Anomaly detection method and apparatus, storage medium, and program product

Abstract

An anomaly detection method and apparatus, a storage medium, and a program product. The method comprises: a server acquires rule description information, the rule description information being used for indicating a target packet ID and an anomaly determination condition; the server also obtains a packet, the packet corresponding to at least one first file that is used for managing information comprised in the packet; then, the server parses the packet on the basis of the target packet ID and the at least one first file to obtain data to be detected that is structured data; and further, the server determines an anomaly detection result on the basis of the anomaly determination condition and the data to be detected. In this way, the efficiency of anomaly detection can be improved, and the labor costs can be reduced.

Description

Anomaly detection methods, devices, storage media and program products

[0001] This application claims priority to Chinese Patent Application No. 202411051781.7, filed with the China National Intellectual Property Administration on July 30, 2024, entitled “Anomaly Detection Method, Apparatus, Storage Medium and Program Product”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of vehicle technology, and in particular to an anomaly detection method, device, storage medium, and program product. Background Technology

[0003] Various communication protocols exist in the field of automotive communication for data communication between automotive electronic devices. Taking Controller Area Network (CAN) or Local Interconnect Network (LIN) as examples, each message has a unique identifier (ID), and each message contains several signals. One or more signals can represent specific information, such as a sensor reading. When an anomaly occurs, a common method is to capture all messages on the bus and then analyze the problem. In the industry, a common approach to fault detection is to plot a line graph of all signals for all messages according to their values, and then manually determine if a specific anomaly exists. This method involves high human intervention and is inefficient. Summary of the Invention

[0004] This application discloses an anomaly detection method, apparatus, storage medium, and program product, which can improve the efficiency of anomaly detection and reduce labor costs.

[0005] Firstly, embodiments of this application provide an anomaly detection method. This method can be applied to a server. In this method, the server obtains rule description information, which indicates the target message ID and anomaly judgment conditions. The server also obtains a message corresponding to at least one first file, which manages the information contained in the message. Then, based on the target message ID and the at least one first file, the server parses the message to obtain data to be detected, which is structured data. Furthermore, based on the anomaly judgment conditions and the data to be detected, the server determines the anomaly detection result.

[0006] In this embodiment, rule description information and a message are obtained, and the message is parsed based on the target ID and at least one first file in the rule description information to obtain the data to be detected. Then, based on the anomaly judgment conditions in the rule description information and the data to be detected, the anomaly detection result is determined. This example can find specified information in the message based on the rule description information, thereby confirming whether there is a known pattern of anomaly in the message, which can improve the efficiency of anomaly detection and reduce labor costs.

[0007] This structured data can be understood as having a spreadsheet-like structure, including headers, timestamps, and parsed, user-readable data.

[0008] In one possible implementation, the anomaly detection condition includes the signal corresponding to the target message ID and a description of the anomaly range of the signal value.

[0009] This example uses the signal corresponding to the target message ID and the description of the abnormal range of the signal value to make anomaly judgment. It can automatically and quickly identify whether the captured CAN message contains a message with the abnormal feature, thereby clarifying whether the current fault is caused by a specific reason.

[0010] In one possible implementation, the signal value of the signal corresponding to the target message ID is obtained from the data to be detected;

[0011] Based on the description of the abnormal range of the signal value and the signal value of the signal corresponding to the target message ID, the anomaly detection result is determined.

[0012] In one possible implementation, the exception detection condition also includes the duration.

[0013] This example uses the signal corresponding to the target message ID, the description of the abnormal range of the signal value, and the duration to determine the anomaly. It can automatically and quickly identify whether the captured CAN message contains a message with the required duration, thereby clarifying whether the current fault is caused by a specific reason.

[0014] In one possible implementation, the anomaly detection result is determined based at least on the timestamp corresponding to each piece of data in the data to be detected and the duration.

[0015] In one possible implementation, the exception detection condition also includes the number of exceptions.

[0016] This example uses the signal corresponding to the target message ID, the description of the abnormal range of the signal value, and the number of abnormal occurrences to determine anomalies. It can automatically and quickly identify whether the captured CAN messages contain messages whose characteristics need to be considered for occurrence, thereby clarifying whether the current fault is caused by a specific reason.

[0017] In one possible implementation, the data to be detected is determined to be abnormal when the number of times it is determined to be abnormal is not less than the number of abnormal occurrences.

[0018] In one possible implementation, based on the target message ID and the at least one first file, the message is parsed to obtain the data to be detected, including:

[0019] Obtain the second file corresponding to the target message ID from at least one first file;

[0020] The message is parsed based on the second file to obtain the data to be detected.

[0021] This second file corresponds to the target message ID. Like a DBC file, this second file contains detailed information such as message ID, name, length, and transmission period, enabling the original message to be decoded into meaningful signal values.

[0022] This example uses an abstract and unified data format to record the parsed CAN messages. It has strong data expressiveness and supports the combination of several signals in multiple messages with the same CAN message ID, as well as the combination and filling of several signals in multiple messages with different CAN message IDs. Therefore, it can support the condition that a rule description contains multiple messages.

[0023] In one possible implementation, there are multiple target message IDs, and multiple messages corresponding to the target message ID are associated with the same exception.

[0024] Multiple messages corresponding to the target message ID are associated with the same anomaly; that is, the same anomaly is determined by comprehensively analyzing multiple messages corresponding to the target message ID. In other words, certain anomaly characteristics require comprehensive localization by combining multiple functional components. For example, the normal operation of a controller depends on the proper functioning of its heat dissipation components. Localizing anomalies in the controller requires determining whether the controller itself is functioning normally, as well as whether the heat dissipation components are functioning normally. Comprehensive localization of anomalies by combining multiple functional components allows for more accurate analysis.

[0025] Secondly, embodiments of this application provide an anomaly detection device, comprising:

[0026] The first acquisition module is used to acquire rule description information, which is used to indicate the target packet ID and the anomaly judgment conditions.

[0027] The second acquisition module is used to acquire a message that corresponds to at least one first file, which is used to manage the information contained in the message.

[0028] The processing module is used to parse the message based on the target message ID and the at least one first file to obtain the data to be detected, which is structured data;

[0029] The detection module is used to determine the anomaly detection result based on the anomaly judgment condition and the data to be detected.

[0030] In one possible implementation, the anomaly detection condition includes the signal corresponding to the target message ID and a description of the anomaly range of the signal value.

[0031] In one possible implementation, the device further includes a third acquisition module, which is used for:

[0032] Obtain the signal value of the signal corresponding to the target message ID from the data to be detected;

[0033] This detection module is specifically used to: determine the anomaly detection result based on the description of the abnormal range of the signal value and the signal value of the signal corresponding to the target message ID.

[0034] In one possible implementation, the exception detection condition also includes the duration.

[0035] In one possible implementation, the detection module is specifically used to: determine the anomaly detection result based at least on the timestamp corresponding to each piece of data in the data to be detected and the duration.

[0036] In one possible implementation, the exception detection condition also includes the number of exceptions.

[0037] In one possible implementation, the detection module is specifically used for:

[0038] The data to be tested is considered abnormal if the number of times it is identified as abnormal is not less than the number of abnormal data points.

[0039] In one possible implementation, the processing module is specifically used for:

[0040] Obtain the second file corresponding to the target message ID from at least one first file;

[0041] The message is parsed based on the second file to obtain the data to be detected.

[0042] In one possible implementation, there are multiple target message IDs, and multiple messages corresponding to the target message ID are associated with the same exception.

[0043] Thirdly, this application provides an anomaly detection device, including a processor and a memory; wherein the memory is used to store program code, and the processor is used to call the program code to execute the method provided in any possible implementation of the first aspect.

[0044] Fourthly, this application provides a computer-readable storage medium storing a computer program that is executed by a processor to implement the method provided in any possible implementation of the first aspect.

[0045] Fifthly, this application provides a computer program product that, when run on a computer, causes the computer to perform the method provided in any possible implementation of the first aspect.

[0046] It is understood that the apparatus described in the second aspect, the apparatus described in the third aspect, the computer storage medium described in the fourth aspect, or the computer program product described in the fifth aspect are all used to perform the method provided in any of the first aspects. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here. Attached Figure Description

[0047] The accompanying drawings used in the embodiments of this application are described below.

[0048] Figure 1 is a schematic diagram of an anomaly detection system provided in an embodiment of this application;

[0049] Figure 2 is a flowchart illustrating an anomaly detection method provided in an embodiment of this application;

[0050] Figure 3 is a schematic diagram of an anomaly detection method provided in an embodiment of this application;

[0051] Figure 4 is a schematic diagram of another anomaly detection method provided in an embodiment of this application;

[0052] Figure 5 is a structural schematic diagram of an anomaly detection device provided in an embodiment of this application;

[0053] Figure 6 is a schematic diagram of another anomaly detection device provided in an embodiment of this application. Detailed Implementation

[0054] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is for explaining specific embodiments only and is not intended to limit the scope of this application.

[0055] First, let's introduce the technical terms used in this application:

[0056] 1. CAN message: CAN message is one of the most important communication protocols in automotive electronic systems. It can include two protocols: CAN and CAN with flexible data rate (CAN-FD). It features bus transmission, serial transmission, good real-time performance, differential signal transmission, low cost, and high flexibility.

[0057] 2. Controller Area Network Database (DBC): A DBC file is an industry-standard file format used to describe the CAN communication protocol. It provides definitions and management of CAN messages, signals, nodes, and other information. Based on DBC files, developers can efficiently organize and manage CAN-related information, enabling data parsing and configuration.

[0058] Referring to Figure 1, a schematic diagram of an anomaly detection system provided in an embodiment of this application is shown. As shown in Figure 1, the system includes a vehicle 101 and a server 102. Wherein:

[0059] Vehicle 101 is a device with communication and computing capabilities, capable of providing mobility services to users. Vehicle 101 can provide an environment for deploying software, hardware, or a combination of both. For example, software can be installed on vehicle 101. Furthermore, vehicle 101 has an interface for connecting hardware, through which hardware can be connected to vehicle 101.

[0060] Server 102 is a device with centralized computing capabilities. For example, server 102 can be implemented through devices such as servers, virtual machines, cloud, roadside devices, or robots.

[0061] When server 102 includes servers, the type of server includes, but is not limited to, general-purpose computers, dedicated server computers, blade servers, etc. This application does not impose a strict limit on the number of servers included in server 102; the number can be one or multiple (such as a server cluster).

[0062] A virtual machine is a computing module simulated by software, possessing complete hardware system functionality and running in a completely isolated environment. Of course, besides virtual machines, server 102 can also be implemented using other computing instances, such as containers.

[0063] The cloud is a software platform that uses application virtualization technology, enabling one or more software programs or applications to be developed and run in an independent virtualized environment. Optionally, when server 102 is implemented through the cloud, the cloud can be deployed on a public cloud, private cloud, or hybrid cloud, etc.

[0064] Roadside units are devices installed along the side of a road (or intersection, or roadside, etc.). The road can be an outdoor road (e.g., main road, auxiliary road, elevated road, or temporary road) or an indoor road (e.g., a road in an indoor parking lot). Roadside units provide services to vehicles. It should be noted that a roadside unit can be a standalone device or integrated into other devices. For example, roadside units can be integrated into smart gas stations, charging stations, smart traffic lights, streetlights, utility poles, or traffic signs.

[0065] It should be noted that this example uses an anomaly detection system comprising vehicle 101 and server 102 as an example. Alternatively, the anomaly detection system may include vehicles and electronic devices (such as computers), and this solution is not limited to this.

[0066] The common method used in the industry for fault detection is to capture all CAN messages on the bus and then manually determine if any specific anomalies exist. This method involves a high degree of human intervention and is inefficient. Therefore, this application provides an anomaly detection method that can improve the efficiency of anomaly detection and reduce labor costs.

[0067] The architecture of the embodiments of this application has been described above. The methods of the embodiments of this application will be described in detail below.

[0068] Referring to Figure 2, a flowchart illustrating an anomaly detection method provided in an embodiment of this application is shown. Optionally, this method can be applied to the aforementioned anomaly detection system, such as the anomaly detection system shown in Figure 1. The anomaly detection method shown in Figure 2 may include steps 201-204. It should be understood that, for ease of description, this application uses the sequence 201-204 in this order, and is not intended to limit the execution to the above order. This application does not limit the order of execution, execution time, or number of executions of one or more of the above steps. The following description uses the server as an example to illustrate the execution subject of steps 201-204 of the anomaly detection method; this application is also applicable to other execution subjects such as electronic devices (e.g., computers). Steps 201-204 are as follows:

[0069] 201. The server obtains the rule description information, which is used to indicate the target packet ID and the anomaly judgment conditions.

[0070] For example, when the server performs online inspections periodically or at preset times, steps 201-204 can be triggered. Alternatively, when the vehicle experiences abnormal power-on conditions, abnormal operating system startup, or other faults, the server executes steps 201-204.

[0071] For example, the rule description information is obtained from the cloud or disk. This rule description information is used for anomaly detection. Different rule descriptions correspond to different anomalies. For instance, the first rule description corresponds to anomalies related to power-on conditions; that is, the first rule description is used to detect anomalies related to power-on conditions. Similarly, the second rule description corresponds to anomalies related to operating system startup; that is, the second rule description is used to detect anomalies related to operating system startup.

[0072] The rule description information can be pre-generated and reusable. In one possible implementation, the rule description information is related to the vehicle model. For example, different vehicle models correspond to different rule description information. Since the observed messages and signals may differ for each vehicle model, even the same signal may have different IDs across different models. Therefore, the rule description information can record the vehicle models to which the current rule applies, and new rule description information is typically needed when adapting to a new vehicle model.

[0073] The target message ID is the ID corresponding to the exception described in the rule. For example, a power-on condition exception depends on a signal in a CAN message with message ID 83, and its corresponding target message ID is 83. Another example is an operating system startup exception, where the target message ID is 146. Yet another example is a liquid cooling status exception, where the target message ID is 144. And yet another example is an ignition signal status exception, where the target message ID is 102.

[0074] The anomaly detection condition refers to the specific situation corresponding to the anomaly described in the rule. In other words, if this anomaly detection condition is met, it indicates that the current detection result is abnormal. Examples include a liquid cooling Cool signal value not equal to 1, or a PowerStatus signal value between 1 and 3.

[0075] In one possible implementation, the anomaly detection condition includes the signal (i.e., the signal name) corresponding to the target message ID and a description of the abnormal range of the signal value. For example, the anomaly detection condition corresponding to the above power-on condition anomaly includes the Cool signal value not being equal to 1. Another example is the operating system startup anomaly, where the PowerStatus signal value is equal to 1. Yet another example is the liquid cooling status anomaly, where the liquid cooling signal value is not equal to 1. And yet another example is the ignition signal status anomaly, where the PowerMode signal value is not equal to 1.

[0076] This example uses the signal corresponding to the target message ID and the description of the abnormal range of the signal value to make anomaly judgment. It can automatically and quickly identify whether the captured CAN message contains a message with the abnormal feature, thereby clarifying whether the current fault is caused by a specific reason.

[0077] In another possible implementation, the anomaly determination condition also includes a duration. This duration is the length of time the signal value of the signal corresponding to the target message ID conforms to the aforementioned anomaly range description. That is, if the anomaly range description of the signal value corresponding to the target message ID is met, and the duration is satisfied, it indicates that the current detection result is anomaly. For example, the duration could be 5 seconds.

[0078] This example uses the signal corresponding to the target message ID, the description of the abnormal range of the signal value, and the duration to determine the anomaly. It can automatically and quickly identify whether the captured CAN message contains a message with the required duration, thereby clarifying whether the current fault is caused by a specific reason.

[0079] In another possible implementation, the anomaly determination condition also includes the number of anomalies. This number of anomalies can be the number of times an anomaly occurs, determined based on the anomaly range description of the signal value corresponding to the target message ID; or, it can be the number of times an anomaly occurs, determined based on the anomaly range description and duration of the signal value corresponding to the target message ID. That is, if the anomaly range description of the signal value corresponding to the target message ID is satisfied, it can be considered a preliminary anomaly; if the number of times this preliminary anomaly occurs reaches the required number of anomalies, the current detection result is determined to be an anomaly. Alternatively, if the anomaly range description and duration of the signal value corresponding to the target message ID are satisfied, it can be considered a preliminary anomaly; if the number of times this preliminary anomaly occurs reaches the required number of anomalies, the current detection result is determined to be an anomaly. For example, the number of anomalies could be, for instance, 3 times.

[0080] This example uses the signal corresponding to the target message ID, the description of the abnormal range of the signal value, and the number of abnormal occurrences to determine anomalies. It can automatically and quickly identify whether the captured CAN messages contain messages whose characteristics need to be considered for occurrence, thereby clarifying whether the current fault is caused by a specific reason.

[0081] In one possible implementation, there are multiple target message IDs, and multiple messages corresponding to a target message ID are associated with the same anomaly. This association of multiple messages corresponding to the same target message ID means that the same anomaly is determined based on a comprehensive analysis of the multiple messages corresponding to that target message ID. In other words, certain anomaly characteristics require comprehensive localization by combining multiple functional components. For example, the normal operation of a controller depends on the normal operation of its heat dissipation components. Anomaly localization for the controller requires determining whether the controller itself is in a normal state, and also whether the heat dissipation components are in a normal state. For example, power-on condition anomalies are associated with message ID 83 and message ID 144, respectively. The anomaly judgment condition corresponding to message ID 83 includes a Cool signal value not equal to 1. The anomaly judgment condition corresponding to message ID 144 includes a PowerStatus signal value between 1 and 3. The judgment condition for this power-on condition anomaly also includes a duration of 5 seconds. In other words, if the Cool signal value is not equal to 1 and lasts for more than 5 seconds, and the PowerStatus signal value is between 1 and 3 and lasts for more than 5 seconds, it indicates that the power-on conditions are abnormal.

[0082] Table 1 is a schematic table of rule description information provided in an embodiment of this application.

[0083] Table 1

[0084] This example only illustrates how the same exception can be associated with two target message IDs; however, there can be other numbers of such exceptions, and this solution does not impose any restrictions on this.

[0085] The rule description information provided in this example can record abnormal features formed by the combination of multiple signals in multiple messages within various ranges. When abnormal features change or are added, only the corresponding rule description information needs to be updated to complete the feature update, without needing to modify other parts of the entire diagnostic process.

[0086] For example, rule description information (such as a rule description file) may include analysis conclusions, analysis suggestions, and phenomenon characteristics for a certain anomaly. The analysis conclusions and suggestions can be presented to the user as the final result to assist in the final problem localization. Phenomenon characteristics mainly include the CAN message ID that locates the anomaly, the signal name in the message (such as the signal corresponding to the target message ID mentioned above), the signal value range (such as the description of the abnormal range of signal values ​​mentioned above), and the duration supported by the feature (such as the duration mentioned above). Rule description information can record characteristics containing multiple messages and multiple signals.

[0087] 202. The server obtains a message, which corresponds to at least one first file, which is used to manage the information contained in the message.

[0088] This message can be a CAN message, a LIN message, etc., and this solution does not impose any restrictions on it.

[0089] This first file is used to manage the information contained in the message. Management of the message based on this first file enables data parsing and configuration of the message. This first file can be a pre-saved file.

[0090] The server can retrieve binary messages from the vehicle's CAN bus. There can be multiple messages; for example, these messages can be multiple messages over a period of time.

[0091] One message may correspond to one or more first files. That is, one or more first files can manage one message. For example, the first file may be a DBC file. For an introduction to DBC files, please refer to the foregoing description, which will not be repeated here.

[0092] 203. The server parses the message based on the target message ID and the at least one first file to obtain the data to be detected, which is structured data.

[0093] This structured data can be understood as having a spreadsheet-like structure, including headers, timestamps, and parsed, user-readable data.

[0094] In one possible implementation, the server retrieves a second file corresponding to the target message ID from at least one first file. Then, the server parses the message based on the second file to obtain the data to be detected.

[0095] In other words, this second file corresponds to the target message ID. This second file, such as a DBC file, contains detailed information such as message ID, name, length, and transmission period, enabling the original message to be decoded into meaningful signal values.

[0096] This example uses an abstract and unified data format to record the parsed CAN messages. It has strong data expressiveness and supports the combination of several signals in multiple messages with the same CAN message ID, as well as the combination and filling of several signals in multiple messages with different CAN message IDs. Therefore, it can support the condition that a rule description contains multiple messages.

[0097] In one possible implementation, the parsed structured data includes the DBC version number (understandably, at least one of the at least one first file used to obtain the structured data includes the DBC version number). The anomaly detection device automatically manages the DBC file version information. This device is compatible with multiple DBC versions, improving its usability and reducing manpower requirements.

[0098] In one possible implementation, the aforementioned message is initially in compressed form. In this case, regardless of the format version information (e.g., compression format information) of the message carrier, the tool can perform uniform processing. For example, a specific uniform processing method could be to find the corresponding parsing method based on the format version information of the message carrier, thereby decompressing the message before parsing it.

[0099] 204. Based on the anomaly detection conditions and the data to be detected, the server determines the anomaly detection result.

[0100] Understandably, the data to be detected includes at least a signal and its corresponding signal value. Based on the anomaly detection conditions indicated by the rule description information above, the signal and its corresponding signal value are detected to obtain the anomaly detection result.

[0101] In one possible implementation, the signal value of the signal corresponding to the target message ID is obtained from the data to be detected. Then, based on the description of the abnormal range of the signal value and the signal value of the signal corresponding to the target message ID, the anomaly detection result is determined.

[0102] In other words, the signal value of the signal corresponding to the target message ID in the rule description information is first extracted from the message. If the signal value of the signal corresponding to the target message ID meets the description of the abnormal range, the anomaly detection result is abnormal. If it does not meet the description of the abnormal range, the anomaly detection result is normal.

[0103] This example, based on rule description information, can unify feature descriptions and diagnose messages accordingly, so as to conveniently and quickly match messages captured from the bus with rule description information, find specific messages, and then locate problems.

[0104] In another possible implementation, the anomaly detection condition also includes determining the anomaly detection result based at least on the timestamp corresponding to each piece of data in the data to be detected and the duration.

[0105] Optionally, the anomaly detection result is determined based on the timestamp corresponding to each piece of data in the data to be detected, the duration, the description of the abnormal range of the signal value, and the signal value of the signal corresponding to the target message ID.

[0106] In other words, if the abnormal range of the signal value corresponding to the target message ID is satisfied, and the duration determined based on the timestamp corresponding to each data item satisfies the duration, it indicates that the current detection result is abnormal.

[0107] In another possible implementation, the anomaly determination condition also includes an anomaly count. If the number of times the data to be detected is determined to be an anomaly is not less than the anomaly count, then the data to be detected is determined to be an anomaly. For example, if the anomaly range description of the signal value corresponding to the target message ID is satisfied, it can be considered a preliminary anomaly. If the number of times the preliminary anomaly occurs meets the anomaly count, then the current detection result is determined to be an anomaly. Alternatively, if the anomaly range description and duration description of the signal value corresponding to the target message ID are satisfied, it can be considered a preliminary anomaly. If the number of times the preliminary anomaly occurs reaches the anomaly count, then the current detection result is determined to be an anomaly.

[0108] In one possible implementation, when the anomaly detection result is abnormal, the server can report the fault to the electronic device, instructing the device to display the anomaly. This anomaly display could be, for example, text, graphics, sound, or light. This serves to remind the user to perform timely maintenance. Understandably, when the executing entity is the electronic device, it can directly display relevant information corresponding to the anomaly.

[0109] In this embodiment, rule description information and a message are obtained, and the message is parsed based on the target ID and at least one first file in the rule description information to obtain the data to be detected. Then, based on the anomaly judgment conditions in the rule description information and the data to be detected, the anomaly detection result is determined. This example can find specified information in the message based on the rule description information, thereby confirming whether there is a known pattern of anomaly in the message, which can improve the efficiency of anomaly detection and reduce labor costs.

[0110] Figure 3 is a schematic diagram of an anomaly detection method provided in an embodiment of this application. This example is described using an abnormal power supply condition as an example.

[0111] The target ID in the rule description information determines the selection of the DBC file. Based on the determined DBC file, the acquired vehicle CAN messages are parsed to obtain structured raw data (such as the aforementioned data to be detected), and this raw data is stored. For example, all messages with message IDs 83 and 144 are extracted from the vehicle CAN messages, parsed, and stored in their respective message storage structures.

[0112] Then, based on the rule description information, target data is obtained from the raw data. This target data is the data corresponding to the anomaly judgment conditions in the rule description information. For example, the anomaly judgment conditions corresponding to this power-on condition anomaly include the Cool signal value not being equal to 1, and the PowerStatus signal value being between 1 and 3; simultaneously, the duration is 5 seconds. Therefore, the values ​​of the Cool signal (CAN message ID 83) and the PowerStatus signal (CAN message ID 144) are extracted from the raw data. Optionally, the timestamps corresponding to the values ​​of the above signals are aligned and padded to obtain the target data. Since the transmission frequencies of different signals are inconsistent, for example, ID 83 is transmitted once per second, and ID 144 is transmitted once every 5 seconds, the signal corresponding to ID 144 needs to be aligned and padded down according to the frequency of the signal corresponding to ID 83 to ensure that all signals to be detected exist at each moment for anomaly detection and judgment.

[0113] Then, the detection results are obtained by comparing the target data with the rule description information. For example, by comparing the target data with the value range of the rule description information one by one, an anomaly is reported when the value of the target data is found to be consistent with the range of the rule description information and the duration meets the requirements.

[0114] Figure 4 shows a schematic diagram of another anomaly detection method provided in an embodiment of this application. Exemplarily, the executing entity of this anomaly detection method is an electronic device (such as a computer). The method may include the following steps:

[0115] S1. The user inputs an anomaly detection request into the electronic device. The request includes the selected CAN data packet (message) and vehicle model.

[0116] For example, a user enters the above-mentioned anomaly detection request in the tool interface corresponding to the electronic device.

[0117] S2. The electronic device parses the CAN message according to the DBC file (i.e. the aforementioned first file and second file) to obtain the data to be detected, which is structured data.

[0118] The DBC file, a description file for CAN data, is essential for correctly parsing CAN messages. Therefore, electronic devices need to have pre-installed DBC files for different versions of each vehicle model. When a user selects a vehicle model, the electronic device uses this model information to locate the necessary DBC file for parsing CAN messages, and then uses it to parse the raw CAN data into structured data for easier subsequent analysis.

[0119] For example, an electronic device sends a parsing task to its CAN message analysis function.

[0120] Optionally, if the CAN message is a compressed file, the CAN message analysis function sends the CAN data packet to the decompression program for decompression. The decompression program then returns the decompressed CAN message.

[0121] For a description of this step, please refer to the description of step 203 in the embodiment shown in Figure 2, which will not be repeated here.

[0122] S3. The electronic device determines the scanning result based on the rule description information and the data to be detected.

[0123] In one possible implementation, the CAN message analysis function sends a scan request to the scan rule file, filters the vehicle model-related scan rules, and obtains the filtered rules (i.e., rule description information). Then, the CAN message analysis function scans the parsed CAN messages (data to be detected) according to the filtered rules, obtaining the scan result (i.e., anomaly detection result). The CAN message analysis function returns the scan result to an electronic device (such as a tool interface).

[0124] Optionally, the electronic device sends an insertion request to the detection history module to insert the scan result into the scan history database.

[0125] S4. The electronic device displays the scan results to the user.

[0126] In one possible implementation, the electronic device can display progress information on the interface throughout the detection process, such as the current step and the percentage of progress.

[0127] It should be noted that this application uses vehicle anomaly detection as an example for illustration. This solution can also be applied to feature description and lookup based on other table-type data sources. For example, in equipment operation status monitoring scenarios, the collected data can be stored in a database. By configuring the fields to be monitored and then performing data scanning, highly flexible equipment anomaly monitoring and alarms can be achieved.

[0128] It should be noted that, in the various embodiments of this application, unless otherwise specified or in case of logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0129] The methods of the embodiments of this application have been described in detail above, and the apparatus of the embodiments of this application is provided below. It is understood that the division of multiple units or modules in the various apparatus embodiments of this application is only a logical division based on function and is not intended to limit the specific structure of the apparatus. In specific implementations, some functional modules may be subdivided into more smaller functional modules, and some functional modules may be combined into a single functional module. However, regardless of whether these functional modules are subdivided or combined, the general flow executed by the apparatus is the same. For example, some apparatuses include a receiving unit and a transmitting unit. In some designs, the transmitting unit and the receiving unit can also be integrated into a communication unit, which can implement the functions implemented by the receiving unit and the transmitting unit. Typically, each unit corresponds to its own program code (or program instructions). When the program code corresponding to each unit runs on the processor, it causes the unit to be controlled by the processing unit to execute the corresponding flow and thus achieve the corresponding function.

[0130] This application also provides an apparatus for implementing any of the above methods. For example, an anomaly detection apparatus includes modules (or means) for implementing the steps performed by the server in any of the above methods.

[0131] For example, referring to FIG5, which is a schematic diagram of an anomaly detection device provided in an embodiment of this application, the anomaly detection device is used to implement the aforementioned anomaly detection method, such as the anomaly detection method shown in FIG2.

[0132] As shown in Figure 5, the device may include a first acquisition module 501, a second acquisition module 502, a processing module 503, and a detection module 504, as detailed below:

[0133] The first acquisition module 501 is used to acquire rule description information, which is used to indicate the target message ID and anomaly judgment conditions.

[0134] The second acquisition module 502 is used to acquire a message, the message corresponding to at least one first file, the first file being used to manage the information contained in the message;

[0135] Processing module 503 is used to parse the message based on the target message ID and the at least one first file to obtain data to be detected, wherein the data to be detected is structured data;

[0136] The detection module 504 is used to determine the anomaly detection result based on the anomaly judgment conditions and the data to be detected.

[0137] In one possible implementation, the anomaly detection conditions include the signal corresponding to the target message ID and a description of the anomaly range of the signal value.

[0138] In one possible implementation, the apparatus further includes a third acquisition module, the third acquisition module being used for:

[0139] Obtain the signal value of the signal corresponding to the target message ID from the data to be detected;

[0140] The detection module 504 is specifically used to: determine the anomaly detection result based on the description of the abnormal range of the signal value and the signal value of the signal corresponding to the target message ID.

[0141] In one possible implementation, the anomaly detection condition also includes duration.

[0142] In one possible implementation, the detection module 504 is specifically used to: determine the anomaly detection result based at least on the timestamp corresponding to each piece of data in the data to be detected and the duration.

[0143] In one possible implementation, the exception detection condition also includes the number of exceptions.

[0144] In one possible implementation, the detection module 504 is specifically used for:

[0145] The data to be detected is determined to be abnormal when the number of times it is determined to be abnormal is not less than the number of abnormal data.

[0146] In one possible implementation, the processing module 503 is specifically used for:

[0147] Obtain a second file corresponding to the target message ID from at least one first file;

[0148] The message is parsed based on the second file to obtain the data to be detected.

[0149] In one possible implementation, there are multiple target message IDs, and multiple messages corresponding to the target message IDs are associated with the same anomaly.

[0150] For a description of each of the above modules, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0151] It should be understood that the division of modules in the above devices is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, the modules in the anomaly detection device can be implemented by a processor calling software; for example, the anomaly detection device includes a processor connected to a memory containing instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of each module of the device. The processor can be, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory can be internal or external to the device. Alternatively, the modules in the device can be implemented as hardware circuits. The functionality of some or all units can be achieved through the design of these hardware circuits, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC), and the functionality of some or all of the above units is achieved through the design of the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a programmable logic device (PLD), such as a field-programmable gate array (FPGA), which can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files, thereby achieving the functionality of some or all of the above units. All modules of the above device can be implemented entirely through processor-called software, entirely through hardware circuits, or partially through processor-called software with the remaining parts implemented through hardware circuits.

[0152] Referring to Figure 6, a hardware structure diagram of another anomaly detection device provided in this application embodiment is shown. The anomaly detection device 600 shown in Figure 6 (specifically, this device 600 can be a computer device) includes a memory 601, a processor 602, a communication interface 603, and a bus 604. The memory 601, processor 602, and communication interface 603 are interconnected via the bus 604.

[0153] The memory 601 may be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM).

[0154] The memory 601 can store programs. When the program stored in the memory 601 is executed by the processor 602, the processor 602 and the communication interface 603 are used to execute the various steps of the anomaly detection method of the present application embodiment.

[0155] Processor 602 is a circuit with signal processing capabilities. In one implementation, processor 602 can be a circuit with instruction read and execute capabilities, such as a central processing unit (CPU), microprocessor, graphics processing unit (GPU) (which can be understood as a type of microprocessor), or digital signal processor (DSP). In another implementation, processor 602 can implement certain functions through the logical relationships of hardware circuits. These logical relationships of hardware circuits are fixed or reconfigurable. For example, processor 602 can be a hardware circuit implemented as an ASIC or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the processor loading instructions to implement the functions of some or all of the above units. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as a type of ASIC, such as a neural network processing unit (NPU), tensor processing unit (TPU), or deep learning processing unit (DPU). The processor 602 is used to execute related programs to implement the functions required by the units in the anomaly detection device of this application embodiment, or to execute the anomaly detection method of the method embodiment of this application.

[0156] As can be seen, each unit in the above device can be one or more processors (or processing circuits) configured to implement the above methods, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0157] Furthermore, the units in the above devices can be integrated in whole or in part, or they can be implemented independently. In one implementation, these units are integrated together as a system-on-a-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or implementing the functions of the units in the device. The at least one processor may be of different types, such as CPU and FPGA, CPU and artificial intelligence processor, CPU and GPU, etc.

[0158] The communication interface 603 uses transceiver devices, such as, but not limited to, transceivers, to enable communication between the device 600 and other devices or communication networks. For example, data can be acquired through the communication interface 603.

[0159] Bus 604 may include a pathway for transmitting information between various components of device 600 (e.g., memory 601, processor 602, communication interface 603).

[0160] It should be noted that although the device 600 shown in Figure 6 only illustrates the memory, processor, and communication interface, those skilled in the art should understand that in specific implementations, device 600 may also include other devices necessary for normal operation. Furthermore, depending on specific needs, those skilled in the art should understand that device 600 may also include hardware devices for implementing other additional functions. Moreover, those skilled in the art should understand that device 600 may only include the devices necessary for implementing the embodiments of this application, and not necessarily all the devices shown in Figure 6.

[0161] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform one or more steps of any of the above methods.

[0162] This application also provides a computer program product containing instructions. When the computer program product is run on a computer or processor, it causes the computer or processor to perform one or more steps of any of the methods described above.

[0163] It is understood that in this application, "instruction" can include direct instruction, indirect instruction, explicit instruction, and implicit instruction. When describing a certain instruction information to indicate A, it can be understood that the instruction information carries A, directly indicates A, or indirectly indicates A. In this application, the information indicated by the instruction information is called the information to be instructed. In specific implementation, there are many ways to indicate the information to be instructed, such as, but not limited to, directly indicating the information to be instructed, such as the information to be instructed itself or its index, or indirectly indicating the information to be instructed by indicating other information, wherein there is an association between the other information and the information to be instructed. It is also possible to indicate only a part of the information to be instructed, while the other parts of the information to be instructed are known or agreed upon in advance. For example, the instruction of specific information can also be achieved by using the arrangement order of various information in advance (e.g., as specified by a protocol), thereby reducing the instruction overhead to a certain extent. The information to be instructed can be sent as a whole or divided into multiple sub-information to be sent separately, and the sending period and / or sending time of these sub-information can be the same or different. This application does not limit the specific sending method. The sending period and / or timing of these sub-information messages can be predefined, for example, according to a protocol, or configured by the transmitting device by sending configuration information to the receiving device.

[0164] The term "at least one" as used in this application refers to one or more items. "More than one item" means two or more items. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. Furthermore, it should be understood that although the terms "first," "second," etc., may be used in this application to describe various objects, these objects should not be limited to these terms. These terms are only used to distinguish the objects from each other.

[0165] The terms "comprising" and "having," and any variations thereof, used in this application as described below, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units not listed, or optionally include other steps or units inherent to such processes, methods, products, or apparatus. It should be noted that in this application, words such as "exemplary" or "for example" are used to indicate illustrative, exemplary, or descriptive purposes. Any method or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other methods or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0166] It should be understood that in the description of this application, unless otherwise stated, " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B can represent A or B; where A and B can be singular or plural. Furthermore, in the description of this application, unless otherwise stated, "multiple" refers to two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple. Additionally, to facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and the terms "first" and "second" do not necessarily imply difference. In this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being better or more advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner to facilitate understanding.

[0167] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the division of units is merely a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The coupling, direct coupling, or communication connection shown or discussed between each other may be indirect coupling or communication connection through some interfaces, apparatuses, or units, and may be electrical, mechanical, or other forms.

[0168] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0169] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid-state disks (SSDs).

[0170] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. An anomaly detection method, characterized in that, include: Obtain rule description information, which is used to indicate the target packet identifier ID and anomaly judgment conditions; Acquire a message, the message corresponding to at least one first file, the first file being used to manage the information contained in the message; Based on the target message ID and the at least one first file, the message is parsed to obtain the data to be detected, wherein the data to be detected is structured data; Based on the anomaly detection conditions and the data to be detected, the anomaly detection result is determined.

2. The method according to claim 1, characterized in that, The anomaly detection criteria include the signal corresponding to the target message ID and a description of the anomaly range of the signal value.

3. The method according to claim 2, characterized in that, The method further includes: Obtain the signal value of the signal corresponding to the target message ID from the data to be detected; The step of determining the anomaly detection result based on the anomaly judgment conditions and the data to be detected includes: The anomaly detection result is determined based on the description of the abnormal range of the signal value and the signal value of the signal corresponding to the target message ID.

4. The method according to claim 2 or 3, characterized in that, The anomaly detection criteria also include duration.

5. The method according to claim 4, characterized in that, The step of determining the anomaly detection result based on the anomaly judgment conditions and the data to be detected includes: The anomaly detection result is determined based at least on the timestamp corresponding to each piece of data in the data to be detected and the duration.

6. The method according to any one of claims 2 to 5, characterized in that, The anomaly detection criteria also include the number of anomalies.

7. The method according to claim 6, characterized in that, The step of determining the anomaly detection result based on the anomaly judgment conditions and the data to be detected includes: The data to be detected is determined to be abnormal when the number of times it is determined to be abnormal is not less than the number of abnormal data.

8. The method according to any one of claims 1 to 7, characterized in that, The step of parsing the message based on the target message ID and the at least one first file to obtain the data to be detected includes: Obtain a second file corresponding to the target message ID from at least one first file; The message is parsed based on the second file to obtain the data to be detected.

9. The method according to any one of claims 1 to 8, characterized in that, There are multiple target message IDs, and multiple messages corresponding to the target message IDs are associated with the same anomaly.

10. An anomaly detection device, characterized in that, include: The first acquisition module is used to acquire rule description information, which is used to indicate the target message identifier ID and the anomaly judgment conditions. The second acquisition module is used to acquire a message, the message corresponding to at least one first file, the first file being used to manage the information contained in the message; The processing module is used to parse the message based on the target message ID and the at least one first file to obtain the data to be detected, wherein the data to be detected is structured data; The detection module is used to determine the anomaly detection result based on the anomaly judgment conditions and the data to be detected.

11. The apparatus according to claim 10, characterized in that, The anomaly detection criteria include the signal corresponding to the target message ID and a description of the anomaly range of the signal value.

12. The apparatus according to claim 11, characterized in that, The device further includes a third acquisition module, the third acquisition module being used for: Obtain the signal value of the signal corresponding to the target message ID from the data to be detected; The detection module is specifically used to: determine the anomaly detection result based on the description of the abnormal range of the signal value and the signal value of the signal corresponding to the target message ID.

13. The apparatus according to claim 11 or 12, characterized in that, The anomaly detection criteria also include duration.

14. The apparatus according to claim 13, characterized in that, The detection module is specifically used to: determine the anomaly detection result based at least on the timestamp corresponding to each piece of data in the data to be detected and the duration.

15. The apparatus according to any one of claims 11 to 14, characterized in that, The anomaly detection criteria also include the number of anomalies.

16. The apparatus according to claim 15, characterized in that, The detection module is specifically used for: The data to be detected is determined to be abnormal when the number of times it is determined to be abnormal is not less than the number of abnormal data.

17. The apparatus according to any one of claims 10 to 16, characterized in that, The processing module is specifically used for: Obtain a second file corresponding to the target message ID from at least one first file; The message is parsed based on the second file to obtain the data to be detected.

18. The apparatus according to any one of claims 10 to 17, characterized in that, There are multiple target message IDs, and multiple messages corresponding to the target message IDs are associated with the same anomaly.

19. An anomaly detection device, characterized in that, The device includes a processor and a memory, the processor being configured to cause the device to perform the method as described in any one of claims 1-9 by executing a computer program or computer-executable instructions stored in the memory, and / or by logic circuitry.

20. A computer-readable storage medium, characterized in that, The system contains a computer program that, when executed by a processor, causes the method described in any one of claims 1-9 to be implemented.

21. A computer program product comprising instructions that, when run on a processor, cause the method as described in any one of claims 1-9 to be implemented.

Images