic contextual information—matched to the current driving environment and vehicle state—to the core decision-making stage (i.e., the deviation analysis and adjudication module). Its direct purpose is to enable the subsequent adjudication threshold to be adaptively adjusted, thereby effectively suppressing false alarms under complex operating conditions while maintaining high safety sensitivity.

[0162] This module receives real-time self-state data from the state acquisition module and can selectively fuse high-precision map data from the in-vehicle navigation system. Its internal workflow mainly includes two stages: contextual feature extraction and contextual quantification output. The core of the contextual feature extraction stage is to extract key features that characterize the current driving intensity or uncertainty from the continuous, raw self-state data stream. The contextual quantification output stage, after extracting the above features, integrates these multi-dimensional, qualitative or quantitative features into one or a set of standardized driving context information and outputs it periodically (e.g., every 100ms) to the deviation analysis and adjudication module. This information flow ensures that the attack identification system's security defenses can flexibly adapt to the driving environment, thereby making the most appropriate judgments in various complex scenarios.

[0163] The task of the baseline prediction module is to independently predict the state of the vehicle's surrounding environment in the next moment, using only highly reliable vehicle state data and a rigorous physical model, without relying on any external environmental sensor input (such as cameras or LiDAR). This prediction result, i.e., the expected perception state baseline, will serve as a truth reference or physical anchor for subsequent deviation analysis.

[0164] The internal workflow of this module can be broken down into three closely linked core steps: high-precision vehicle state estimation, target state propagation prediction, and expected perception benchmark generation. Through these three steps, the benchmark prediction module completes a full prediction cycle. Its output, the expected perception state benchmark, is a theoretical snapshot of the external world, derived entirely from physical laws and highly reliable internal data. This snapshot is sent to the deviation analysis and adjudication module for cross-validation with the actual snapshots perceived by the sensors, thereby detecting anomalies that do not conform to the laws of the physical world.

[0165] The deviation analysis and adjudication module is located at the intersection of the data flow. Its core function is to perform a rigorous, physical reality-based cross-check, quantitatively comparing the observation results transmitted by the external environment sensors (actual perception data) with the physical expected results predicted by the digital twin model (expected perception state benchmark), and combining this with the current driving situation to ultimately determine whether there is an attack risk.

[0166] The module's internal workflow can be broken down into four key steps: data correlation, multi-dimensional deviation calculation, dynamic threshold generation, and risk adjudication and alert generation. Through the close coordination of these four steps, the deviation analysis and adjudication module can assess the credibility of perceived data in a highly sensitive and robust manner in real time, forming a core defense against deception attacks.

[0167] The response execution module is the executor of the attack detection system. It is responsible for translating the security risks identified by the upstream module into specific and effective protective actions for the autonomous driving system. The design principle of this module is to maintain the vehicle's normal driving functions as much as possible while ensuring maximum driving safety, achieving a smooth degradation. As the interface between the attack detection system and the vehicle's main intelligent driving software, the output of this module directly affects the final environmental perception results.

[0168] This module communicates with the perception fusion module of intelligent driving through a predefined application programming interface (API). This API allows the response execution module to pass control requests for specific data sources or specific targets to the fusion module in a standardized format.

[0169] The response execution module enables the attack identification system not only to see threats but also to defend against attacks. It establishes a connection between the security system and the vehicle's main functional systems, allowing the results of security analysis to be translated into practical protective measures in a precise, hierarchical manner that minimizes the impact on the overall vehicle performance, ultimately ensuring the driving safety of intelligent vehicles in complex network environments.

[0170] Exemplary device Accordingly, this application also provides an attack identification device for use in vehicles equipped with intelligent driving systems.

[0171] like Figure 4 As shown, the device may include: The first determining module 401 is used to determine the first motion state data of the vehicle in the world coordinate system at the current moment based on the preset vehicle physical model and the motion state data of the vehicle at the previous moment.

[0172] The second determining module 402 is used to determine the second motion state data of the external target in the world coordinate system at the current moment based on the preset motion model and the reliable motion state data of the external target at the previous moment.

[0173] The third determining module 403 is used to determine the third motion state data of the external target relative to the vehicle based on the first motion state data and the second motion state data.

[0174] The fourth determination module 404 is used to determine the fourth motion state data of the external target relative to the vehicle at the current moment based on the actual perception data obtained by the perception sensors on the vehicle.

[0175] The detection module 405 is used to compare the third motion state data at the same time with the fourth motion state data, and determine whether the vehicle's perception system has been attacked based on the comparison result.

[0176] Optionally, the detection module 405 may include: The deviation determination submodule is used to determine the deviation value between the third motion state data and the fourth motion state data at the same time.

[0177] The deviation threshold determination submodule is used to determine the corresponding target deviation threshold based on the current driving scenario information; different driving scenarios correspond to different deviation thresholds.

[0178] The detection submodule is used to compare the deviation value with the target deviation threshold and determine whether the vehicle's perception system has been attacked based on the comparison result.

[0179] Optionally, the deviation threshold determination submodule may include: The adjustment factor determination unit is used to determine the corresponding target situation adjustment factor based on the current driving situation information.

[0180] The deviation threshold determination unit is used to determine the target deviation value threshold based on the target situation adjustment factor and the preset basic deviation threshold.

[0181] Optionally, the current driving situation information includes the vehicle's speed and maneuvering status.

[0182] The adjustment factor determination unit can be specifically used for: Based on the vehicle's maneuvering status, determine the intensity of the vehicle's maneuvering; based on the intensity of the vehicle's maneuvering and the vehicle's speed, determine the target situation adjustment factor.

[0183] Optionally, the first determining module 401 may include: The first data determination submodule is used to determine the fifth motion state data of the vehicle at the current moment based on the target sensor of the vehicle; wherein the target sensor includes at least one of the following: an inertial measurement unit, a wheel speed sensor, and a steering angle sensor.

[0184] The second data determination submodule is used to predict the sixth motion state data of the vehicle at the current moment based on the preset vehicle physical model and the motion state data of the vehicle at the previous moment.

[0185] The third data determination submodule is used to correct the fifth motion state data using the sixth motion state data to obtain the first motion state data of the vehicle at the current moment.

[0186] Optionally, the second determining module 402 may include: The target determination submodule is used to determine the external target based on trusted environment information; wherein the trusted environment information includes at least one of the following: historical trusted perception results and prior information from the map.

[0187] Optionally, the detection module 405 may be specifically used for: If an external target consistently indicates that the deviation value exceeds the target deviation threshold in the comparison results of consecutive preset frames of data, it is determined that the vehicle's perception system has been attacked, and a risk warning message is output; wherein, the risk warning message includes at least one of the following: risk level, information of the attacked target perception sensor, and information of the abnormal external target.

[0188] Optionally, after determining that the vehicle's perception system has been attacked, the device may further include: The decision module is used to reduce the weight of the perception data collected by the target perception sensor in the multi-sensor data fusion calculation; or to discard the perception data about the abnormal external target collected by the target perception sensor when performing multi-sensor data fusion calculation.

[0189] The attack identification device provided in this embodiment belongs to the same concept as the attack identification method provided in the above embodiments of this application. It can execute the attack identification method provided in any of the above embodiments of this application and has the corresponding functional modules and beneficial effects of the execution method. Technical details not described in detail in this embodiment can be found in the specific processing content of the attack identification method provided in the above embodiments of this application, and will not be repeated here.

[0190] It should be understood that the modules in the above attack identification device can be implemented in the form of processor calling software. For example, the device includes a processor connected to a memory containing instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of each unit of the device. The processor can be a general-purpose processor, such as a CPU or microprocessor, and the memory can be internal or external to the device. Alternatively, the units in the device can be implemented in the form of hardware circuits. By designing the hardware circuits, some or all of the unit functions can be implemented. The hardware circuit can be understood as one or more processors. For example, in one implementation, the hardware circuit is an ASIC, and the functions of some or all of the above units are implemented by designing the logical relationships of the components within the circuit. In another implementation, the hardware circuit can be implemented using a PLD, such as an FPGA, which can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files to implement the functions of some or all of the above units. All units of the above device can be implemented entirely in the form of processor calling software, entirely in the form of hardware circuits, or partially in the form of processor calling software with the remaining parts implemented in the form of hardware circuits.

[0191] In this application embodiment, a processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction reading and execution capabilities, such as a CPU, microprocessor, GPU, or DSP. In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. These logical relationships are fixed or reconfigurable. For example, the processor may be a hardware circuit implemented as an ASIC or PLD, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the processor loading instructions to implement the functions of some or all of the above units. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as an NPU, TPU, or DPU.

[0192] As can be seen, each unit in the above device can be one or more processors (or processing circuits) configured to implement the above methods, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0193] Furthermore, the units in the above devices can be integrated in whole or in part, or they can be implemented independently. In one implementation, these units are integrated together and implemented in the form of a System-on-Chip (SoC). The SoC may include at least one processor for implementing any of the above methods or implementing the functions of the units in the device. The at least one processor may be of different types, such as CPU and FPGA, CPU and artificial intelligence processor, CPU and GPU, etc.

[0194] Exemplary electronic devices This application also provides an electronic device, such as... Figure 5 As shown, the electronic device includes a memory 500 and a processor 510.

[0195] The memory 500 is connected to the processor 510 and is used to store programs.

[0196] The processor 510 is used to implement the attack identification method in the above embodiments by running the program stored in the memory 500.

[0197] Specifically, the aforementioned electronic device may also include: a communication interface 520, an input device 530, an output device 540, and a bus 550.

[0198] The processor 510, memory 500, communication interface 520, input device 530, and output device 540 are interconnected via a bus. Among them: Bus 550 may include a pathway for transmitting information between various components of a computer system.

[0199] The processor 510 can be a general-purpose processor, such as a general-purpose central processing unit (CPU), a microprocessor, etc., or an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present invention. It can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0200] Processor 510 may include a main processor, as well as a baseband chip, modem, etc.

[0201] The memory 500 stores a program that executes the technical solution of this invention, and may also store an operating system and other key business functions. Specifically, the program may include program code, which includes computer operation instructions. More specifically, the memory 500 may include read-only memory (ROM), other types of static storage devices capable of storing static information and instructions, random access memory (RAM), other types of dynamic storage devices capable of storing information and instructions, disk storage, flash memory, etc.

[0202] Input device 530 may include a device for receiving data and information input by a user, such as a keyboard, mouse, camera, scanner, light pen, voice input device, touch screen, pedometer, or gravity sensor.

[0203] Output device 540 may include devices that allow information to be output to a user, such as a display screen, printer, speaker, etc.

[0204] The communication interface 520 may include a device that uses any transceiver to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Network (WLAN), etc.

[0205] The processor 510 executes the program stored in the memory 500 and calls other devices, which can be used to implement the various steps in the attack identification method provided in the above embodiments of this application.

[0206] Exemplary computer program products and storage media In addition to the methods and devices described above, embodiments of this application may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps in the attack identification method described in the embodiments of this application.

[0207] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0208] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0209] Furthermore, embodiments of this application may also be storage media storing a computer program, which is executed by a processor of the steps in the attack identification method described in the embodiments of this application.

[0210] Furthermore, embodiments of this application may also be chips, which include processors and data interfaces. The processor reads instructions stored in the memory through the data interface to execute the steps in the attack identification method described in the embodiments of this application.

[0211] For the foregoing method embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0212] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0213] The steps in the methods of the various embodiments of this application can be adjusted, merged, or deleted in order according to actual needs, and the technical features described in each embodiment can be replaced or combined.

[0214] The modules and sub-modules in the devices and terminals in the various embodiments of this application can be merged, divided, and deleted according to actual needs.

[0215] It should be understood that the disclosed terminals, devices, and methods can be implemented in other ways, given the several embodiments provided in this application. For example, the terminal embodiments described above are merely illustrative. For instance, the division of modules or sub-modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple sub-modules or modules may be combined or integrated into another module, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0216] The modules or submodules described as separate components may or may not be physically separate. The components that constitute a module or submodule may or may not be physical modules or submodules; that is, they may be located in one place or distributed across multiple network modules or submodules. Some or all of the modules or submodules can be selected to achieve the purpose of this embodiment's solution, depending on actual needs.

[0217] Furthermore, the functional modules or sub-modules in the various embodiments of this application can be integrated into one processing module, or each module or sub-module can exist physically separately, or two or more modules or sub-modules can be integrated into one module. The integrated modules or sub-modules described above can be implemented in hardware or in the form of software functional modules or sub-modules.

[0218] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0219] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software unit executed by a processor, or a combination of both. The software unit can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0220] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. An attack identification method, characterized in that, The method includes: Based on the preset vehicle physical model and the vehicle's motion state data at the previous moment, determine the vehicle's first motion state data in the world coordinate system at the current moment; Based on the preset motion model and the reliable motion state data of the external target at the previous moment, determine the second motion state data of the external target in the world coordinate system at the current moment; Based on the first motion state data and the second motion state data, a third motion state data of the external target relative to the vehicle is determined; Based on the actual perception data obtained by the perception sensors on the vehicle, the fourth motion state data of the external target relative to the vehicle at the current moment is determined; The third motion state data at the same time is compared with the fourth motion state data, and the vehicle's perception system is determined based on the comparison result.

2. The attack identification method according to claim 1, characterized in that, The step of comparing the third motion state data with the fourth motion state data at the same time, and determining whether the vehicle's perception system has been attacked based on the comparison result, includes: Determine the deviation value between the third motion state data and the fourth motion state data at the same time; Based on the current driving scenario information, determine the corresponding target deviation threshold; different driving scenarios correspond to different deviation thresholds. The deviation value is compared with the target deviation threshold, and the vehicle's perception system is determined based on the comparison result to determine whether it has been attacked.

3. The attack identification method according to claim 2, characterized in that, The step of determining the corresponding target deviation threshold based on the current driving context information includes: Based on the current driving situation information, determine the corresponding target situation adjustment factor; The target deviation threshold is determined based on the target situation adjustment factor and the preset basic deviation threshold.

4. The attack identification method according to claim 3, characterized in that, The current driving situation information includes the vehicle's speed and maneuvering status; The step of determining the corresponding target scenario adjustment factor based on the current driving scenario information includes: The degree of intensity of the vehicle's movement is determined based on its maneuverability. The target situation adjustment factor is determined based on the degree of maneuvering of the vehicle and the vehicle speed.

5. The attack identification method according to claim 1, characterized in that, The step of determining the first motion state data of the vehicle in the world coordinate system at the current moment based on the preset vehicle physical model and the vehicle's motion state data at the previous moment includes: Based on the target sensors of the vehicle, the fifth motion state data of the vehicle at the current moment is determined; wherein, the target sensors include at least one of the following: an inertial measurement unit, a wheel speed sensor, and a steering angle sensor; Based on the vehicle's physical model and the vehicle's motion state data from the previous moment, predict the vehicle's sixth motion state data at the current moment. The fifth motion state data is corrected using the sixth motion state data to obtain the first motion state data of the vehicle at the current moment.

6. The attack identification method according to claim 1, characterized in that, Before determining the second motion state data of the external target in the world coordinate system at the current moment based on the preset motion model and the reliable motion state data of the external target at the previous moment, the method further includes: The external target is determined based on trusted environment information; wherein, the trusted environment information includes: results from historical trusted perception.

7. The attack identification method according to claim 2, characterized in that, The step of determining whether the vehicle's perception system has been attacked based on the comparison results includes: If an external target indicates that the deviation value exceeds the target deviation threshold in the comparison results of consecutive preset frames of data, it is determined that the vehicle's perception system has been attacked, and a risk warning message is output. The risk alert information includes at least one of the following: risk level, information of the target's sensor that was attacked, and information of abnormal external targets.

8. The attack identification method according to claim 7, characterized in that, After determining that the vehicle's perception system has been attacked, the method further includes: Reduce the weight of the perception data collected by the target perception sensor in the multi-sensor data fusion calculation; or discard the perception data about the abnormal external target collected by the target perception sensor when performing multi-sensor data fusion calculation.

9. An electronic device, characterized in that, include: Memory and processor; The memory is connected to the processor and is used to store programs; The processor is used to implement the attack identification method as described in any one of claims 1 to 8 by running the program in the memory.

10. A computer program product, characterized in that, The computer program product stores a computer program, which, when executed by a processor, implements the attack identification method as described in any one of claims 1 to 8.

Images