Vehicle behavior anomaly processing method and device based on eBPF

Abstract

This application relates to a method and apparatus for handling vehicle behavior anomalies based on eBPF. The method may include: acquiring current vehicle state information and current behavior information of a target vehicle service based on eBPF; extracting multi-dimensional features from the current behavior information and fusing the extracted multi-dimensional features to obtain a current behavior feature vector of the target vehicle service; performing behavior fingerprint matching processing on the current behavior feature vector based on reference behavior fingerprints in a behavior fingerprint database to obtain behavior fingerprint deviation information; and, when the behavior fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state, invoking eBPF to control the target vehicle service to perform anomaly handling operations matching the current vehicle state information. According to the technical solution provided in this application, the real-time performance, accuracy, and efficiency of vehicle anomaly detection can be improved, and the driving safety risks caused by unified processing can be avoided, achieving coordinated protection of information security and vehicle functional safety.

Description

Technical Field

[0001] This application relates to the field of intelligent vehicle safety monitoring technology, and in particular to a method and device for handling vehicle behavior anomalies based on eBPF. Background Technology

[0002] As the electronic and electrical architecture of intelligent vehicles evolves from distributed ECUs to a central computing platform and regional control architecture, the deep integration of intelligent driving and intelligent cockpits leads to the following characteristics in in-vehicle systems: a large number of AUTOSAR AP microservices run simultaneously with complex inter-service interaction dependencies; the intelligent driving domain and cockpit domain share perception, mapping, navigation, and other services, and the number of services continues to grow; the hybrid deployment of Linux and RTOS means that services may run across multiple systems; the AI ​​model inference load exhibits dynamic fluctuations, causing resource usage patterns to constantly change; and functional safety and information security requirements continue to increase. These characteristics collectively make the operational behavior of in-vehicle services increasingly complex and unpredictable.

[0003] Existing vehicle monitoring solutions primarily rely on system-level metrics, such as CPU utilization, memory usage, and network traffic, to assess service operational status. However, this coarse-grained resource monitoring approach has significant limitations: it cannot delve into the system kernel to capture subtle characteristics such as underlying resource calls and service behavior patterns. Especially when services are attacked externally or have code defects, it often doesn't immediately cause fluctuations in total resource usage, but rather manifests first as abnormal program behavior patterns, such as abnormal system call frequencies, abnormal memory allocation patterns, or abnormal scheduling latency distributions. Traditional monitoring methods rely on execution logs or source code templates to build behavioral models, but log recording itself has latency and depends on data integrity, making it impossible to capture these behavioral changes in real time. This results in a lag in service anomaly detection, missing the optimal intervention window, and potentially even impacting driving safety due to functional failure. Summary of the Invention

[0004] This application provides a method and apparatus for handling vehicle behavior anomalies based on eBPF, aiming to address at least the issues in related technologies regarding how to improve the real-time performance, accuracy, and efficiency of vehicle anomaly detection. The technical solution of this application is as follows: According to a first aspect of the embodiments of this application, a method for handling in-vehicle behavior anomalies based on eBPF is provided, comprising: Based on eBPF, the current vehicle status information and the current behavior information of the target in-vehicle service are obtained; the current behavior information is used to characterize the current multi-dimensional interaction state and current resource consumption characteristics of the target in-vehicle service in the vehicle system. Multidimensional features are extracted from the current behavior information, and the extracted multidimensional features are fused to obtain the current behavior feature vector of the target vehicle service; Based on the reference behavioral fingerprint in the behavioral fingerprint database, behavioral fingerprint matching processing is performed on the current behavioral feature vector to obtain behavioral fingerprint deviation information; the reference behavioral fingerprint is constructed by the historical behavioral information of the target vehicle service pre-collected by eBPF, and is used to characterize the distribution center information and normal fluctuation range of the behavioral features of the target vehicle service in various dimensions under normal operation. When the behavioral fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state, eBPF is invoked to control the target vehicle service to perform an exception handling operation that matches the current vehicle state information.

[0005] According to a second aspect of the embodiments of this application, an eBPF-based vehicle behavior anomaly handling device is provided, comprising: The behavior information acquisition module is used to acquire the current vehicle status information and the current behavior information of the target vehicle service based on eBPF; the current behavior information is used to characterize the current multi-dimensional interaction state and current resource consumption characteristics of the target vehicle service in the vehicle system; The feature fusion module is used to extract multi-dimensional features from the current behavior information and fuse the extracted multi-dimensional features to obtain the current behavior feature vector of the target vehicle service. The behavior fingerprint deviation information determination module is used to perform behavior fingerprint matching processing on the current behavior feature vector based on the reference behavior fingerprint in the behavior fingerprint database to obtain behavior fingerprint deviation information. The reference behavior fingerprint is constructed by the historical behavior information of the target vehicle service pre-collected by eBPF and is used to characterize the distribution center information and normal fluctuation range of the behavior features of the target vehicle service in various dimensions under normal operation. The exception handling module is used to call eBPF to control the target vehicle service to perform exception handling operations that match the current vehicle state information when the behavior fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state.

[0006] According to a third aspect of the embodiments of this application, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the method as described in any one of the first aspects above.

[0007] According to a fourth aspect of the present application, a computer-readable storage medium is provided, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform any of the methods described in the first aspect of the present application. According to a fifth aspect of the embodiments of this application, a computer program product is provided, including computer instructions that, when executed by a processor, cause a computer to perform the method described in any one of the first aspects of the embodiments of this application.

[0008] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this application.

[0009] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects: Based on the eBPF, the current vehicle status information and the current behavior information of the target vehicle service can be obtained. Without modifying the application code or restarting the service, the overhead of deeply capturing the underlying behavioral characteristics of the service in multiple dimensions such as system calls, memory access, and scheduling latency in the system kernel can be reduced. This overcomes the defect of traditional system-level resource monitoring that cannot detect abnormal behavior patterns in real time and improves the authenticity and real-time performance of the collected data. By extracting and fusing multidimensional features from current behavior information to generate a current behavior feature vector, and matching it with a reference behavior fingerprint constructed based on historical behavior information pre-collected by eBPF to obtain behavior fingerprint deviation information, it is possible to use the pre-collected historical behavior information to construct a reference benchmark that represents the distribution center information and normal fluctuation range under normal operating conditions, thereby accurately quantifying the degree of deviation between the current behavior and the normal baseline and effectively identifying abnormal behavior patterns hidden under normal resource occupation. When the behavioral fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state, the eBPF is invoked to control the target vehicle service to perform anomaly handling operations that match the current vehicle state information. This can implement differentiated handling strategies based on the current driving conditions of the vehicle, avoiding driving safety risks caused by a uniform anomaly handling method, and achieving coordinated protection of information security and vehicle functional safety.

[0010] Other features and aspects of this application will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0011] To more clearly illustrate the technical solutions and advantages in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart illustrating an eBPF-based method for handling vehicle behavior anomalies according to an exemplary embodiment.

[0013] Figure 2 This is a flowchart illustrating a deviation information determination method according to an exemplary embodiment. Figure 1 .

[0014] Figure 3 This is a flowchart illustrating a deviation information determination method according to an exemplary embodiment. Figure 2 .

[0015] Figure 4 This is a flowchart illustrating an anomaly level determination method according to an exemplary embodiment.

[0016] Figure 5 This is a flowchart illustrating a hierarchical processing strategy determination method according to an exemplary embodiment.

[0017] Figure 6 This is a block diagram of an eBPF-based vehicle behavior anomaly handling device according to an exemplary embodiment.

[0018] Figure 7 This is a block diagram of an electronic device for handling in-vehicle behavior anomalies based on an exemplary embodiment. Figure 1 .

[0019] Figure 8 This is a block diagram of an electronic device for handling in-vehicle behavior anomalies based on an exemplary embodiment. Figure 2 . Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments in the specification, and not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0022] Various exemplary embodiments, features, and aspects of this application will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0023] The term "exemplary" as used herein means "serving as an example, embodiment, or illustration." Any embodiment illustrated herein as "exemplary" is not necessarily to be construed as superior to or better than other embodiments. The term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships may exist, for example, A and / or B, which can represent: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more of a plurality, for example, including at least one of A, B, and C, which can represent including any one or more elements selected from the set consisting of A, B, and C.

[0024] Unless otherwise specified, the directions in this article should be understood as follows: the direction closer to the user is forward, and the direction farther from the user is backward.

[0025] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed description. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0026] Existing vehicle monitoring strategies mainly rely on coarse-grained system-level indicators such as CPU utilization, memory usage, and network traffic to assess service operation status. This monitoring method cannot delve into the kernel to capture subtle changes in service at the underlying resource call and behavior pattern level. When a service is attacked or has code defects, it often manifests first as abnormal program behavior patterns, while the total resource usage has not yet fluctuated significantly. Traditional monitoring methods cannot detect these behavioral changes, and combined with the inherent latency issues in log analysis, anomaly detection is severely delayed, missing the best intervention opportunity, and may even affect driving safety due to functional failure.

[0027] To address the aforementioned technical problems, this application provides a vehicle behavior anomaly handling method and apparatus based on eBPF. This method can acquire real-time behavior information of vehicle services, improving the real-time performance, accuracy, and detection efficiency of vehicle anomaly handling. It also avoids driving safety risks arising from a uniform anomaly handling approach, achieving coordinated protection of information security and vehicle functional safety. Specifically, as shown in the following embodiments.

[0028] Figure 1This is a flowchart illustrating an eBPF-based method for handling in-vehicle behavior anomalies, according to an exemplary embodiment. Figure 1 As shown, the steps may include the following.

[0029] In step S101, based on eBPF, the current vehicle status information and the current behavior information of the target vehicle service are obtained.

[0030] In this embodiment, eBPF (Extended Berkeley Packet Filter) refers to the security sandbox mechanism built into the Linux kernel, allowing users to run verified sandbox programs in kernel mode to securely and efficiently track and monitor kernel events without modifying the kernel source code or loading kernel modules. In this embodiment, eBPF is used to hook system calls, memory accesses, and scheduling events of the target vehicle service in kernel mode, collecting service runtime behavior data in a low-overhead and non-intrusive manner.

[0031] This application defines four types of Maps in the eBPF kernel space for data aggregation: a system call statistics Map (syscall_stats_map), using a per-CPU array map structure, with process PID, system call ID, and time bucket as keys, and call count, total latency, and return code mask as values; a memory access statistics Map (mem_access_map), using a per-CPU Hash Map structure, with process PID, allocation type, and time bucket as keys, and total allocation size, allocation count, and size variance as values; a scheduling latency statistics Map (sched_latency_map), using a per-CPU array map structure, with process PID and time bucket as keys, and wake-up count, total scheduling latency, maximum latency, and preemption count as values; and a control configuration Map (control_map), used to store dynamic configuration parameters such as sampling rate, load threshold, and function switches. The above eBPF Maps perform data aggregation in kernel space, and the user-space Agent periodically reads the statistical results from the Maps, avoiding the performance overhead of reporting raw events one by one.

[0032] Current vehicle status information can refer to the vehicle's driving conditions at the current moment, including vehicle speed (such as parking, low-speed driving, high-speed driving) and driving mode (such as manual driving mode, assisted driving mode, and automatic driving mode). This application does not limit this.

[0033] The target in-vehicle service can refer to the in-vehicle software service instance that is monitored and protected in the vehicle system, including but not limited to the Adaptive Application (AA) process under the AUTOSAR AP architecture, such as perception service, planning and decision service, positioning service, map service, voice interaction service, entertainment service, etc. This application does not limit it.

[0034] Current behavior information can refer to the raw behavior data generated by the target vehicle service during its current operation, collected through eBPF. This includes system call sequences, such as which system calls were made, call frequency, and return values; memory access patterns, such as memory allocation size, allocation frequency, and release patterns; and scheduling delay distribution, such as scheduling wait time, CPU usage time, and number of preemptions. These data are used to characterize the current multidimensional interaction state and current resource consumption characteristics of the target vehicle service in the vehicle system.

[0035] In one possible implementation, monitoring logic is dynamically injected into the Linux kernel using eBPF. By attaching the eBPF program to system call trace points, kernel probes, and scheduling-related events, kernel-level behavioral data generated by the target vehicle service during operation can be captured in real time in an event-driven manner.

[0036] Because the eBPF program performs data collection and preliminary aggregation directly in kernel space, only periodically uploading statistical results to user space, it avoids the process context switching overhead caused by system call hijacking in traditional monitoring tools such as strace. The overall performance loss can be controlled within 5%, meeting the requirements of low overhead and real-time performance in automotive embedded environments. This application does not impose any limitations on performance loss. The above configuration ensures zero-intrusion kernel-level behavioral data collection without modifying the target service code or restarting the process. Simultaneously, by accessing kernel data structures through the eBPF program, real-time vehicle status information such as vehicle speed and driving mode is obtained, as well as raw behavioral data characterizing the current interaction state and resource consumption characteristics of the target automotive service in multiple dimensions such as system calls, memory access, and scheduling latency—that is, current behavioral information.

[0037] In one possible implementation, this embodiment can also dynamically adjust the eBPF sampling rate based on system load: when CPU utilization is below 50%, all sensitive system calls are collected; when CPU utilization is between 50% and 70%, the sampling rate is adjusted to 50%; when CPU utilization is between 70% and 85%, the sampling rate is adjusted to 25%, monitoring only high-risk system calls such as execve, socket, and open; when CPU utilization exceeds 85%, the sampling rate is adjusted to 10%. Through the above dynamic sampling strategy, the eBPF collection overhead is automatically reduced under high system load, ensuring system stability.

[0038] In step S103, multi-dimensional features are extracted from the current behavior information and the extracted multi-dimensional features are fused to obtain the current behavior feature vector of the target vehicle service.

[0039] In the embodiments of this specification, the current behavior feature vector can refer to a mathematical vector obtained after multi-dimensional feature extraction and feature fusion of the current behavior information, such as the current behavior feature vector V=[f1, f2, ..., fn].

[0040] In one possible implementation, after periodically reading the aggregated results of the raw behavior data collected from the kernel layer of eBPF, i.e., the current behavior information, multi-dimensional feature extraction processing is performed on the current behavior information.

[0041] Specifically, a system call feature extractor is used to extract system call features from the system call sequence of the current behavior information. The system call features include multi-dimensional sub-features, such as call frequency vector (i.e., the distribution of the number of various system calls), return value distribution (i.e., the success / error ratio), and call interval distribution (i.e., the statistics of the time interval between consecutive calls). This application does not limit these features.

[0042] The memory access feature extractor extracts memory access features from memory access tracking data of current behavior information. The memory access features include multi-dimensional sub-features, such as the mean and variance of allocation size, allocation frequency, allocation amount per unit time, and memory region dispersion. This application does not limit these features.

[0043] The scheduling delay feature extractor extracts scheduling delay features from the scheduling tracking data of the current behavior information. The scheduling delay features include multi-dimensional sub-features, such as average scheduling delay, delay standard deviation, 99th percentile delay, and preemption rate. This application does not limit these features.

[0044] Furthermore, the extracted multidimensional features, namely system call features, memory access features, and scheduling delay features, are subjected to feature fusion processing, that is, the above three types of features are concatenated and combined into a unified mathematical vector to obtain the current behavior feature vector including multidimensional behavioral features.

[0045] In one example, this application can also construct cross-layer composite features to improve the accuracy of anomaly detection. For example, it calculates the system call density per unit CPU cycle, i.e., the ratio of the number of system calls to the number of CPU cycles, reflecting whether the computational density of the service is stable under normal conditions; it calculates the memory allocation jitter after specific system calls, such as execve or socket, i.e., the variance change in memory allocation size, to detect abnormal memory patterns after code injection; and it calculates the deviation between the amount of data received over the network and the amount of data written to the disk, to detect covert data transmission behavior. These composite features, along with other statistical features, are input into the behavioral feature vector to further enhance the detection capability of covert attacks.

[0046] In step S105, based on the reference behavioral fingerprint in the behavioral fingerprint database, behavioral fingerprint matching processing is performed on the current behavioral feature vector to obtain behavioral fingerprint deviation information; In the embodiments of this specification, the behavior fingerprint database refers to a database that stores reference behavior fingerprints of each target vehicle service, serving as a reference benchmark for maintaining the normal operation behavior of each service.

[0047] The reference behavioral fingerprint is a mathematical benchmark obtained by statistical learning fitting of a large number of historical behavioral samples of the target vehicle service under normal operation, which are pre-collected by eBPF. It contains the distribution center information of behavioral features in various dimensions, such as the mean μ and the normal fluctuation range, such as the standard deviation σ and the covariance matrix Σ.

[0048] Distribution center information can refer to the statistical mean (μ) of each dimension of behavioral characteristics in the reference behavioral fingerprint under normal conditions. For example, the average frequency of the execve system call in the perception service under normal operating conditions is 0.1 times / minute, and this value is the distribution center information of the execve frequency dimension.

[0049] Normal fluctuation range can refer to the statistical dispersion of each dimension of behavioral features in the reference behavioral fingerprint under normal conditions, including standard deviation (σ) and covariance matrix (Σ).

[0050] Behavioral fingerprint deviation information refers to the result of behavioral fingerprint matching processing, including first deviation information, namely Mahalanobis distance, and second deviation information, namely comprehensive deviation. Mahalanobis distance is used to comprehensively evaluate the overall deviation of the current behavioral vector after considering the correlation of each dimension; comprehensive deviation is used to evaluate the independent deviation of each dimension by weighted average.

[0051] In one possible implementation, when multiple vehicle services are in normal operation, eBPF collects the historical behavior feature vectors of each of the multiple vehicle services within a preset historical time window; the multiple vehicle services include the target vehicle service; based on a statistical learning algorithm, the historical behavior feature vectors are subjected to statistical distribution fitting to obtain the reference behavior fingerprints corresponding to each of the multiple vehicle services; and a behavior fingerprint database is constructed based on the reference behavior fingerprints corresponding to each of the multiple vehicle services.

[0052] Specifically, assuming multiple in-vehicle services are operating normally (i.e., the vehicle is in healthy operation with no known faults or attacks, and all services function normally and perform stably), eBPF collects historical behavior feature vectors for each of the multiple in-vehicle services within a preset historical time window. These multiple in-vehicle services include target in-vehicle services that need to be monitored subsequently, such as perception services, planning and decision-making services, positioning services, map services, and voice interaction services; this application does not limit the specific services included in this category. The preset historical time window is, for example, the operating period of the most recent 24 hours or the most recent week, and the number of samples for the collected historical behavior feature vectors must meet statistical requirements, such as 1000 to 5000 samples, to ensure accuracy in subsequent fingerprint matching. The historical behavior feature vectors have the same feature dimension structure as the aforementioned current behavior feature vectors, for example, both including statistical information on three dimensions: system call frequency characteristics, memory access characteristics, and scheduling latency characteristics.

[0053] After collecting a sufficient number of historical behavior feature vector samples, statistical distribution fitting processing is performed on the historical behavior feature vectors based on statistical learning algorithms, such as maximum likelihood estimation or moment estimation. That is, the mean (μ) and standard deviation (σ) of each dimension feature under normal operating conditions are calculated, as well as the covariance matrix (Σ) between each dimension, so as to obtain the reference behavior fingerprints corresponding to each of the multiple vehicle services.

[0054] Multiple in-vehicle services are associated with and stored using their respective reference behavioral fingerprints, based on service identifiers such as service names or service IDs, to construct a behavioral fingerprint database. Each reference behavioral fingerprint in the database corresponds one-to-one with an in-vehicle service, enabling the rapid retrieval and loading of the corresponding reference behavioral fingerprint from the database for behavioral fingerprint matching when monitoring any target in-vehicle service.

[0055] In one possible implementation, the behavioral fingerprint database supports dynamic updates. For example, when the service version of the in-vehicle service is upgraded or the operating environment changes, the corresponding reference behavioral fingerprint can be adaptively updated through statistical learning algorithms to match the evolution of the normal operating behavior pattern of the service.

[0056] Specifically, when the service version of the vehicle service is upgraded, such as when the perception service is upgraded from V1.0 to V2.0, new algorithm modules or system call logic are introduced, or the operating environment changes, such as when the operating system kernel version is updated, the underlying hardware platform is replaced, or the system configuration parameters are adjusted, the original reference behavior fingerprint will no longer be able to accurately represent the current normal operating status.

[0057] Furthermore, after confirming that the target vehicle service is in normal operating condition—that is, after passing functional safety checks, meeting service health standards, and having no abnormal alarms—the statistical learning algorithm is re-triggered. This process collects new historical behavioral feature vectors of the service within a preset historical time window after version upgrades or environmental changes. The corresponding reference behavioral fingerprint is then adaptively updated using the same statistical distribution fitting method described above to match the target vehicle service's behavioral pattern after version upgrades or environmental changes. After the new fingerprint is generated, the original reference behavioral fingerprint corresponding to the vehicle service in the behavioral fingerprint database can be deleted, and replaced with the new reference behavioral fingerprint. This ensures that the behavioral fingerprint database always retains only the latest version of the reference benchmark, avoiding subsequent misloading or misjudgment due to old fingerprint residue. This ensures that the reference benchmark in the behavioral fingerprint database always accurately reflects the current normal operating status of the service, effectively eliminating interference from old version fingerprints in anomaly detection.

[0058] Figure 2 This is a flowchart illustrating a deviation information determination method according to an exemplary embodiment. Figure 2 As shown, it includes the following steps.

[0059] Step S201: Extract the fingerprint center vector and fingerprint covariance matrix from the reference behavioral fingerprint; Step S203: Subtract the current behavior feature vector from the fingerprint center vector to obtain the feature vector deviation information; Step S205: Multiply the transpose of the feature vector deviation information, the inverse of the fingerprint covariance matrix, and the feature vector deviation information to obtain an intermediate product result. Step S207: Perform square root processing on the intermediate product results to obtain the first deviation information.

[0060] Specifically, the fingerprint center vector, which is the mean vector of each dimension of behavioral features under normal operating conditions, such as μ=[μ1, μ2, ..., μn], and the fingerprint covariance matrix, which is the covariance matrix between each dimension of behavioral features under normal operating conditions, such as Σ, are extracted from the reference behavioral fingerprint.

[0061] Furthermore, the current behavior feature vector V=[f1, f2, ..., fn] is subtracted from the fingerprint center vector μ=[μ1, μ2, ..., μn] to obtain the feature vector deviation information V-μ, which represents the original deviation of the current behavior relative to the normal baseline in each dimension; then the feature vector deviation information is transposed, i.e., (V-μ). The inverse matrix of the fingerprint covariance matrix, i.e., Σ - ¹ and the eigenvector deviation information, i.e., (V-μ), are multiplied to obtain the intermediate product result, i.e., (V-μ). ×Σ - ¹×(V-μ). Finally, the square root of the intermediate product result is taken to obtain the first deviation information D_M(V).

[0062] Specifically, the formula for the first deviation information is: D_M(V) = sqrt((V-μ)) ×Σ - ¹×(V-μ)).

[0063] The Mahalanobis distance, by introducing the inverse of the covariance matrix as weights, effectively eliminates the correlation between behavioral features across different dimensions. For example, when memory allocation and system call frequency exhibit synchronous changes under normal conditions, the Mahalanobis distance automatically normalizes this correlation, preventing misjudgment of abnormalities due to normal co-variance. This provides a high-precision measure of overall behavioral deviation, quantifying the degree of overall deviation of the current behavior relative to the normal behavioral fingerprint. A larger value for the first deviation indicates a more significant overall deviation between the current behavior and the normal operating mode.

[0064] Figure 3 This is a flowchart illustrating a deviation information determination method according to an exemplary embodiment. Figure 3 As shown, it includes the following steps.

[0065] Step S301: Obtain the service type identifier of the target vehicle service; Step S303: Determine the feature weight coefficients corresponding to each dimension of the behavioral features in the current behavioral feature vector based on the service type identifier; Step S305: Extract the fingerprint standard deviation from the reference behavioral fingerprint; Step S307: Subtract the behavioral features of each dimension in the current behavioral feature vector from the corresponding center dimension features in the fingerprint center vector to obtain feature deviation information; Step S309: Determine the standardized deviation information corresponding to each dimension of behavioral features based on the ratio of the absolute value of the feature deviation information to the standard deviation of the fingerprint. Step S311: Multiply the feature weight coefficients corresponding to each dimension of behavioral features with the standardized deviation information corresponding to each dimension of behavioral features to obtain the fingerprint deviation results of each dimension of behavioral features. Step S313: Accumulate the fingerprint deviation results of behavioral features in each dimension to obtain the fingerprint deviation accumulation result; accumulate the feature weight coefficients to obtain the feature weight accumulation result. Step S315: Divide the fingerprint deviation accumulation result by the feature weight accumulation result to obtain the second deviation information.

[0066] Specifically, the service type identifier of the target in-vehicle service is obtained, such as a Class A real-time service, a Class B interactive service, or a Class C backend service. Based on the service type identifier, the feature weight coefficient wi corresponding to each dimension of the current behavior feature vector is determined. For example, for Class A real-time services such as perception and control, which have extremely high real-time requirements, the weight of the scheduling delay feature dimension is set to the highest, for example, 0.6, while the system call frequency feature dimension and memory access feature dimension each account for 0.2. For Class B interactive services such as human-machine interface and navigation, a relatively balanced weight configuration is adopted, for example, 0.4 for the system call frequency feature dimension, 0.4 for the memory access feature dimension, and 0.2 for the scheduling delay feature dimension. For backend services such as log upload and OTA upgrade, the weight of the scheduling delay feature is set to the lowest, for example, 0.5 for the system call frequency feature dimension, 0.4 for the memory access feature dimension, and 0.1 for the scheduling delay feature dimension. This application does not limit this.

[0067] After determining the feature weight coefficients corresponding to each dimension, the standard deviation, i.e., the standard deviation σ of each dimension feature under normal operating conditions, is extracted from the reference behavioral fingerprint. Then, the behavioral feature fi- of each dimension in the current behavioral feature vector is subtracted from the corresponding central dimension feature μi in the fingerprint center vector to obtain the feature deviation information corresponding to each dimension, i.e., fi-μi. Further, the feature deviation information corresponding to each dimension is ratioed to the corresponding fingerprint standard deviation σi, i.e., |fi-μi| / σi is calculated to obtain the standardized deviation information corresponding to each dimension behavioral feature, i.e., di=|fi-μi| / σi. Here, the standardized deviation information is used to characterize the degree of deviation of the current feature value of each dimension from its normal fluctuation range. di=1 indicates a deviation of 1 standard deviation, di=2 indicates a deviation of 2 standard deviations, and this application does not limit this.

[0068] Next, the feature weight coefficients *wi* corresponding to each dimension of behavioral features are multiplied with the standardized deviation information corresponding to each dimension of behavioral features, i.e., *wi*×di is calculated to obtain the fingerprint deviation result *wi*×di* for each dimension of behavioral features. Then, the fingerprint deviation results for each dimension of behavioral features are accumulated, i.e., Σ(wi*di) is calculated to obtain the cumulative fingerprint deviation result Σ(wi*di). Finally, the cumulative fingerprint deviation result is divided by the cumulative feature weight result, i.e., Σ(wi*di) / Σwi is calculated to obtain the second deviation information D_composite. The formula for the second deviation information D_composite is D_composite=Σ(wi*di) / Σwi. The second deviation information is the comprehensive deviation degree; the larger its value, the more significant the weighted comprehensive deviation of the current behavior from the normal operating mode. This comprehensive deviation score, through differentiated weights matched with the target vehicle service type, enables adaptive adjustment of the monitoring focus for different service types. For example, real-time services focus on scheduling latency, interactive services pay balanced attention to all dimensions, and backend services ignore the scheduling latency dimension. This makes anomaly detection more targeted and effectively reduces the false alarm rate caused by differences in service types.

[0069] In one possible implementation, if the first deviation information is greater than the first behavior anomaly threshold, the target vehicle service is determined to be in an abnormal operating state; or if the first deviation information is less than or equal to the first behavior anomaly threshold and the second deviation information is greater than the second behavior anomaly threshold, the target vehicle service is determined to be in an abnormal operating state; the second behavior anomaly threshold is less than the first behavior anomaly threshold.

[0070] Specifically, this application employs a dual-determination mechanism to determine abnormal operating states. First, it determines whether the first deviation information, namely the Mahalanobis distance D_M(V), is greater than the first row's anomaly threshold T_M. If the first deviation information D_M(V) is greater than the first row's anomaly threshold T_M, then the target vehicle service is directly determined to be in an abnormal operating state. The Mahalanobis distance eliminates the correlation effects between dimensions through the covariance matrix, providing a high-precision overall deviation measure and serving as the primary criterion for anomaly determination. If the first deviation information D_M(V) is less than or equal to the first line's anomaly threshold T_M, meaning the Mahalanobis distance is not exceeded, then the second deviation information D_composite, i.e., the comprehensive deviation, is further determined to be greater than the second line's anomaly threshold T_C. If the second deviation information D_composite is greater than the second line's anomaly threshold T_C, then the target vehicle service is determined to be in an abnormal operating state. The comprehensive deviation is calculated independently for each dimension, standardized deviations, and then weighted and averaged. This can detect scenarios where a single dimension deviates drastically, but the Mahalanobis distance fails to trigger an alarm due to correlation considerations, such as a sudden increase in the frequency of execve calls while other dimensions remain normal.

[0071] In another possible implementation, if the first deviation information is less than or equal to the first behavior anomaly threshold and the second deviation information is less than or equal to the second behavior anomaly threshold, the target vehicle service is determined to be in normal operation.

[0072] By combining the Mahalanobis distance (the first deviation information) and the comprehensive deviation (the second deviation information) through the above dual judgment mechanism, a double insurance is formed to minimize missed detections and improve the accuracy and reliability of anomaly detection.

[0073] In step S107, if the behavioral fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state, the eBPF is invoked to control the target vehicle service to perform an abnormal handling operation that matches the current vehicle state information.

[0074] In the embodiments of this specification, the abnormal operating state can refer to the state in which the deviation of the current behavior feature vector of the target vehicle service from its reference behavior fingerprint exceeds a preset behavior abnormality threshold.

[0075] Anomaly handling operations can refer to graded handling measures executed according to the anomaly level, including various types such as complete isolation actions, service degradation actions, and security degradation mode actions, and this application does not limit them.

[0076] In one possible implementation, when the behavioral fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state, the abnormality level corresponding to the target vehicle service is determined based on the current vehicle state information; based on the abnormality level, a hierarchical abnormality handling strategy corresponding to the abnormality level is generated, and eBPF is invoked to control the target vehicle service to execute the abnormality handling operation matching the hierarchical abnormality handling strategy.

[0077] Figure 4 This is a flowchart illustrating an anomaly level determination method according to an exemplary embodiment. For example... Figure 4 As shown, it includes the following steps.

[0078] Step S401: Obtain the security service identifier of the target vehicle service. The security service identifier is used to indicate whether the target vehicle service is a security service. Step S403: If the current vehicle status information is in a parked state, determine that the target vehicle service is in the first abnormal level. Step S405: If the current vehicle status information is in a driving state and the safety service identifier indicates that the target vehicle service is a non-safe service, determine that the target vehicle service is at the second abnormal level; the first abnormal level is higher than the second abnormal level. Step S407: If the current vehicle status information is in driving status and the safety service identifier indicates that the target vehicle service is a safe service, determine that the target vehicle service is at the third abnormal level; the second abnormal level is higher than the third abnormal level.

[0079] Specifically, while acquiring the current vehicle status information, the safety service identifier of the target in-vehicle service is also acquired. The safety service identifier indicates whether the target in-vehicle service is a safety service, i.e., a safety-critical service. Specifically, the safety service identifier can be determined by reading the ASIL (Automotive Safety Integrity Level) field configured in the target in-vehicle service's Manifest file: when the ASIL level is A, B, C, or D, the safety service identifier indicates that the target in-vehicle service is a safety service; when the ASIL level is QM (Quality Management), the safety service identifier indicates that the target in-vehicle service is a non-safety service.

[0080] If the behavioral fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state, the current vehicle status information is determined. If the current vehicle status information indicates that the vehicle is parked, since the vehicle is stationary, performing any handling operation on the abnormal service will not affect driving safety. Therefore, the target vehicle service is determined to be in the first abnormal level, which is the highest level.

[0081] When the current vehicle status information is in driving status, the determination is further combined with the safety service identifier: if the safety service identifier indicates that the target vehicle service is a non-safe service, such as an in-vehicle entertainment system or navigation service, then the target vehicle service is determined to be in the second abnormal level, that is, the medium level. When the current vehicle status information indicates a driving state, if the safety service identifier indicates that the target in-vehicle service is a safety service, such as a perception service or a planning and decision-making service, then the target in-vehicle service is determined to be at the third anomaly level, the lowest level. The first anomaly level is higher than the second anomaly level, and the second anomaly level is higher than the third anomaly level. That is, the higher the level, the more aggressive the anomaly handling operations allowed. For example, the first anomaly level can perform complete isolation actions, including process killing and network isolation; the second anomaly level only performs service degradation actions; and the third anomaly level only performs security degradation mode actions, such as limiting resources but not killing processes.

[0082] Figure 5 This is a flowchart illustrating a method for determining a hierarchical processing strategy according to an exemplary embodiment. Figure 5 As shown, it includes the following steps.

[0083] Step S501: If the target vehicle service is at the first abnormal level, generate a first abnormality handling strategy. Step S503: According to the first exception handling strategy, call eBPF to control the target vehicle service to perform a complete isolation operation matching the first exception handling strategy; Alternatively, in step S505, if the target vehicle service is at the second abnormal level, a second abnormality handling strategy is generated. Step S507: According to the second exception handling strategy, the eBPF is invoked to control the target vehicle service to perform the service degradation operation matched by the second exception handling strategy. Alternatively, in step S509, if the target vehicle service is at the third level of anomaly, generate a third anomaly handling strategy. Step S511: According to the third exception handling strategy, call eBPF to control the target vehicle service to perform the security degradation mode operation matched by the third exception handling strategy; the security degradation mode action is used to represent that while keeping the target vehicle service process alive, the resource consumption of the target vehicle service is limited to within a preset security threshold, and the exception handling behavior of non-security functions is stopped.

[0084] Specifically, when the target vehicle service is at the first anomaly level, i.e., the current vehicle state is parked, a first anomaly handling strategy is generated, and eBPF is invoked to control the target vehicle service to execute a complete isolation operation matching the first anomaly handling strategy. The complete isolation operation is used to completely remove the abnormal service from the vehicle system and start a replacement service, including the following steps: First, a snapshot of the target vehicle service's process context, including memory pages, CPU registers, file descriptor tables, and signal processor states, is saved via CRIU (Checkpoint / Restore In Userspace) for subsequent root cause analysis; then, the AUTOSAR AP's Execution Management is notified to stop the target vehicle service; next, the target vehicle service is marked as unavailable via ara::com's Service Registry, and a Topicunavailable event is published, causing downstream services subscribed to this service to automatically switch; simultaneously, all network packets of the target vehicle service are discarded via eBPF Socket Filter to achieve network isolation; finally, the Runtime Policy Engine is notified to start a backup service on a standby node to take over the original service's functionality, ensuring business continuity. This application does not limit this step.

[0085] When the target vehicle service is in the second anomaly level (i.e., the vehicle is currently in motion and the target vehicle service is a non-safety-critical service), a second anomaly handling strategy is generated, and eBPF is invoked to control the target vehicle service to execute a service degradation operation matching the second anomaly handling strategy. The service degradation operation is used to reduce the resource consumption and service quality of the target vehicle service process to release system resources while keeping the process alive. This includes the following steps: limiting the process scheduling cycle of the target vehicle service through eBPF to reduce its frame rate and / or bandwidth; releasing pre-allocated non-critical resources of the target vehicle service, such as graphics processor memory; and publishing a degradation event through ara::com to notify downstream services to switch to degradation mode. This strategy reduces system load while ensuring vehicle driving safety, prioritizing the release of resources for safety-critical services; this application does not limit the scope of this strategy.

[0086] When the target vehicle service is at the third level of anomaly (i.e., the vehicle is in motion and the target vehicle service is a safety-critical service), a third anomaly handling strategy is generated, and eBPF is invoked to control the target vehicle service to execute the security degradation mode operation matched by the third anomaly handling strategy. The security degradation mode action represents limiting the resource consumption of the target vehicle service to within a preset safety threshold and stopping anomaly handling behavior of non-safety functions while keeping the target vehicle service process alive. Specifically, eBPF limits the CPU utilization of the target vehicle service to a preset safety threshold, such as below 10%, limits memory usage to the minimum required range, and stops non-safety-related functional modules in the target vehicle service, such as image enhancement and advanced semantic analysis, while retaining its safety-related functional modules, such as basic obstacle detection, and outputting safety alarms to the vehicle's dashboard to remind the driver. Since safety-critical services bear the core responsibility of ensuring driving safety while in motion, directly isolating or killing this service could lead to serious safety accidents such as loss of vehicle control. Furthermore, by operating in a security downgrade mode, while preserving core security functions of the service as much as possible, resource consumption is controlled within a safe threshold to prevent abnormal services from further affecting driving safety due to resource exhaustion or loss of control. This achieves a balance between information security protection and vehicle functional safety while in motion.

[0087] Figure 6 This is a device block diagram illustrating an eBPF-based vehicle behavior anomaly handling apparatus according to an exemplary embodiment. (Refer to...) Figure 6 The device may include: The behavior information acquisition module 601 is used to acquire current vehicle status information and current behavior information of the target vehicle service based on the eBPF; the current behavior information is used to characterize the current multi-dimensional interaction state and current resource consumption characteristics of the target vehicle service in the vehicle system. The feature fusion module 603 is used to extract multi-dimensional features from the current behavior information and fuse the extracted multi-dimensional features to obtain the current behavior feature vector of the target vehicle service. The behavior fingerprint deviation information determination module 605 is used to perform behavior fingerprint matching processing on the current behavior feature vector based on the reference behavior fingerprint in the behavior fingerprint database to obtain behavior fingerprint deviation information; the reference behavior fingerprint is constructed by the historical behavior information of the target vehicle service pre-collected by the eBPF, and is used to characterize the distribution center information and normal fluctuation range of the behavior features of the target vehicle service in normal operation. In one possible implementation, the behavioral fingerprint deviation information determination module 605 includes: The historical behavior feature vector acquisition unit is used to acquire the historical behavior feature vectors of the multiple vehicle services within a preset historical time window by eBPF when the multiple vehicle services are in the normal operation state; the multiple vehicle services include the target vehicle service. The reference behavior fingerprint determination unit is used to perform statistical distribution fitting processing on the historical behavior feature vector based on a statistical learning algorithm to obtain the reference behavior fingerprint corresponding to each of the multiple vehicle services. The behavior fingerprint database construction unit is used to construct the behavior fingerprint database based on the reference behavior fingerprints corresponding to each of the multiple vehicle services.

[0088] In one possible implementation, the behavioral fingerprint deviation information determination module 605 includes: A fingerprint center vector extraction unit is used to extract the fingerprint center vector and fingerprint covariance matrix from the reference behavioral fingerprint. The feature vector deviation information determination unit is used to subtract the current behavior feature vector from the fingerprint center vector to obtain feature vector deviation information. The intermediate product result determination unit is used to multiply the transpose of the feature vector deviation information, the inverse matrix of the fingerprint covariance matrix, and the feature vector deviation information to obtain the intermediate product result. The first deviation information determination unit is used to perform square root processing on the intermediate product result to obtain the first deviation information.

[0089] In one possible implementation, the behavioral fingerprint deviation information determination module 605 includes: A service type identifier acquisition unit is used to acquire the service type identifier of the target vehicle service. The feature weight coefficient determination unit is used to determine the feature weight coefficients corresponding to each dimension of the behavior feature in the current behavior feature vector based on the service type identifier. A fingerprint standard deviation determination unit is used to extract the fingerprint standard deviation from the reference behavioral fingerprint; The feature deviation information determination unit is used to subtract the behavior features of each dimension in the current behavior feature vector from the corresponding center dimension features in the fingerprint center vector to obtain feature deviation information. The standardized deviation information determination unit is used to determine the standardized deviation information corresponding to each of the dimensional behavioral features based on the ratio information of the absolute value of the feature deviation information to the standard deviation of the fingerprint. The fingerprint deviation result determination unit is used to multiply the feature weight coefficients corresponding to the behavioral features of each dimension with the standardized deviation information corresponding to the behavioral features of each dimension to obtain the fingerprint deviation results of the behavioral features of each dimension. The fingerprint deviation accumulation result determination unit is used to accumulate the fingerprint deviation results of the behavioral features of each dimension to obtain the fingerprint deviation accumulation result; The feature weight accumulation result determination unit is used to accumulate the feature weight coefficients to obtain the feature weight accumulation result; The second deviation information determination unit is used to divide the fingerprint deviation accumulation result by the feature weight accumulation result to obtain the second deviation information.

[0090] In one possible implementation, the behavioral fingerprint deviation information determination module 605 further includes: The first abnormal state determination unit is used to determine that the target vehicle service is in the abnormal operating state when the first deviation information is greater than the first behavior abnormal threshold. Alternatively, a second abnormal state determination unit is configured to determine that the target vehicle service is in the abnormal operating state when the first deviation information is less than or equal to the first behavior abnormal threshold and the second deviation information is greater than the second behavior abnormal threshold; wherein the second behavior abnormal threshold is less than the first behavior abnormal threshold.

[0091] The normal state determination unit is used to determine that the target vehicle service is in the normal operating state when the first deviation information is less than or equal to the first behavior abnormality threshold and the second deviation information is less than or equal to the second behavior abnormality threshold.

[0092] The exception handling module 607 is used to invoke the eBPF to control the target vehicle service to perform an exception handling operation that matches the current vehicle state information when the behavior fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state.

[0093] In one possible implementation, the exception handling module 607 includes: An anomaly level determination unit is used to determine the anomaly level of the target vehicle service based on the current vehicle status information when the behavioral fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state. The hierarchical anomaly handling unit is used to generate a hierarchical anomaly handling strategy corresponding to the anomaly level based on the anomaly level, and to call the eBPF to control the target vehicle service to perform anomaly handling operations matching the hierarchical anomaly handling strategy.

[0094] In one possible implementation, the exception handling module 607 includes: A security service identifier acquisition unit is used to acquire the security service identifier of the target vehicle service; the security service identifier is used to indicate whether the target vehicle service is a security service. The first anomaly level determination unit is used to determine that the target vehicle service is in the first anomaly level when the current vehicle status information is in the parking state. The second anomaly level determination unit is used to determine that the target vehicle service is at a second anomaly level when the current vehicle status information is in a driving state and the safety service identifier indicates that the target vehicle service is a non-safe service; the first anomaly level is higher than the second anomaly level. The third anomaly level determination unit is used to determine that the target vehicle service is at the third anomaly level when the current vehicle status information is in a driving state and the safety service identifier indicates that the target vehicle service is a safe service; the second anomaly level is higher than the third anomaly level.

[0095] In one possible implementation, the exception handling module 607 includes: The first anomaly handling strategy generation unit is used to generate the first anomaly handling strategy when the target vehicle service is at the first anomaly level. The complete isolation operation unit is used to invoke the eBPF to control the target vehicle service to perform a complete isolation operation matching the first exception handling strategy according to the first exception handling strategy. Alternatively, the second anomaly handling strategy generation unit is used to generate the second anomaly handling strategy when the target vehicle service is at the second anomaly level. The service degradation operation unit is used to invoke the eBPF to control the target vehicle service to perform a service degradation operation matched by the second exception handling strategy according to the second exception handling strategy. Alternatively, the third anomaly handling strategy generation unit is used to generate the third anomaly handling strategy when the target vehicle service is at the third anomaly level. The security degradation mode operation unit is used to call the eBPF to control the target vehicle service to perform the security degradation mode operation matched by the third anomaly handling strategy according to the third anomaly handling strategy; the security degradation mode action is used to represent limiting the resource consumption of the target vehicle service to within a preset security threshold and stopping the anomaly handling behavior of non-security functions while keeping the target vehicle service process alive.

[0096] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0097] Figure 7 This is a block diagram illustrating an electronic device for handling in-vehicle behavior anomalies based on an exemplary embodiment. The electronic device may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the electronic device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an eBPF-based method for handling vehicle behavior anomalies. The display screen can be a liquid crystal display (LCD) or an electronic ink display. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse. Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0098] Figure 8 This is a block diagram illustrating an electronic device for handling in-vehicle behavior anomalies based on eBPF, according to an exemplary embodiment. The electronic device can be a server, and its internal structure can be as shown in Figure 8. The electronic device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an eBPF-based method for handling in-vehicle behavior anomalies. Those skilled in the art will understand that Figure 8The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements. In an exemplary embodiment, an electronic device is also provided, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the eBPF-based vehicle behavior anomaly handling method as described in the embodiments of this application.

[0099] In an exemplary embodiment, a computer-readable storage medium is also provided, which, when executed by a processor of an electronic device, enables the electronic device to perform the eBPF-based vehicle behavior anomaly handling method of this application embodiment. The computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, or optical data storage device, etc.

[0100] In an exemplary embodiment, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute the eBPF-based vehicle behavior anomaly handling method in the embodiments of this application.

[0101] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0102] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0103] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for handling in-vehicle behavior anomalies based on eBPF, characterized in that, include: Based on the eBPF, obtain the current vehicle status information and the current behavior information of the target in-vehicle service; The current behavior information is used to characterize the current multi-dimensional interaction state and current resource consumption characteristics of the target in-vehicle service in the vehicle system; Multidimensional feature extraction is performed on the current behavior information, and feature fusion is performed on the extracted multidimensional features to obtain the current behavior feature vector of the target vehicle service; Based on the reference behavioral fingerprint in the behavioral fingerprint database, behavioral fingerprint matching processing is performed on the current behavioral feature vector to obtain behavioral fingerprint deviation information; the reference behavioral fingerprint is constructed by the historical behavioral information of the target vehicle service pre-collected by the eBPF, and is used to characterize the distribution center information and normal fluctuation range of the behavioral features of the target vehicle service in normal operation. When the behavioral fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state, the eBPF is invoked to control the target vehicle service to perform an abnormal handling operation that matches the current vehicle state information.

2. The vehicle behavior anomaly handling method based on eBPF according to claim 1, characterized in that, The behavioral fingerprint deviation information includes first deviation information; the step of performing behavioral fingerprint matching processing on the current behavioral feature vector based on reference behavioral fingerprints in the behavioral fingerprint database to obtain behavioral fingerprint deviation information includes: Extract the fingerprint center vector and fingerprint covariance matrix from the reference behavioral fingerprint; Subtract the current behavior feature vector from the fingerprint center vector to obtain feature vector deviation information; The transpose of the feature vector deviation information, the inverse of the fingerprint covariance matrix, and the feature vector deviation information are multiplied together to obtain an intermediate product result. The first deviation information is obtained by taking the square root of the intermediate product result.

3. The vehicle behavior anomaly handling method based on eBPF according to claim 2, characterized in that, The method further includes: Obtain the service type identifier of the target in-vehicle service; Based on the service type identifier, determine the feature weight coefficients corresponding to each dimension of the behavioral features in the current behavioral feature vector; The behavioral fingerprint deviation information further includes second deviation information; the step of performing behavioral fingerprint matching processing on the current behavioral feature vector based on reference behavioral fingerprints in the behavioral fingerprint database to obtain behavioral fingerprint deviation information includes: Extract the fingerprint standard deviation from the reference behavioral fingerprint; Subtracting the behavioral features of each dimension in the current behavioral feature vector from the corresponding center dimension features in the fingerprint center vector yields feature deviation information. Based on the ratio of the absolute value of the feature deviation information to the standard deviation of the fingerprint, the standardized deviation information corresponding to each of the behavioral features in the dimensions is determined; The feature weight coefficients corresponding to each dimension of behavioral features are multiplied with the standardized deviation information corresponding to each dimension of behavioral features to obtain the fingerprint deviation results of each dimension of behavioral features. The fingerprint deviation results of each dimension of behavioral features are accumulated to obtain the fingerprint deviation accumulation result; The feature weight coefficients are summed to obtain the feature weight accumulation result; The second deviation information is obtained by dividing the accumulated fingerprint deviation result by the accumulated feature weight result.

4. The vehicle behavior anomaly handling method based on eBPF according to claim 3, characterized in that, The method further includes: If the first deviation information is greater than the first behavior abnormal threshold, it is determined that the target vehicle service is in the abnormal operating state; Alternatively, if the first deviation information is less than or equal to the first behavior anomaly threshold and the second deviation information is greater than the second behavior anomaly threshold, the target vehicle service is determined to be in the abnormal operating state; the second behavior anomaly threshold is less than the first behavior anomaly threshold.

5. The vehicle behavior anomaly handling method based on eBPF according to claim 4, characterized in that, The method further includes: If the first deviation information is less than or equal to the first behavior anomaly threshold and the second deviation information is less than or equal to the second behavior anomaly threshold, the target vehicle service is determined to be in the normal operating state.

6. The eBPF-based vehicle behavior anomaly handling method according to claim 1 or 4, wherein when the behavior fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state, the step of invoking the eBPF to control the target vehicle service to perform an anomaly handling operation matching the current vehicle state information includes: When the behavioral fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state, the abnormality level of the target vehicle service is determined according to the current vehicle status information. Based on the anomaly level, a hierarchical anomaly handling strategy corresponding to the anomaly level is generated, and the eBPF is invoked to control the target vehicle service to execute the anomaly handling operation matched by the hierarchical anomaly handling strategy.

7. The vehicle behavior anomaly handling method based on eBPF according to claim 6, characterized in that, The method further includes: Obtain the security service identifier of the target vehicle service; the security service identifier is used to indicate whether the target vehicle service is a security service. Determining the anomaly level corresponding to the target vehicle service based on the current vehicle status information includes: If the current vehicle status information indicates a parked state, the target vehicle service is determined to be at the first abnormal level. If the current vehicle status information indicates a driving state and the safety service identifier indicates that the target vehicle service is a non-safe service, then the target vehicle service is determined to be at the second anomaly level; the first anomaly level is higher than the second anomaly level. If the current vehicle status information indicates that the vehicle is in a driving state and the safety service identifier indicates that the target vehicle service is a safe service, then the target vehicle service is determined to be at the third anomaly level; the second anomaly level is higher than the third anomaly level.

8. The vehicle behavior anomaly handling method based on eBPF according to claim 7, characterized in that, The hierarchical anomaly handling strategy includes a first anomaly handling strategy, a second anomaly handling strategy, and a third anomaly handling strategy; the step of generating a hierarchical anomaly handling strategy corresponding to the anomaly level, and invoking the eBPF to control the target vehicle service to execute the anomaly handling operation matched by the hierarchical anomaly handling strategy, includes: If the target vehicle service is at the first anomaly level, the first anomaly handling strategy is generated. According to the first exception handling strategy, the eBPF is invoked to control the target vehicle service to perform a complete isolation operation matching the first exception handling strategy. Alternatively, if the target in-vehicle service is at the second anomaly level, the second anomaly handling strategy may be generated. According to the second exception handling strategy, the eBPF is invoked to control the target vehicle service to perform a service degradation operation matched by the second exception handling strategy. Alternatively, if the target in-vehicle service is at the third anomaly level, the third anomaly handling strategy may be generated. According to the third exception handling strategy, the eBPF is invoked to control the target vehicle service to perform the security degradation mode operation matched by the third exception handling strategy; the security degradation mode action is used to represent that while keeping the target vehicle service process alive, the resource consumption of the target vehicle service is limited to within a preset security threshold, and the exception handling behavior of non-security functions is stopped.

9. The vehicle behavior anomaly handling method based on eBPF according to claim 1, characterized in that, The behavioral fingerprint database construction steps include: When multiple in-vehicle services are in normal operating condition, eBPF is used to collect the historical behavior feature vectors of each of the multiple in-vehicle services within a preset historical time window; the multiple in-vehicle services include the target in-vehicle service. Based on a statistical learning algorithm, the historical behavior feature vector is subjected to statistical distribution fitting to obtain the reference behavior fingerprint corresponding to each of the multiple in-vehicle services. The behavior fingerprint database is constructed based on the reference behavior fingerprints corresponding to each of the multiple in-vehicle services.

10. A vehicle behavior anomaly handling device based on eBPF, characterized in that, include: The behavior information acquisition module is used to acquire current vehicle status information and current behavior information of the target vehicle service based on the eBPF. The current behavior information is used to characterize the current multi-dimensional interaction state and current resource consumption characteristics of the target in-vehicle service in the vehicle system; The feature fusion module is used to extract multi-dimensional features from the current behavior information and fuse the extracted multi-dimensional features to obtain the current behavior feature vector of the target vehicle service. The behavior fingerprint deviation information determination module is used to perform behavior fingerprint matching processing on the current behavior feature vector based on the reference behavior fingerprint in the behavior fingerprint database to obtain behavior fingerprint deviation information; the reference behavior fingerprint is constructed by the historical behavior information of the target vehicle service pre-collected by the eBPF, and is used to characterize the distribution center information and normal fluctuation range of the behavior features of the target vehicle service in various dimensions under normal operation. An exception handling module is used to invoke the eBPF to control the target vehicle service to perform an exception handling operation that matches the current vehicle state information when the behavior fingerprint deviation information indicates that the target vehicle service is in an abnormal operating state.

Images